source4/dsdb/samdb/ldb_modules/repl_meta_data.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Simo Sorce  2004-2008
   5    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
   6    Copyright (C) Andrew Tridgell 2005
   7    Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
   8    Copyright (C) Matthieu Patou <mat@samba.org> 2010
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 /*
  25  *  Name: ldb
  26  *
  27  *  Component: ldb repl_meta_data module
  28  *
  29  *  Description: - add a unique objectGUID onto every new record,
  30  *               - handle whenCreated, whenChanged timestamps
  31  *               - handle uSNCreated, uSNChanged numbers
  32  *               - handle replPropertyMetaData attribute
  33  *
  34  *  Author: Simo Sorce
  35  *  Author: Stefan Metzmacher
  36  */
  37
  38 #include "includes.h"
  39 #include "ldb_module.h"
  40 #include "dsdb/samdb/samdb.h"
  41 #include "dsdb/common/proto.h"
  42 #include "../libds/common/flags.h"
  43 #include "librpc/gen_ndr/ndr_misc.h"
  44 #include "librpc/gen_ndr/ndr_drsuapi.h"
  45 #include "librpc/gen_ndr/ndr_drsblobs.h"
  46 #include "param/param.h"
  47 #include "libcli/security/security.h"
  48 #include "lib/util/dlinklist.h"
  49 #include "dsdb/samdb/ldb_modules/util.h"
  50 #include "lib/util/binsearch.h"
  51 #include "lib/util/tsort.h"
  52
  53 struct replmd_private {
  54         TALLOC_CTX *la_ctx;
  55         struct la_entry *la_list;
  56         TALLOC_CTX *bl_ctx;
  57         struct la_backlink *la_backlinks;
  58         struct nc_entry {
  59                 struct nc_entry *prev, *next;
  60                 struct ldb_dn *dn;
  61                 uint64_t mod_usn;
  62                 uint64_t mod_usn_urgent;
  63         } *ncs;
  64 };
  65
  66 struct la_entry {
  67         struct la_entry *next, *prev;
  68         struct drsuapi_DsReplicaLinkedAttribute *la;
  69 };
  70
  71 struct replmd_replicated_request {
  72         struct ldb_module *module;
  73         struct ldb_request *req;
  74
  75         const struct dsdb_schema *schema;
  76
  77         /* the controls we pass down */
  78         struct ldb_control **controls;
  79
  80         /* details for the mode where we apply a bunch of inbound replication meessages */
  81         bool apply_mode;
  82         uint32_t index_current;
  83         struct dsdb_extended_replicated_objects *objs;
  84
  85         struct ldb_message *search_msg;
  86
  87         uint64_t seq_num;
  88         bool is_urgent;
  89 };
  90
  91 enum urgent_situation {
  92         REPL_URGENT_ON_CREATE = 1,
  93         REPL_URGENT_ON_UPDATE = 2,
  94         REPL_URGENT_ON_DELETE = 4
  95 };
  96
  97
  98 static const struct {
  99         const char *update_name;
 100         enum urgent_situation repl_situation;
 101 } urgent_objects[] = {
 102                 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
 103                 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
 104                 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
 105                 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
 106                 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
 107                 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
 108                 {NULL, 0}
 109 };
 110
 111 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
 112 static const char *urgent_attrs[] = {
 113                 "lockoutTime",
 114                 "pwdLastSet",
 115                 "userAccountControl",
 116                 NULL
 117 };
 118
 119
 120 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
 121                                         enum urgent_situation situation)
 122 {
 123         unsigned int i, j;
 124         for (i=0; urgent_objects[i].update_name; i++) {
 125
 126                 if ((situation & urgent_objects[i].repl_situation) == 0) {
 127                         continue;
 128                 }
 129
 130                 for (j=0; j<objectclass_el->num_values; j++) {
 131                         const struct ldb_val *v = &objectclass_el->values[j];
 132                         if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
 133                                 return true;
 134                         }
 135                 }
 136         }
 137         return false;
 138 }
 139
 140 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
 141 {
 142         if (ldb_attr_in_list(urgent_attrs, el->name)) {
 143                 return true;
 144         }
 145         return false;
 146 }
 147
 148
 149 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
 150
 151 /*
 152   initialise the module
 153   allocate the private structure and build the list
 154   of partition DNs for use by replmd_notify()
 155  */
 156 static int replmd_init(struct ldb_module *module)
 157 {
 158         struct replmd_private *replmd_private;
 159         struct ldb_context *ldb = ldb_module_get_ctx(module);
 160
 161         replmd_private = talloc_zero(module, struct replmd_private);
 162         if (replmd_private == NULL) {
 163                 ldb_oom(ldb);
 164                 return LDB_ERR_OPERATIONS_ERROR;
 165         }
 166         ldb_module_set_private(module, replmd_private);
 167
 168         return ldb_next_init(module);
 169 }
 170
 171 /*
 172   cleanup our per-transaction contexts
 173  */
 174 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
 175 {
 176         talloc_free(replmd_private->la_ctx);
 177         replmd_private->la_list = NULL;
 178         replmd_private->la_ctx = NULL;
 179
 180         talloc_free(replmd_private->bl_ctx);
 181         replmd_private->la_backlinks = NULL;
 182         replmd_private->bl_ctx = NULL;
 183 }
 184
 185
 186 struct la_backlink {
 187         struct la_backlink *next, *prev;
 188         const char *attr_name;
 189         struct GUID forward_guid, target_guid;
 190         bool active;
 191 };
 192
 193 /*
 194   process a backlinks we accumulated during a transaction, adding and
 195   deleting the backlinks from the target objects
 196  */
 197 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl, struct ldb_request *parent)
 198 {
 199         struct ldb_dn *target_dn, *source_dn;
 200         int ret;
 201         struct ldb_context *ldb = ldb_module_get_ctx(module);
 202         struct ldb_message *msg;
 203         TALLOC_CTX *tmp_ctx = talloc_new(bl);
 204         char *dn_string;
 205
 206         /*
 207           - find DN of target
 208           - find DN of source
 209           - construct ldb_message
 210               - either an add or a delete
 211          */
 212         ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn, parent);
 213         if (ret != LDB_SUCCESS) {
 214                 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
 215                          GUID_string(bl, &bl->target_guid)));
 216                 return LDB_SUCCESS;
 217         }
 218
 219         ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn, parent);
 220         if (ret != LDB_SUCCESS) {
 221                 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
 222                                        GUID_string(bl, &bl->forward_guid));
 223                 talloc_free(tmp_ctx);
 224                 return ret;
 225         }
 226
 227         msg = ldb_msg_new(tmp_ctx);
 228         if (msg == NULL) {
 229                 ldb_module_oom(module);
 230                 talloc_free(tmp_ctx);
 231                 return LDB_ERR_OPERATIONS_ERROR;
 232         }
 233
 234         /* construct a ldb_message for adding/deleting the backlink */
 235         msg->dn = target_dn;
 236         dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
 237         if (!dn_string) {
 238                 ldb_module_oom(module);
 239                 talloc_free(tmp_ctx);
 240                 return LDB_ERR_OPERATIONS_ERROR;
 241         }
 242         ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
 243         if (ret != LDB_SUCCESS) {
 244                 talloc_free(tmp_ctx);
 245                 return ret;
 246         }
 247         msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
 248
 249         /* a backlink should never be single valued. Unfortunately the
 250            exchange schema has a attribute
 251            msExchBridgeheadedLocalConnectorsDNBL which is single
 252            valued and a backlink. We need to cope with that by
 253            ignoring the single value flag */
 254         msg->elements[0].flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
 255
 256         ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
 257         if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE && !bl->active) {
 258                 /* we allow LDB_ERR_NO_SUCH_ATTRIBUTE as success to
 259                    cope with possible corruption where the backlink has
 260                    already been removed */
 261                 DEBUG(0,("WARNING: backlink from %s already removed from %s - %s\n",
 262                          ldb_dn_get_linearized(target_dn),
 263                          ldb_dn_get_linearized(source_dn),
 264                          ldb_errstring(ldb)));
 265                 ret = LDB_SUCCESS;
 266         } else if (ret != LDB_SUCCESS) {
 267                 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
 268                                        bl->active?"add":"remove",
 269                                        ldb_dn_get_linearized(source_dn),
 270                                        ldb_dn_get_linearized(target_dn),
 271                                        ldb_errstring(ldb));
 272                 talloc_free(tmp_ctx);
 273                 return ret;
 274         }
 275         talloc_free(tmp_ctx);
 276         return ret;
 277 }
 278
 279 /*
 280   add a backlink to the list of backlinks to add/delete in the prepare
 281   commit
 282  */
 283 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
 284                                struct GUID *forward_guid, struct GUID *target_guid,
 285                                bool active, const struct dsdb_attribute *schema_attr, bool immediate)
 286 {
 287         const struct dsdb_attribute *target_attr;
 288         struct la_backlink *bl;
 289         struct replmd_private *replmd_private =
 290                 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
 291
 292         target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
 293         if (!target_attr) {
 294                 /*
 295                  * windows 2003 has a broken schema where the
 296                  * definition of msDS-IsDomainFor is missing (which is
 297                  * supposed to be the backlink of the
 298                  * msDS-HasDomainNCs attribute
 299                  */
 300                 return LDB_SUCCESS;
 301         }
 302
 303         /* see if its already in the list */
 304         for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
 305                 if (GUID_equal(forward_guid, &bl->forward_guid) &&
 306                     GUID_equal(target_guid, &bl->target_guid) &&
 307                     (target_attr->lDAPDisplayName == bl->attr_name ||
 308                      strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
 309                         break;
 310                 }
 311         }
 312
 313         if (bl) {
 314                 /* we found an existing one */
 315                 if (bl->active == active) {
 316                         return LDB_SUCCESS;
 317                 }
 318                 DLIST_REMOVE(replmd_private->la_backlinks, bl);
 319                 talloc_free(bl);
 320                 return LDB_SUCCESS;
 321         }
 322
 323         if (replmd_private->bl_ctx == NULL) {
 324                 replmd_private->bl_ctx = talloc_new(replmd_private);
 325                 if (replmd_private->bl_ctx == NULL) {
 326                         ldb_module_oom(module);
 327                         return LDB_ERR_OPERATIONS_ERROR;
 328                 }
 329         }
 330
 331         /* its a new one */
 332         bl = talloc(replmd_private->bl_ctx, struct la_backlink);
 333         if (bl == NULL) {
 334                 ldb_module_oom(module);
 335                 return LDB_ERR_OPERATIONS_ERROR;
 336         }
 337
 338         /* Ensure the schema does not go away before the bl->attr_name is used */
 339         if (!talloc_reference(bl, schema)) {
 340                 talloc_free(bl);
 341                 ldb_module_oom(module);
 342                 return LDB_ERR_OPERATIONS_ERROR;
 343         }
 344
 345         bl->attr_name = target_attr->lDAPDisplayName;
 346         bl->forward_guid = *forward_guid;
 347         bl->target_guid = *target_guid;
 348         bl->active = active;
 349
 350         /* the caller may ask for this backlink to be processed
 351            immediately */
 352         if (immediate) {
 353                 int ret = replmd_process_backlink(module, bl, NULL);
 354                 talloc_free(bl);
 355                 return ret;
 356         }
 357
 358         DLIST_ADD(replmd_private->la_backlinks, bl);
 359
 360         return LDB_SUCCESS;
 361 }
 362
 363
 364 /*
 365  * Callback for most write operations in this module:
 366  *
 367  * notify the repl task that a object has changed. The notifies are
 368  * gathered up in the replmd_private structure then written to the
 369  * @REPLCHANGED object in each partition during the prepare_commit
 370  */
 371 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
 372 {
 373         int ret;
 374         struct replmd_replicated_request *ac =
 375                 talloc_get_type_abort(req->context, struct replmd_replicated_request);
 376         struct replmd_private *replmd_private =
 377                 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
 378         struct nc_entry *modified_partition;
 379         struct ldb_control *partition_ctrl;
 380         const struct dsdb_control_current_partition *partition;
 381
 382         struct ldb_control **controls;
 383
 384         partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
 385
 386         controls = ares->controls;
 387         if (ldb_request_get_control(ac->req,
 388                                     DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
 389                 /*
 390                  * Remove the current partition control from what we pass up
 391                  * the chain if it hasn't been requested manually.
 392                  */
 393                 controls = ldb_controls_except_specified(ares->controls, ares,
 394                                                          partition_ctrl);
 395         }
 396
 397         if (ares->error != LDB_SUCCESS) {
 398                 DEBUG(0,("%s failure. Error is: %s\n", __FUNCTION__, ldb_strerror(ares->error)));
 399                 return ldb_module_done(ac->req, controls,
 400                                         ares->response, ares->error);
 401         }
 402
 403         if (ares->type != LDB_REPLY_DONE) {
 404                 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
 405                 return ldb_module_done(ac->req, NULL,
 406                                        NULL, LDB_ERR_OPERATIONS_ERROR);
 407         }
 408
 409         if (!partition_ctrl) {
 410                 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
 411                 return ldb_module_done(ac->req, NULL,
 412                                        NULL, LDB_ERR_OPERATIONS_ERROR);
 413         }
 414
 415         partition = talloc_get_type_abort(partition_ctrl->data,
 416                                     struct dsdb_control_current_partition);
 417
 418         if (ac->seq_num > 0) {
 419                 for (modified_partition = replmd_private->ncs; modified_partition;
 420                      modified_partition = modified_partition->next) {
 421                         if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
 422                                 break;
 423                         }
 424                 }
 425
 426                 if (modified_partition == NULL) {
 427                         modified_partition = talloc_zero(replmd_private, struct nc_entry);
 428                         if (!modified_partition) {
 429                                 ldb_oom(ldb_module_get_ctx(ac->module));
 430                                 return ldb_module_done(ac->req, NULL,
 431                                                        NULL, LDB_ERR_OPERATIONS_ERROR);
 432                         }
 433                         modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
 434                         if (!modified_partition->dn) {
 435                                 ldb_oom(ldb_module_get_ctx(ac->module));
 436                                 return ldb_module_done(ac->req, NULL,
 437                                                        NULL, LDB_ERR_OPERATIONS_ERROR);
 438                         }
 439                         DLIST_ADD(replmd_private->ncs, modified_partition);
 440                 }
 441
 442                 if (ac->seq_num > modified_partition->mod_usn) {
 443                         modified_partition->mod_usn = ac->seq_num;
 444                         if (ac->is_urgent) {
 445                                 modified_partition->mod_usn_urgent = ac->seq_num;
 446                         }
 447                 }
 448         }
 449
 450         if (ac->apply_mode) {
 451                 talloc_free(ares);
 452                 ac->index_current++;
 453
 454                 ret = replmd_replicated_apply_next(ac);
 455                 if (ret != LDB_SUCCESS) {
 456                         return ldb_module_done(ac->req, NULL, NULL, ret);
 457                 }
 458                 return ret;
 459         } else {
 460                 /* free the partition control container here, for the
 461                  * common path.  Other cases will have it cleaned up
 462                  * eventually with the ares */
 463                 talloc_free(partition_ctrl);
 464                 return ldb_module_done(ac->req, controls,
 465                                        ares->response, LDB_SUCCESS);
 466         }
 467 }
 468
 469
 470 /*
 471  * update a @REPLCHANGED record in each partition if there have been
 472  * any writes of replicated data in the partition
 473  */
 474 static int replmd_notify_store(struct ldb_module *module, struct ldb_request *parent)
 475 {
 476         struct replmd_private *replmd_private =
 477                 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
 478
 479         while (replmd_private->ncs) {
 480                 int ret;
 481                 struct nc_entry *modified_partition = replmd_private->ncs;
 482
 483                 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
 484                                                      modified_partition->mod_usn,
 485                                                      modified_partition->mod_usn_urgent, parent);
 486                 if (ret != LDB_SUCCESS) {
 487                         DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
 488                                  ldb_dn_get_linearized(modified_partition->dn)));
 489                         return ret;
 490                 }
 491                 DLIST_REMOVE(replmd_private->ncs, modified_partition);
 492                 talloc_free(modified_partition);
 493         }
 494
 495         return LDB_SUCCESS;
 496 }
 497
 498
 499 /*
 500   created a replmd_replicated_request context
 501  */
 502 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
 503                                                          struct ldb_request *req)
 504 {
 505         struct ldb_context *ldb;
 506         struct replmd_replicated_request *ac;
 507
 508         ldb = ldb_module_get_ctx(module);
 509
 510         ac = talloc_zero(req, struct replmd_replicated_request);
 511         if (ac == NULL) {
 512                 ldb_oom(ldb);
 513                 return NULL;
 514         }
 515
 516         ac->module = module;
 517         ac->req = req;
 518
 519         ac->schema = dsdb_get_schema(ldb, ac);
 520         if (!ac->schema) {
 521                 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
 522                               "replmd_modify: no dsdb_schema loaded");
 523                 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
 524                 return NULL;
 525         }
 526
 527         return ac;
 528 }
 529
 530 /*
 531   add a time element to a record
 532 */
 533 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
 534 {
 535         struct ldb_message_element *el;
 536         char *s;
 537         int ret;
 538
 539         if (ldb_msg_find_element(msg, attr) != NULL) {
 540                 return LDB_SUCCESS;
 541         }
 542
 543         s = ldb_timestring(msg, t);
 544         if (s == NULL) {
 545                 return LDB_ERR_OPERATIONS_ERROR;
 546         }
 547
 548         ret = ldb_msg_add_string(msg, attr, s);
 549         if (ret != LDB_SUCCESS) {
 550                 return ret;
 551         }
 552
 553         el = ldb_msg_find_element(msg, attr);
 554         /* always set as replace. This works because on add ops, the flag
 555            is ignored */
 556         el->flags = LDB_FLAG_MOD_REPLACE;
 557
 558         return LDB_SUCCESS;
 559 }
 560
 561 /*
 562   add a uint64_t element to a record
 563 */
 564 static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
 565                               const char *attr, uint64_t v)
 566 {
 567         struct ldb_message_element *el;
 568         int ret;
 569
 570         if (ldb_msg_find_element(msg, attr) != NULL) {
 571                 return LDB_SUCCESS;
 572         }
 573
 574         ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
 575         if (ret != LDB_SUCCESS) {
 576                 return ret;
 577         }
 578
 579         el = ldb_msg_find_element(msg, attr);
 580         /* always set as replace. This works because on add ops, the flag
 581            is ignored */
 582         el->flags = LDB_FLAG_MOD_REPLACE;
 583
 584         return LDB_SUCCESS;
 585 }
 586
 587 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
 588                                                    const struct replPropertyMetaData1 *m2,
 589                                                    const uint32_t *rdn_attid)
 590 {
 591         if (m1->attid == m2->attid) {
 592                 return 0;
 593         }
 594
 595         /*
 596          * the rdn attribute should be at the end!
 597          * so we need to return a value greater than zero
 598          * which means m1 is greater than m2
 599          */
 600         if (m1->attid == *rdn_attid) {
 601                 return 1;
 602         }
 603
 604         /*
 605          * the rdn attribute should be at the end!
 606          * so we need to return a value less than zero
 607          * which means m2 is greater than m1
 608          */
 609         if (m2->attid == *rdn_attid) {
 610                 return -1;
 611         }
 612
 613         return m1->attid > m2->attid ? 1 : -1;
 614 }
 615
 616 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
 617                                                 const struct dsdb_schema *schema,
 618                                                 struct ldb_dn *dn)
 619 {
 620         const char *rdn_name;
 621         const struct dsdb_attribute *rdn_sa;
 622
 623         rdn_name = ldb_dn_get_rdn_name(dn);
 624         if (!rdn_name) {
 625                 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
 626                 return LDB_ERR_OPERATIONS_ERROR;
 627         }
 628
 629         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
 630         if (rdn_sa == NULL) {
 631                 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
 632                 return LDB_ERR_OPERATIONS_ERROR;
 633         }
 634
 635         DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
 636                  rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
 637
 638         LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
 639
 640         return LDB_SUCCESS;
 641 }
 642
 643 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
 644                                                  const struct ldb_message_element *e2,
 645                                                  const struct dsdb_schema *schema)
 646 {
 647         const struct dsdb_attribute *a1;
 648         const struct dsdb_attribute *a2;
 649
 650         /*
 651          * TODO: make this faster by caching the dsdb_attribute pointer
 652          *       on the ldb_messag_element
 653          */
 654
 655         a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
 656         a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
 657
 658         /*
 659          * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
 660          *       in the schema
 661          */
 662         if (!a1 || !a2) {
 663                 return strcasecmp(e1->name, e2->name);
 664         }
 665         if (a1->attributeID_id == a2->attributeID_id) {
 666                 return 0;
 667         }
 668         return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
 669 }
 670
 671 static void replmd_ldb_message_sort(struct ldb_message *msg,
 672                                     const struct dsdb_schema *schema)
 673 {
 674         LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
 675 }
 676
 677 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
 678                                const struct GUID *invocation_id, uint64_t seq_num,
 679                                uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
 680
 681
 682 /*
 683   fix up linked attributes in replmd_add.
 684   This involves setting up the right meta-data in extended DN
 685   components, and creating backlinks to the object
 686  */
 687 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
 688                              uint64_t seq_num, const struct GUID *invocationId, time_t t,
 689                              struct GUID *guid, const struct dsdb_attribute *sa, struct ldb_request *parent)
 690 {
 691         unsigned int i;
 692         TALLOC_CTX *tmp_ctx = talloc_new(el->values);
 693         struct ldb_context *ldb = ldb_module_get_ctx(module);
 694
 695         /* We will take a reference to the schema in replmd_add_backlink */
 696         const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
 697         NTTIME now;
 698
 699         unix_to_nt_time(&now, t);
 700
 701         for (i=0; i<el->num_values; i++) {
 702                 struct ldb_val *v = &el->values[i];
 703                 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
 704                 struct GUID target_guid;
 705                 NTSTATUS status;
 706                 int ret;
 707
 708                 /* note that the DN already has the extended
 709                    components from the extended_dn_store module */
 710                 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
 711                 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
 712                         ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid, parent);
 713                         if (ret != LDB_SUCCESS) {
 714                                 talloc_free(tmp_ctx);
 715                                 return ret;
 716                         }
 717                         ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
 718                         if (ret != LDB_SUCCESS) {
 719                                 talloc_free(tmp_ctx);
 720                                 return ret;
 721                         }
 722                 }
 723
 724                 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
 725                                           seq_num, seq_num, now, 0, false);
 726                 if (ret != LDB_SUCCESS) {
 727                         talloc_free(tmp_ctx);
 728                         return ret;
 729                 }
 730
 731                 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
 732                 if (ret != LDB_SUCCESS) {
 733                         talloc_free(tmp_ctx);
 734                         return ret;
 735                 }
 736         }
 737
 738         talloc_free(tmp_ctx);
 739         return LDB_SUCCESS;
 740 }
 741
 742
 743 /*
 744   intercept add requests
 745  */
 746 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
 747 {
 748         struct ldb_context *ldb;
 749         struct ldb_control *control;
 750         struct replmd_replicated_request *ac;
 751         enum ndr_err_code ndr_err;
 752         struct ldb_request *down_req;
 753         struct ldb_message *msg;
 754         const DATA_BLOB *guid_blob;
 755         struct GUID guid;
 756         struct replPropertyMetaDataBlob nmd;
 757         struct ldb_val nmd_value;
 758         const struct GUID *our_invocation_id;
 759         time_t t = time(NULL);
 760         NTTIME now;
 761         char *time_str;
 762         int ret;
 763         unsigned int i;
 764         unsigned int functional_level;
 765         uint32_t ni=0;
 766         bool allow_add_guid = false;
 767         bool remove_current_guid = false;
 768         bool is_urgent = false;
 769         struct ldb_message_element *objectclass_el;
 770
 771         /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
 772         control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
 773         if (control) {
 774                 allow_add_guid = true;
 775         }
 776
 777         /* do not manipulate our control entries */
 778         if (ldb_dn_is_special(req->op.add.message->dn)) {
 779                 return ldb_next_request(module, req);
 780         }
 781
 782         ldb = ldb_module_get_ctx(module);
 783
 784         ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
 785
 786         guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
 787         if (guid_blob != NULL) {
 788                 if (!allow_add_guid) {
 789                         ldb_set_errstring(ldb,
 790                                           "replmd_add: it's not allowed to add an object with objectGUID!");
 791                         return LDB_ERR_UNWILLING_TO_PERFORM;
 792                 } else {
 793                         NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
 794                         if (!NT_STATUS_IS_OK(status)) {
 795                                 ldb_set_errstring(ldb,
 796                                                   "replmd_add: Unable to parse the 'objectGUID' as a GUID!");
 797                                 return LDB_ERR_UNWILLING_TO_PERFORM;
 798                         }
 799                         /* we remove this attribute as it can be a string and
 800                          * will not be treated correctly and then we will re-add
 801                          * it later on in the good format */
 802                         remove_current_guid = true;
 803                 }
 804         } else {
 805                 /* a new GUID */
 806                 guid = GUID_random();
 807         }
 808
 809         ac = replmd_ctx_init(module, req);
 810         if (ac == NULL) {
 811                 return ldb_module_oom(module);
 812         }
 813
 814         functional_level = dsdb_functional_level(ldb);
 815
 816         /* Get a sequence number from the backend */
 817         ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
 818         if (ret != LDB_SUCCESS) {
 819                 talloc_free(ac);
 820                 return ret;
 821         }
 822
 823         /* get our invocationId */
 824         our_invocation_id = samdb_ntds_invocation_id(ldb);
 825         if (!our_invocation_id) {
 826                 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
 827                               "replmd_add: unable to find invocationId\n");
 828                 talloc_free(ac);
 829                 return LDB_ERR_OPERATIONS_ERROR;
 830         }
 831
 832         /* we have to copy the message as the caller might have it as a const */
 833         msg = ldb_msg_copy_shallow(ac, req->op.add.message);
 834         if (msg == NULL) {
 835                 ldb_oom(ldb);
 836                 talloc_free(ac);
 837                 return LDB_ERR_OPERATIONS_ERROR;
 838         }
 839
 840         /* generated times */
 841         unix_to_nt_time(&now, t);
 842         time_str = ldb_timestring(msg, t);
 843         if (!time_str) {
 844                 ldb_oom(ldb);
 845                 talloc_free(ac);
 846                 return LDB_ERR_OPERATIONS_ERROR;
 847         }
 848         if (remove_current_guid) {
 849                 ldb_msg_remove_attr(msg,"objectGUID");
 850         }
 851
 852         /*
 853          * remove autogenerated attributes
 854          */
 855         ldb_msg_remove_attr(msg, "whenCreated");
 856         ldb_msg_remove_attr(msg, "whenChanged");
 857         ldb_msg_remove_attr(msg, "uSNCreated");
 858         ldb_msg_remove_attr(msg, "uSNChanged");
 859         ldb_msg_remove_attr(msg, "replPropertyMetaData");
 860
 861         /*
 862          * readd replicated attributes
 863          */
 864         ret = ldb_msg_add_string(msg, "whenCreated", time_str);
 865         if (ret != LDB_SUCCESS) {
 866                 ldb_oom(ldb);
 867                 talloc_free(ac);
 868                 return ret;
 869         }
 870
 871         /* build the replication meta_data */
 872         ZERO_STRUCT(nmd);
 873         nmd.version             = 1;
 874         nmd.ctr.ctr1.count      = msg->num_elements;
 875         nmd.ctr.ctr1.array      = talloc_array(msg,
 876                                                struct replPropertyMetaData1,
 877                                                nmd.ctr.ctr1.count);
 878         if (!nmd.ctr.ctr1.array) {
 879                 ldb_oom(ldb);
 880                 talloc_free(ac);
 881                 return LDB_ERR_OPERATIONS_ERROR;
 882         }
 883
 884         for (i=0; i < msg->num_elements; i++) {
 885                 struct ldb_message_element *e = &msg->elements[i];
 886                 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
 887                 const struct dsdb_attribute *sa;
 888
 889                 if (e->name[0] == '@') continue;
 890
 891                 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
 892                 if (!sa) {
 893                         ldb_debug_set(ldb, LDB_DEBUG_ERROR,
 894                                       "replmd_add: attribute '%s' not defined in schema\n",
 895                                       e->name);
 896                         talloc_free(ac);
 897                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
 898                 }
 899
 900                 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
 901                         /* if the attribute is not replicated (0x00000001)
 902                          * or constructed (0x00000004) it has no metadata
 903                          */
 904                         continue;
 905                 }
 906
 907                 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
 908                         ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa, req);
 909                         if (ret != LDB_SUCCESS) {
 910                                 talloc_free(ac);
 911                                 return ret;
 912                         }
 913                         /* linked attributes are not stored in
 914                            replPropertyMetaData in FL above w2k */
 915                         continue;
 916                 }
 917
 918                 m->attid                        = sa->attributeID_id;
 919                 m->version                      = 1;
 920                 m->originating_change_time      = now;
 921                 m->originating_invocation_id    = *our_invocation_id;
 922                 m->originating_usn              = ac->seq_num;
 923                 m->local_usn                    = ac->seq_num;
 924                 ni++;
 925         }
 926
 927         /* fix meta data count */
 928         nmd.ctr.ctr1.count = ni;
 929
 930         /*
 931          * sort meta data array, and move the rdn attribute entry to the end
 932          */
 933         ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
 934         if (ret != LDB_SUCCESS) {
 935                 talloc_free(ac);
 936                 return ret;
 937         }
 938
 939         /* generated NDR encoded values */
 940         ndr_err = ndr_push_struct_blob(&nmd_value, msg,
 941                                        &nmd,
 942                                        (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
 943         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 944                 ldb_oom(ldb);
 945                 talloc_free(ac);
 946                 return LDB_ERR_OPERATIONS_ERROR;
 947         }
 948
 949         /*
 950          * add the autogenerated values
 951          */
 952         ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
 953         if (ret != LDB_SUCCESS) {
 954                 ldb_oom(ldb);
 955                 talloc_free(ac);
 956                 return ret;
 957         }
 958         ret = ldb_msg_add_string(msg, "whenChanged", time_str);
 959         if (ret != LDB_SUCCESS) {
 960                 ldb_oom(ldb);
 961                 talloc_free(ac);
 962                 return ret;
 963         }
 964         ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
 965         if (ret != LDB_SUCCESS) {
 966                 ldb_oom(ldb);
 967                 talloc_free(ac);
 968                 return ret;
 969         }
 970         ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
 971         if (ret != LDB_SUCCESS) {
 972                 ldb_oom(ldb);
 973                 talloc_free(ac);
 974                 return ret;
 975         }
 976         ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
 977         if (ret != LDB_SUCCESS) {
 978                 ldb_oom(ldb);
 979                 talloc_free(ac);
 980                 return ret;
 981         }
 982
 983         /*
 984          * sort the attributes by attid before storing the object
 985          */
 986         replmd_ldb_message_sort(msg, ac->schema);
 987
 988         objectclass_el = ldb_msg_find_element(msg, "objectClass");
 989         is_urgent = replmd_check_urgent_objectclass(objectclass_el,
 990                                                         REPL_URGENT_ON_CREATE);
 991
 992         ac->is_urgent = is_urgent;
 993         ret = ldb_build_add_req(&down_req, ldb, ac,
 994                                 msg,
 995                                 req->controls,
 996                                 ac, replmd_op_callback,
 997                                 req);
 998
 999         LDB_REQ_SET_LOCATION(down_req);
1000         if (ret != LDB_SUCCESS) {
1001                 talloc_free(ac);
1002                 return ret;
1003         }
1004
1005         /* current partition control is needed by "replmd_op_callback" */
1006         if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
1007                 ret = ldb_request_add_control(down_req,
1008                                               DSDB_CONTROL_CURRENT_PARTITION_OID,
1009                                               false, NULL);
1010                 if (ret != LDB_SUCCESS) {
1011                         talloc_free(ac);
1012                         return ret;
1013                 }
1014         }
1015
1016         if (functional_level == DS_DOMAIN_FUNCTION_2000) {
1017                 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
1018                 if (ret != LDB_SUCCESS) {
1019                         talloc_free(ac);
1020                         return ret;
1021                 }
1022         }
1023
1024         /* mark the control done */
1025         if (control) {
1026                 control->critical = 0;
1027         }
1028
1029         /* go on with the call chain */
1030         return ldb_next_request(module, down_req);
1031 }
1032
1033
1034 /*
1035  * update the replPropertyMetaData for one element
1036  */
1037 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1038                                       struct ldb_message *msg,
1039                                       struct ldb_message_element *el,
1040                                       struct ldb_message_element *old_el,
1041                                       struct replPropertyMetaDataBlob *omd,
1042                                       const struct dsdb_schema *schema,
1043                                       uint64_t *seq_num,
1044                                       const struct GUID *our_invocation_id,
1045                                       NTTIME now,
1046                                       struct ldb_request *req)
1047 {
1048         uint32_t i;
1049         const struct dsdb_attribute *a;
1050         struct replPropertyMetaData1 *md1;
1051
1052         a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1053         if (a == NULL) {
1054                 if (ldb_request_get_control(req, LDB_CONTROL_RELAX_OID)) {
1055                         /* allow this to make it possible for dbcheck
1056                            to remove bad attributes */
1057                         return LDB_SUCCESS;
1058                 }
1059
1060                 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1061                          el->name));
1062                 return LDB_ERR_OPERATIONS_ERROR;
1063         }
1064
1065         if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1066                 return LDB_SUCCESS;
1067         }
1068
1069         /* if the attribute's value haven't changed then return LDB_SUCCESS     */
1070         if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1071                 if (!ldb_request_get_control(req, LDB_CONTROL_PROVISION_OID)) {
1072                         /*
1073                          * allow this to make it possible for dbcheck
1074                          * to rebuild broken metadata
1075                          */
1076                         return LDB_SUCCESS;
1077                 }
1078         }
1079
1080         for (i=0; i<omd->ctr.ctr1.count; i++) {
1081                 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1082         }
1083
1084         if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1085                 /* linked attributes are not stored in
1086                    replPropertyMetaData in FL above w2k, but we do
1087                    raise the seqnum for the object  */
1088                 if (*seq_num == 0 &&
1089                     ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1090                         return LDB_ERR_OPERATIONS_ERROR;
1091                 }
1092                 return LDB_SUCCESS;
1093         }
1094
1095         if (i == omd->ctr.ctr1.count) {
1096                 /* we need to add a new one */
1097                 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1098                                                      struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1099                 if (omd->ctr.ctr1.array == NULL) {
1100                         ldb_oom(ldb);
1101                         return LDB_ERR_OPERATIONS_ERROR;
1102                 }
1103                 omd->ctr.ctr1.count++;
1104                 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1105         }
1106
1107         /* Get a new sequence number from the backend. We only do this
1108          * if we have a change that requires a new
1109          * replPropertyMetaData element
1110          */
1111         if (*seq_num == 0) {
1112                 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1113                 if (ret != LDB_SUCCESS) {
1114                         return LDB_ERR_OPERATIONS_ERROR;
1115                 }
1116         }
1117
1118         md1 = &omd->ctr.ctr1.array[i];
1119         md1->version++;
1120         md1->attid                     = a->attributeID_id;
1121         md1->originating_change_time   = now;
1122         md1->originating_invocation_id = *our_invocation_id;
1123         md1->originating_usn           = *seq_num;
1124         md1->local_usn                 = *seq_num;
1125
1126         return LDB_SUCCESS;
1127 }
1128
1129 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1130 {
1131         uint32_t count = omd.ctr.ctr1.count;
1132         uint64_t max = 0;
1133         uint32_t i;
1134         for (i=0; i < count; i++) {
1135                 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1136                 if (max < m.local_usn) {
1137                         max = m.local_usn;
1138                 }
1139         }
1140         return max;
1141 }
1142
1143 /*
1144  * update the replPropertyMetaData object each time we modify an
1145  * object. This is needed for DRS replication, as the merge on the
1146  * client is based on this object
1147  */
1148 static int replmd_update_rpmd(struct ldb_module *module,
1149                               const struct dsdb_schema *schema,
1150                               struct ldb_request *req,
1151                               const char * const *rename_attrs,
1152                               struct ldb_message *msg, uint64_t *seq_num,
1153                               time_t t,
1154                               bool *is_urgent)
1155 {
1156         const struct ldb_val *omd_value;
1157         enum ndr_err_code ndr_err;
1158         struct replPropertyMetaDataBlob omd;
1159         unsigned int i;
1160         NTTIME now;
1161         const struct GUID *our_invocation_id;
1162         int ret;
1163         const char * const *attrs = NULL;
1164         const char * const attrs1[] = { "replPropertyMetaData", "*", NULL };
1165         const char * const attrs2[] = { "uSNChanged", "objectClass", NULL };
1166         struct ldb_result *res;
1167         struct ldb_context *ldb;
1168         struct ldb_message_element *objectclass_el;
1169         enum urgent_situation situation;
1170         bool rodc, rmd_is_provided;
1171
1172         if (rename_attrs) {
1173                 attrs = rename_attrs;
1174         } else {
1175                 attrs = attrs1;
1176         }
1177
1178         ldb = ldb_module_get_ctx(module);
1179
1180         our_invocation_id = samdb_ntds_invocation_id(ldb);
1181         if (!our_invocation_id) {
1182                 /* this happens during an initial vampire while
1183                    updating the schema */
1184                 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1185                 return LDB_SUCCESS;
1186         }
1187
1188         unix_to_nt_time(&now, t);
1189
1190         if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1191                 rmd_is_provided = true;
1192         } else {
1193                 rmd_is_provided = false;
1194         }
1195
1196         /* if isDeleted is present and is TRUE, then we consider we are deleting,
1197          * otherwise we consider we are updating */
1198         if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1199                 situation = REPL_URGENT_ON_DELETE;
1200         } else if (rename_attrs) {
1201                 situation = REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE;
1202         } else {
1203                 situation = REPL_URGENT_ON_UPDATE;
1204         }
1205
1206         if (rmd_is_provided) {
1207                 /* In this case the change_replmetadata control was supplied */
1208                 /* We check that it's the only attribute that is provided
1209                  * (it's a rare case so it's better to keep the code simplier)
1210                  * We also check that the highest local_usn is bigger than
1211                  * uSNChanged. */
1212                 uint64_t db_seq;
1213                 if( msg->num_elements != 1 ||
1214                         strncmp(msg->elements[0].name,
1215                                 "replPropertyMetaData", 20) ) {
1216                         DEBUG(0,(__location__ ": changereplmetada control called without "\
1217                                 "a specified replPropertyMetaData attribute or with others\n"));
1218                         return LDB_ERR_OPERATIONS_ERROR;
1219                 }
1220                 if (situation != REPL_URGENT_ON_UPDATE) {
1221                         DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1222                         return LDB_ERR_OPERATIONS_ERROR;
1223                 }
1224                 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1225                 if (!omd_value) {
1226                         DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1227                                  ldb_dn_get_linearized(msg->dn)));
1228                         return LDB_ERR_OPERATIONS_ERROR;
1229                 }
1230                 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1231                                                (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1232                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1233                         DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1234                                  ldb_dn_get_linearized(msg->dn)));
1235                         return LDB_ERR_OPERATIONS_ERROR;
1236                 }
1237                 *seq_num = find_max_local_usn(omd);
1238
1239                 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1240                                             DSDB_FLAG_NEXT_MODULE |
1241                                             DSDB_SEARCH_SHOW_RECYCLED |
1242                                             DSDB_SEARCH_SHOW_EXTENDED_DN |
1243                                             DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1244                                             DSDB_SEARCH_REVEAL_INTERNALS, req);
1245
1246                 if (ret != LDB_SUCCESS || res->count != 1) {
1247                         DEBUG(0,(__location__ ": Object %s failed to find uSNChanged\n",
1248                                  ldb_dn_get_linearized(msg->dn)));
1249                         return LDB_ERR_OPERATIONS_ERROR;
1250                 }
1251
1252                 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1253                 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1254                                                                 situation)) {
1255                         *is_urgent = true;
1256                 }
1257
1258                 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1259                 if (*seq_num <= db_seq) {
1260                         DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1261                                               " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1262                                  (long long)*seq_num, (long long)db_seq));
1263                         return LDB_ERR_OPERATIONS_ERROR;
1264                 }
1265
1266         } else {
1267                 /* search for the existing replPropertyMetaDataBlob. We need
1268                  * to use REVEAL and ask for DNs in storage format to support
1269                  * the check for values being the same in
1270                  * replmd_update_rpmd_element()
1271                  */
1272                 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1273                                             DSDB_FLAG_NEXT_MODULE |
1274                                             DSDB_SEARCH_SHOW_RECYCLED |
1275                                             DSDB_SEARCH_SHOW_EXTENDED_DN |
1276                                             DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1277                                             DSDB_SEARCH_REVEAL_INTERNALS, req);
1278                 if (ret != LDB_SUCCESS || res->count != 1) {
1279                         DEBUG(0,(__location__ ": Object %s failed to find replPropertyMetaData\n",
1280                                  ldb_dn_get_linearized(msg->dn)));
1281                         return LDB_ERR_OPERATIONS_ERROR;
1282                 }
1283
1284                 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1285                 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1286                                                                 situation)) {
1287                         *is_urgent = true;
1288                 }
1289
1290                 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1291                 if (!omd_value) {
1292                         DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1293                                  ldb_dn_get_linearized(msg->dn)));
1294                         return LDB_ERR_OPERATIONS_ERROR;
1295                 }
1296
1297                 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1298                                                (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1299                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1300                         DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1301                                  ldb_dn_get_linearized(msg->dn)));
1302                         return LDB_ERR_OPERATIONS_ERROR;
1303                 }
1304
1305                 if (omd.version != 1) {
1306                         DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1307                                  omd.version, ldb_dn_get_linearized(msg->dn)));
1308                         return LDB_ERR_OPERATIONS_ERROR;
1309                 }
1310
1311                 for (i=0; i<msg->num_elements; i++) {
1312                         struct ldb_message_element *old_el;
1313                         old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1314                         ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1315                                                          our_invocation_id, now, req);
1316                         if (ret != LDB_SUCCESS) {
1317                                 return ret;
1318                         }
1319
1320                         if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1321                                 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1322                         }
1323
1324                 }
1325         }
1326         /*
1327          * replmd_update_rpmd_element has done an update if the
1328          * seq_num is set
1329          */
1330         if (*seq_num != 0) {
1331                 struct ldb_val *md_value;
1332                 struct ldb_message_element *el;
1333
1334                 /*if we are RODC and this is a DRSR update then its ok*/
1335                 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1336                         ret = samdb_rodc(ldb, &rodc);
1337                         if (ret != LDB_SUCCESS) {
1338                                 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1339                         } else if (rodc) {
1340                                 ldb_asprintf_errstring(ldb, "RODC modify is forbidden\n");
1341                                 return LDB_ERR_REFERRAL;
1342                         }
1343                 }
1344
1345                 md_value = talloc(msg, struct ldb_val);
1346                 if (md_value == NULL) {
1347                         ldb_oom(ldb);
1348                         return LDB_ERR_OPERATIONS_ERROR;
1349                 }
1350
1351                 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1352                 if (ret != LDB_SUCCESS) {
1353                         return ret;
1354                 }
1355
1356                 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1357                                                (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1358                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1359                         DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1360                                  ldb_dn_get_linearized(msg->dn)));
1361                         return LDB_ERR_OPERATIONS_ERROR;
1362                 }
1363
1364                 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1365                 if (ret != LDB_SUCCESS) {
1366                         DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1367                                  ldb_dn_get_linearized(msg->dn)));
1368                         return ret;
1369                 }
1370
1371                 el->num_values = 1;
1372                 el->values = md_value;
1373         }
1374
1375         return LDB_SUCCESS;
1376 }
1377
1378 struct parsed_dn {
1379         struct dsdb_dn *dsdb_dn;
1380         struct GUID *guid;
1381         struct ldb_val *v;
1382 };
1383
1384 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1385 {
1386         return GUID_compare(pdn1->guid, pdn2->guid);
1387 }
1388
1389 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn,
1390                                         unsigned int count, struct GUID *guid,
1391                                         struct ldb_dn *dn)
1392 {
1393         struct parsed_dn *ret;
1394         unsigned int i;
1395         if (dn && GUID_all_zero(guid)) {
1396                 /* when updating a link using DRS, we sometimes get a
1397                    NULL GUID. We then need to try and match by DN */
1398                 for (i=0; i<count; i++) {
1399                         if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1400                                 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1401                                 return &pdn[i];
1402                         }
1403                 }
1404                 return NULL;
1405         }
1406         BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1407         return ret;
1408 }
1409
1410 /*
1411   get a series of message element values as an array of DNs and GUIDs
1412   the result is sorted by GUID
1413  */
1414 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1415                           struct ldb_message_element *el, struct parsed_dn **pdn,
1416                           const char *ldap_oid, struct ldb_request *parent)
1417 {
1418         unsigned int i;
1419         struct ldb_context *ldb = ldb_module_get_ctx(module);
1420
1421         if (el == NULL) {
1422                 *pdn = NULL;
1423                 return LDB_SUCCESS;
1424         }
1425
1426         (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1427         if (!*pdn) {
1428                 ldb_module_oom(module);
1429                 return LDB_ERR_OPERATIONS_ERROR;
1430         }
1431
1432         for (i=0; i<el->num_values; i++) {
1433                 struct ldb_val *v = &el->values[i];
1434                 NTSTATUS status;
1435                 struct ldb_dn *dn;
1436                 struct parsed_dn *p;
1437
1438                 p = &(*pdn)[i];
1439
1440                 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1441                 if (p->dsdb_dn == NULL) {
1442                         return LDB_ERR_INVALID_DN_SYNTAX;
1443                 }
1444
1445                 dn = p->dsdb_dn->dn;
1446
1447                 p->guid = talloc(*pdn, struct GUID);
1448                 if (p->guid == NULL) {
1449                         ldb_module_oom(module);
1450                         return LDB_ERR_OPERATIONS_ERROR;
1451                 }
1452
1453                 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1454                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1455                         /* we got a DN without a GUID - go find the GUID */
1456                         int ret = dsdb_module_guid_by_dn(module, dn, p->guid, parent);
1457                         if (ret != LDB_SUCCESS) {
1458                                 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1459                                                        ldb_dn_get_linearized(dn));
1460                                 return ret;
1461                         }
1462                         ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1463                         if (ret != LDB_SUCCESS) {
1464                                 return ret;
1465                         }
1466                 } else if (!NT_STATUS_IS_OK(status)) {
1467                         return LDB_ERR_OPERATIONS_ERROR;
1468                 }
1469
1470                 /* keep a pointer to the original ldb_val */
1471                 p->v = v;
1472         }
1473
1474         TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1475
1476         return LDB_SUCCESS;
1477 }
1478
1479 /*
1480   build a new extended DN, including all meta data fields
1481
1482   RMD_FLAGS           = DSDB_RMD_FLAG_* bits
1483   RMD_ADDTIME         = originating_add_time
1484   RMD_INVOCID         = originating_invocation_id
1485   RMD_CHANGETIME      = originating_change_time
1486   RMD_ORIGINATING_USN = originating_usn
1487   RMD_LOCAL_USN       = local_usn
1488   RMD_VERSION         = version
1489  */
1490 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1491                                const struct GUID *invocation_id, uint64_t seq_num,
1492                                uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1493 {
1494         struct ldb_dn *dn = dsdb_dn->dn;
1495         const char *tstring, *usn_string, *flags_string;
1496         struct ldb_val tval;
1497         struct ldb_val iid;
1498         struct ldb_val usnv, local_usnv;
1499         struct ldb_val vers, flagsv;
1500         NTSTATUS status;
1501         int ret;
1502         const char *dnstring;
1503         char *vstring;
1504         uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1505
1506         tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1507         if (!tstring) {
1508                 return LDB_ERR_OPERATIONS_ERROR;
1509         }
1510         tval = data_blob_string_const(tstring);
1511
1512         usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1513         if (!usn_string) {
1514                 return LDB_ERR_OPERATIONS_ERROR;
1515         }
1516         usnv = data_blob_string_const(usn_string);
1517
1518         usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1519         if (!usn_string) {
1520                 return LDB_ERR_OPERATIONS_ERROR;
1521         }
1522         local_usnv = data_blob_string_const(usn_string);
1523
1524         vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1525         if (!vstring) {
1526                 return LDB_ERR_OPERATIONS_ERROR;
1527         }
1528         vers = data_blob_string_const(vstring);
1529
1530         status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1531         if (!NT_STATUS_IS_OK(status)) {
1532                 return LDB_ERR_OPERATIONS_ERROR;
1533         }
1534
1535         flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1536         if (!flags_string) {
1537                 return LDB_ERR_OPERATIONS_ERROR;
1538         }
1539         flagsv = data_blob_string_const(flags_string);
1540
1541         ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1542         if (ret != LDB_SUCCESS) return ret;
1543         ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1544         if (ret != LDB_SUCCESS) return ret;
1545         ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1546         if (ret != LDB_SUCCESS) return ret;
1547         ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1548         if (ret != LDB_SUCCESS) return ret;
1549         ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1550         if (ret != LDB_SUCCESS) return ret;
1551         ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1552         if (ret != LDB_SUCCESS) return ret;
1553         ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1554         if (ret != LDB_SUCCESS) return ret;
1555
1556         dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1557         if (dnstring == NULL) {
1558                 return LDB_ERR_OPERATIONS_ERROR;
1559         }
1560         *v = data_blob_string_const(dnstring);
1561
1562         return LDB_SUCCESS;
1563 }
1564
1565 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1566                                 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1567                                 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1568                                 uint32_t version, bool deleted);
1569
1570 /*
1571   check if any links need upgrading from w2k format
1572
1573   The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1574  */
1575 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1576 {
1577         uint32_t i;
1578         for (i=0; i<count; i++) {
1579                 NTSTATUS status;
1580                 uint32_t version;
1581                 int ret;
1582
1583                 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1584                 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1585                         continue;
1586                 }
1587
1588                 /* it's an old one that needs upgrading */
1589                 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1590                                            1, 1, 0, 0, false);
1591                 if (ret != LDB_SUCCESS) {
1592                         return ret;
1593                 }
1594         }
1595         return LDB_SUCCESS;
1596 }
1597
1598 /*
1599   update an extended DN, including all meta data fields
1600
1601   see replmd_build_la_val for value names
1602  */
1603 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1604                                 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1605                                 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1606                                 uint32_t version, bool deleted)
1607 {
1608         struct ldb_dn *dn = dsdb_dn->dn;
1609         const char *tstring, *usn_string, *flags_string;
1610         struct ldb_val tval;
1611         struct ldb_val iid;
1612         struct ldb_val usnv, local_usnv;
1613         struct ldb_val vers, flagsv;
1614         const struct ldb_val *old_addtime;
1615         uint32_t old_version;
1616         NTSTATUS status;
1617         int ret;
1618         const char *dnstring;
1619         char *vstring;
1620         uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1621
1622         tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1623         if (!tstring) {
1624                 return LDB_ERR_OPERATIONS_ERROR;
1625         }
1626         tval = data_blob_string_const(tstring);
1627
1628         usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1629         if (!usn_string) {
1630                 return LDB_ERR_OPERATIONS_ERROR;
1631         }
1632         usnv = data_blob_string_const(usn_string);
1633
1634         usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1635         if (!usn_string) {
1636                 return LDB_ERR_OPERATIONS_ERROR;
1637         }
1638         local_usnv = data_blob_string_const(usn_string);
1639
1640         status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1641         if (!NT_STATUS_IS_OK(status)) {
1642                 return LDB_ERR_OPERATIONS_ERROR;
1643         }
1644
1645         flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1646         if (!flags_string) {
1647                 return LDB_ERR_OPERATIONS_ERROR;
1648         }
1649         flagsv = data_blob_string_const(flags_string);
1650
1651         ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1652         if (ret != LDB_SUCCESS) return ret;
1653
1654         /* get the ADDTIME from the original */
1655         old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1656         if (old_addtime == NULL) {
1657                 old_addtime = &tval;
1658         }
1659         if (dsdb_dn != old_dsdb_dn ||
1660             ldb_dn_get_extended_component(dn, "RMD_ADDTIME") == NULL) {
1661                 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1662                 if (ret != LDB_SUCCESS) return ret;
1663         }
1664
1665         /* use our invocation id */
1666         ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1667         if (ret != LDB_SUCCESS) return ret;
1668
1669         /* changetime is the current time */
1670         ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1671         if (ret != LDB_SUCCESS) return ret;
1672
1673         /* update the USN */
1674         ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1675         if (ret != LDB_SUCCESS) return ret;
1676
1677         ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1678         if (ret != LDB_SUCCESS) return ret;
1679
1680         /* increase the version by 1 */
1681         status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1682         if (NT_STATUS_IS_OK(status) && old_version >= version) {
1683                 version = old_version+1;
1684         }
1685         vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1686         vers = data_blob_string_const(vstring);
1687         ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1688         if (ret != LDB_SUCCESS) return ret;
1689
1690         dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1691         if (dnstring == NULL) {
1692                 return LDB_ERR_OPERATIONS_ERROR;
1693         }
1694         *v = data_blob_string_const(dnstring);
1695
1696         return LDB_SUCCESS;
1697 }
1698
1699 /*
1700   handle adding a linked attribute
1701  */
1702 static int replmd_modify_la_add(struct ldb_module *module,
1703                                 const struct dsdb_schema *schema,
1704                                 struct ldb_message *msg,
1705                                 struct ldb_message_element *el,
1706                                 struct ldb_message_element *old_el,
1707                                 const struct dsdb_attribute *schema_attr,
1708                                 uint64_t seq_num,
1709                                 time_t t,
1710                                 struct GUID *msg_guid,
1711                                 struct ldb_request *parent)
1712 {
1713         unsigned int i;
1714         struct parsed_dn *dns, *old_dns;
1715         TALLOC_CTX *tmp_ctx = talloc_new(msg);
1716         int ret;
1717         struct ldb_val *new_values = NULL;
1718         unsigned int num_new_values = 0;
1719         unsigned old_num_values = old_el?old_el->num_values:0;
1720         const struct GUID *invocation_id;
1721         struct ldb_context *ldb = ldb_module_get_ctx(module);
1722         NTTIME now;
1723
1724         unix_to_nt_time(&now, t);
1725
1726         ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1727         if (ret != LDB_SUCCESS) {
1728                 talloc_free(tmp_ctx);
1729                 return ret;
1730         }
1731
1732         ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1733         if (ret != LDB_SUCCESS) {
1734                 talloc_free(tmp_ctx);
1735                 return ret;
1736         }
1737
1738         invocation_id = samdb_ntds_invocation_id(ldb);
1739         if (!invocation_id) {
1740                 talloc_free(tmp_ctx);
1741                 return LDB_ERR_OPERATIONS_ERROR;
1742         }
1743
1744         ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1745         if (ret != LDB_SUCCESS) {
1746                 talloc_free(tmp_ctx);
1747                 return ret;
1748         }
1749
1750         /* for each new value, see if it exists already with the same GUID */
1751         for (i=0; i<el->num_values; i++) {
1752                 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1753                 if (p == NULL) {
1754                         /* this is a new linked attribute value */
1755                         new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1756                         if (new_values == NULL) {
1757                                 ldb_module_oom(module);
1758                                 talloc_free(tmp_ctx);
1759                                 return LDB_ERR_OPERATIONS_ERROR;
1760                         }
1761                         ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1762                                                   invocation_id, seq_num, seq_num, now, 0, false);
1763                         if (ret != LDB_SUCCESS) {
1764                                 talloc_free(tmp_ctx);
1765                                 return ret;
1766                         }
1767                         num_new_values++;
1768                 } else {
1769                         /* this is only allowed if the GUID was
1770                            previously deleted. */
1771                         uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1772
1773                         if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1774                                 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1775                                                        el->name, GUID_string(tmp_ctx, p->guid));
1776                                 talloc_free(tmp_ctx);
1777                                 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1778                         }
1779                         ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1780                                                    invocation_id, seq_num, seq_num, now, 0, false);
1781                         if (ret != LDB_SUCCESS) {
1782                                 talloc_free(tmp_ctx);
1783                                 return ret;
1784                         }
1785                 }
1786
1787                 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1788                 if (ret != LDB_SUCCESS) {
1789                         talloc_free(tmp_ctx);
1790                         return ret;
1791                 }
1792         }
1793
1794         /* add the new ones on to the end of the old values, constructing a new el->values */
1795         el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1796                                     struct ldb_val,
1797                                     old_num_values+num_new_values);
1798         if (el->values == NULL) {
1799                 ldb_module_oom(module);
1800                 return LDB_ERR_OPERATIONS_ERROR;
1801         }
1802
1803         memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1804         el->num_values = old_num_values + num_new_values;
1805
1806         talloc_steal(msg->elements, el->values);
1807         talloc_steal(el->values, new_values);
1808
1809         talloc_free(tmp_ctx);
1810
1811         /* we now tell the backend to replace all existing values
1812            with the one we have constructed */
1813         el->flags = LDB_FLAG_MOD_REPLACE;
1814
1815         return LDB_SUCCESS;
1816 }
1817
1818
1819 /*
1820   handle deleting all active linked attributes
1821  */
1822 static int replmd_modify_la_delete(struct ldb_module *module,
1823                                    const struct dsdb_schema *schema,
1824                                    struct ldb_message *msg,
1825                                    struct ldb_message_element *el,
1826                                    struct ldb_message_element *old_el,
1827                                    const struct dsdb_attribute *schema_attr,
1828                                    uint64_t seq_num,
1829                                    time_t t,
1830                                    struct GUID *msg_guid,
1831                                    struct ldb_request *parent)
1832 {
1833         unsigned int i;
1834         struct parsed_dn *dns, *old_dns;
1835         TALLOC_CTX *tmp_ctx = talloc_new(msg);
1836         int ret;
1837         const struct GUID *invocation_id;
1838         struct ldb_context *ldb = ldb_module_get_ctx(module);
1839         NTTIME now;
1840
1841         unix_to_nt_time(&now, t);
1842
1843         /* check if there is nothing to delete */
1844         if ((!old_el || old_el->num_values == 0) &&
1845             el->num_values == 0) {
1846                 return LDB_SUCCESS;
1847         }
1848
1849         if (!old_el || old_el->num_values == 0) {
1850                 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1851         }
1852
1853         ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1854         if (ret != LDB_SUCCESS) {
1855                 talloc_free(tmp_ctx);
1856                 return ret;
1857         }
1858
1859         ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1860         if (ret != LDB_SUCCESS) {
1861                 talloc_free(tmp_ctx);
1862                 return ret;
1863         }
1864
1865         invocation_id = samdb_ntds_invocation_id(ldb);
1866         if (!invocation_id) {
1867                 return LDB_ERR_OPERATIONS_ERROR;
1868         }
1869
1870         ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1871         if (ret != LDB_SUCCESS) {
1872                 talloc_free(tmp_ctx);
1873                 return ret;
1874         }
1875
1876         el->values = NULL;
1877
1878         /* see if we are being asked to delete any links that
1879            don't exist or are already deleted */
1880         for (i=0; i<el->num_values; i++) {
1881                 struct parsed_dn *p = &dns[i];
1882                 struct parsed_dn *p2;
1883                 uint32_t rmd_flags;
1884
1885                 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1886                 if (!p2) {
1887                         ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1888                                                el->name, GUID_string(tmp_ctx, p->guid));
1889                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
1890                 }
1891                 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1892                 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1893                         ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1894                                                el->name, GUID_string(tmp_ctx, p->guid));
1895                         return LDB_ERR_NO_SUCH_ATTRIBUTE;
1896                 }
1897         }
1898
1899         /* for each new value, see if it exists already with the same GUID
1900            if it is not already deleted and matches the delete list then delete it
1901         */
1902         for (i=0; i<old_el->num_values; i++) {
1903                 struct parsed_dn *p = &old_dns[i];
1904                 uint32_t rmd_flags;
1905
1906                 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1907                         continue;
1908                 }
1909
1910                 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1911                 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1912
1913                 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
1914                                            invocation_id, seq_num, seq_num, now, 0, true);
1915                 if (ret != LDB_SUCCESS) {
1916                         talloc_free(tmp_ctx);
1917                         return ret;
1918                 }
1919
1920                 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
1921                 if (ret != LDB_SUCCESS) {
1922                         talloc_free(tmp_ctx);
1923                         return ret;
1924                 }
1925         }
1926
1927         el->values = talloc_steal(msg->elements, old_el->values);
1928         el->num_values = old_el->num_values;
1929
1930         talloc_free(tmp_ctx);
1931
1932         /* we now tell the backend to replace all existing values
1933            with the one we have constructed */
1934         el->flags = LDB_FLAG_MOD_REPLACE;
1935
1936         return LDB_SUCCESS;
1937 }
1938
1939 /*
1940   handle replacing a linked attribute
1941  */
1942 static int replmd_modify_la_replace(struct ldb_module *module,
1943                                     const struct dsdb_schema *schema,
1944                                     struct ldb_message *msg,
1945                                     struct ldb_message_element *el,
1946                                     struct ldb_message_element *old_el,
1947                                     const struct dsdb_attribute *schema_attr,
1948                                     uint64_t seq_num,
1949                                     time_t t,
1950                                     struct GUID *msg_guid,
1951                                     struct ldb_request *parent)
1952 {
1953         unsigned int i;
1954         struct parsed_dn *dns, *old_dns;
1955         TALLOC_CTX *tmp_ctx = talloc_new(msg);
1956         int ret;
1957         const struct GUID *invocation_id;
1958         struct ldb_context *ldb = ldb_module_get_ctx(module);
1959         struct ldb_val *new_values = NULL;
1960         unsigned int num_new_values = 0;
1961         unsigned int old_num_values = old_el?old_el->num_values:0;
1962         NTTIME now;
1963
1964         unix_to_nt_time(&now, t);
1965
1966         /* check if there is nothing to replace */
1967         if ((!old_el || old_el->num_values == 0) &&
1968             el->num_values == 0) {
1969                 return LDB_SUCCESS;
1970         }
1971
1972         ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid, parent);
1973         if (ret != LDB_SUCCESS) {
1974                 talloc_free(tmp_ctx);
1975                 return ret;
1976         }
1977
1978         ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid, parent);
1979         if (ret != LDB_SUCCESS) {
1980                 talloc_free(tmp_ctx);
1981                 return ret;
1982         }
1983
1984         invocation_id = samdb_ntds_invocation_id(ldb);
1985         if (!invocation_id) {
1986                 return LDB_ERR_OPERATIONS_ERROR;
1987         }
1988
1989         ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1990         if (ret != LDB_SUCCESS) {
1991                 talloc_free(tmp_ctx);
1992                 return ret;
1993         }
1994
1995         /* mark all the old ones as deleted */
1996         for (i=0; i<old_num_values; i++) {
1997                 struct parsed_dn *old_p = &old_dns[i];
1998                 struct parsed_dn *p;
1999                 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
2000
2001                 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
2002
2003                 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
2004                 if (ret != LDB_SUCCESS) {
2005                         talloc_free(tmp_ctx);
2006                         return ret;
2007                 }
2008
2009                 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
2010                 if (p) {
2011                         /* we don't delete it if we are re-adding it */
2012                         continue;
2013                 }
2014
2015                 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
2016                                            invocation_id, seq_num, seq_num, now, 0, true);
2017                 if (ret != LDB_SUCCESS) {
2018                         talloc_free(tmp_ctx);
2019                         return ret;
2020                 }
2021         }
2022
2023         /* for each new value, either update its meta-data, or add it
2024          * to old_el
2025         */
2026         for (i=0; i<el->num_values; i++) {
2027                 struct parsed_dn *p = &dns[i], *old_p;
2028
2029                 if (old_dns &&
2030                     (old_p = parsed_dn_find(old_dns,
2031                                             old_num_values, p->guid, NULL)) != NULL) {
2032                         /* update in place */
2033                         ret = replmd_update_la_val(old_el->values, old_p->v, p->dsdb_dn,
2034                                                    old_p->dsdb_dn, invocation_id,
2035                                                    seq_num, seq_num, now, 0, false);
2036                         if (ret != LDB_SUCCESS) {
2037                                 talloc_free(tmp_ctx);
2038                                 return ret;
2039                         }
2040                 } else {
2041                         /* add a new one */
2042                         new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
2043                                                     num_new_values+1);
2044                         if (new_values == NULL) {
2045                                 ldb_module_oom(module);
2046                                 talloc_free(tmp_ctx);
2047                                 return LDB_ERR_OPERATIONS_ERROR;
2048                         }
2049                         ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
2050                                                   invocation_id, seq_num, seq_num, now, 0, false);
2051                         if (ret != LDB_SUCCESS) {
2052                                 talloc_free(tmp_ctx);
2053                                 return ret;
2054                         }
2055                         num_new_values++;
2056                 }
2057
2058                 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
2059                 if (ret != LDB_SUCCESS) {
2060                         talloc_free(tmp_ctx);
2061                         return ret;
2062                 }
2063         }
2064
2065         /* add the new values to the end of old_el */
2066         if (num_new_values != 0) {
2067                 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2068                                             struct ldb_val, old_num_values+num_new_values);
2069                 if (el->values == NULL) {
2070                         ldb_module_oom(module);
2071                         return LDB_ERR_OPERATIONS_ERROR;
2072                 }
2073                 memcpy(&el->values[old_num_values], &new_values[0],
2074                        sizeof(struct ldb_val)*num_new_values);
2075                 el->num_values = old_num_values + num_new_values;
2076                 talloc_steal(msg->elements, new_values);
2077         } else {
2078                 el->values = old_el->values;
2079                 el->num_values = old_el->num_values;
2080                 talloc_steal(msg->elements, el->values);
2081         }
2082
2083         talloc_free(tmp_ctx);
2084
2085         /* we now tell the backend to replace all existing values
2086            with the one we have constructed */
2087         el->flags = LDB_FLAG_MOD_REPLACE;
2088
2089         return LDB_SUCCESS;
2090 }
2091
2092
2093 /*
2094   handle linked attributes in modify requests
2095  */
2096 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2097                                                struct ldb_message *msg,
2098                                                uint64_t seq_num, time_t t,
2099                                                struct ldb_request *parent)
2100 {
2101         struct ldb_result *res;
2102         unsigned int i;
2103         int ret;
2104         struct ldb_context *ldb = ldb_module_get_ctx(module);
2105         struct ldb_message *old_msg;
2106
2107         const struct dsdb_schema *schema;
2108         struct GUID old_guid;
2109
2110         if (seq_num == 0) {
2111                 /* there the replmd_update_rpmd code has already
2112                  * checked and saw that there are no linked
2113                  * attributes */
2114                 return LDB_SUCCESS;
2115         }
2116
2117         if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2118                 /* don't do anything special for linked attributes */
2119                 return LDB_SUCCESS;
2120         }
2121
2122         ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2123                                     DSDB_FLAG_NEXT_MODULE |
2124                                     DSDB_SEARCH_SHOW_RECYCLED |
2125                                     DSDB_SEARCH_REVEAL_INTERNALS |
2126                                     DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT,
2127                                     parent);
2128         if (ret != LDB_SUCCESS) {
2129                 return ret;
2130         }
2131         schema = dsdb_get_schema(ldb, res);
2132         if (!schema) {
2133                 return LDB_ERR_OPERATIONS_ERROR;
2134         }
2135
2136         old_msg = res->msgs[0];
2137
2138         old_guid = samdb_result_guid(old_msg, "objectGUID");
2139
2140         for (i=0; i<msg->num_elements; i++) {
2141                 struct ldb_message_element *el = &msg->elements[i];
2142                 struct ldb_message_element *old_el, *new_el;
2143                 const struct dsdb_attribute *schema_attr
2144                         = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2145                 if (!schema_attr) {
2146                         ldb_asprintf_errstring(ldb,
2147                                                "%s: attribute %s is not a valid attribute in schema",
2148                                                __FUNCTION__, el->name);
2149                         return LDB_ERR_OBJECT_CLASS_VIOLATION;
2150                 }
2151                 if (schema_attr->linkID == 0) {
2152                         continue;
2153                 }
2154                 if ((schema_attr->linkID & 1) == 1) {
2155                         /* Odd is for the target.  Illegal to modify */
2156                         ldb_asprintf_errstring(ldb,
2157                                                "attribute %s must not be modified directly, it is a linked attribute", el->name);
2158                         return LDB_ERR_UNWILLING_TO_PERFORM;
2159                 }
2160                 old_el = ldb_msg_find_element(old_msg, el->name);
2161                 switch (el->flags & LDB_FLAG_MOD_MASK) {
2162                 case LDB_FLAG_MOD_REPLACE:
2163                         ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2164                         break;
2165                 case LDB_FLAG_MOD_DELETE:
2166                         ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2167                         break;
2168                 case LDB_FLAG_MOD_ADD:
2169                         ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid, parent);
2170                         break;
2171                 default:
2172                         ldb_asprintf_errstring(ldb,
2173                                                "invalid flags 0x%x for %s linked attribute",
2174                                                el->flags, el->name);
2175                         return LDB_ERR_UNWILLING_TO_PERFORM;
2176                 }
2177                 if (dsdb_check_single_valued_link(schema_attr, el) != LDB_SUCCESS) {
2178                         ldb_asprintf_errstring(ldb,
2179                                                "Attribute %s is single valued but more than one value has been supplied",
2180                                                el->name);
2181                         return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
2182                 } else {
2183                         el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
2184                 }
2185
2186
2187
2188                 if (ret != LDB_SUCCESS) {
2189                         return ret;
2190                 }
2191                 if (old_el) {
2192                         ldb_msg_remove_attr(old_msg, el->name);
2193                 }
2194                 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2195                 new_el->num_values = el->num_values;
2196                 new_el->values = talloc_steal(msg->elements, el->values);
2197
2198                 /* TODO: this relises a bit too heavily on the exact
2199                    behaviour of ldb_msg_find_element and
2200                    ldb_msg_remove_element */
2201                 old_el = ldb_msg_find_element(msg, el->name);
2202                 if (old_el != el) {
2203                         ldb_msg_remove_element(msg, old_el);
2204                         i--;
2205                 }
2206         }
2207
2208         talloc_free(res);
2209         return ret;
2210 }
2211
2212
2213
2214 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2215 {
2216         struct ldb_context *ldb;
2217         struct replmd_replicated_request *ac;
2218         struct ldb_request *down_req;
2219         struct ldb_message *msg;
2220         time_t t = time(NULL);
2221         int ret;
2222         bool is_urgent = false;
2223         struct loadparm_context *lp_ctx;
2224         char *referral;
2225         unsigned int functional_level;
2226         const DATA_BLOB *guid_blob;
2227
2228         /* do not manipulate our control entries */
2229         if (ldb_dn_is_special(req->op.mod.message->dn)) {
2230                 return ldb_next_request(module, req);
2231         }
2232
2233         ldb = ldb_module_get_ctx(module);
2234
2235         ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2236
2237         guid_blob = ldb_msg_find_ldb_val(req->op.mod.message, "objectGUID");
2238         if ( guid_blob != NULL ) {
2239                 ldb_set_errstring(ldb,
2240                                   "replmd_modify: it's not allowed to change the objectGUID!");
2241                 return LDB_ERR_CONSTRAINT_VIOLATION;
2242         }
2243
2244         ac = replmd_ctx_init(module, req);
2245         if (ac == NULL) {
2246                 return ldb_module_oom(module);
2247         }
2248
2249         functional_level = dsdb_functional_level(ldb);
2250
2251         lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2252                                  struct loadparm_context);
2253
2254         /* we have to copy the message as the caller might have it as a const */
2255         msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2256         if (msg == NULL) {
2257                 ldb_oom(ldb);
2258                 talloc_free(ac);
2259                 return LDB_ERR_OPERATIONS_ERROR;
2260         }
2261
2262         ldb_msg_remove_attr(msg, "whenChanged");
2263         ldb_msg_remove_attr(msg, "uSNChanged");
2264
2265         ret = replmd_update_rpmd(module, ac->schema, req, NULL,
2266                                  msg, &ac->seq_num, t, &is_urgent);
2267         if (ret == LDB_ERR_REFERRAL) {
2268                 referral = talloc_asprintf(req,
2269                                            "ldap://%s/%s",
2270                                            lpcfg_dnsdomain(lp_ctx),
2271                                            ldb_dn_get_linearized(msg->dn));
2272                 ret = ldb_module_send_referral(req, referral);
2273                 talloc_free(ac);
2274                 return ldb_module_done(req, NULL, NULL, ret);
2275         }
2276
2277         if (ret != LDB_SUCCESS) {
2278                 talloc_free(ac);
2279                 return ret;
2280         }
2281
2282         ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t, req);
2283         if (ret != LDB_SUCCESS) {
2284                 talloc_free(ac);
2285                 return ret;
2286         }
2287
2288         /* TODO:
2289          * - replace the old object with the newly constructed one
2290          */
2291
2292         ac->is_urgent = is_urgent;
2293
2294         ret = ldb_build_mod_req(&down_req, ldb, ac,
2295                                 msg,
2296                                 req->controls,
2297                                 ac, replmd_op_callback,
2298                                 req);
2299         LDB_REQ_SET_LOCATION(down_req);
2300         if (ret != LDB_SUCCESS) {
2301                 talloc_free(ac);
2302                 return ret;
2303         }
2304
2305         /* current partition control is needed by "replmd_op_callback" */
2306         if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2307                 ret = ldb_request_add_control(down_req,
2308                                               DSDB_CONTROL_CURRENT_PARTITION_OID,
2309                                               false, NULL);
2310                 if (ret != LDB_SUCCESS) {
2311                         talloc_free(ac);
2312                         return ret;
2313                 }
2314         }
2315
2316         /* If we are in functional level 2000, then
2317          * replmd_modify_handle_linked_attribs will have done
2318          * nothing */
2319         if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2320                 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2321                 if (ret != LDB_SUCCESS) {
2322                         talloc_free(ac);
2323                         return ret;
2324                 }
2325         }
2326
2327         talloc_steal(down_req, msg);
2328
2329         /* we only change whenChanged and uSNChanged if the seq_num
2330            has changed */
2331         if (ac->seq_num != 0) {
2332                 ret = add_time_element(msg, "whenChanged", t);
2333                 if (ret != LDB_SUCCESS) {
2334                         talloc_free(ac);
2335                         return ret;
2336                 }
2337
2338                 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2339                 if (ret != LDB_SUCCESS) {
2340                         talloc_free(ac);
2341                         return ret;
2342                 }
2343         }
2344
2345         /* go on with the call chain */
2346         return ldb_next_request(module, down_req);
2347 }
2348
2349 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2350
2351 /*
2352   handle a rename request
2353
2354   On a rename we need to do an extra ldb_modify which sets the
2355   whenChanged and uSNChanged attributes.  We do this in a callback after the success.
2356  */
2357 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2358 {
2359         struct ldb_context *ldb;
2360         struct replmd_replicated_request *ac;
2361         int ret;
2362         struct ldb_request *down_req;
2363
2364         /* do not manipulate our control entries */
2365         if (ldb_dn_is_special(req->op.mod.message->dn)) {
2366                 return ldb_next_request(module, req);
2367         }
2368
2369         ldb = ldb_module_get_ctx(module);
2370
2371         ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2372
2373         ac = replmd_ctx_init(module, req);
2374         if (ac == NULL) {
2375                 return ldb_module_oom(module);
2376         }
2377
2378         ret = ldb_build_rename_req(&down_req, ldb, ac,
2379                                    ac->req->op.rename.olddn,
2380                                    ac->req->op.rename.newdn,
2381                                    ac->req->controls,
2382                                    ac, replmd_rename_callback,
2383                                    ac->req);
2384         LDB_REQ_SET_LOCATION(down_req);
2385         if (ret != LDB_SUCCESS) {
2386                 talloc_free(ac);
2387                 return ret;
2388         }
2389
2390         /* go on with the call chain */
2391         return ldb_next_request(module, down_req);
2392 }
2393
2394 /* After the rename is compleated, update the whenchanged etc */
2395 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2396 {
2397         struct ldb_context *ldb;
2398         struct replmd_replicated_request *ac;
2399         struct ldb_request *down_req;
2400         struct ldb_message *msg;
2401         const struct dsdb_attribute *rdn_attr;
2402         const char *rdn_name;
2403         const struct ldb_val *rdn_val;
2404         const char *attrs[4] = { NULL, };
2405         time_t t = time(NULL);
2406         int ret;
2407         bool is_urgent = false;
2408
2409         ac = talloc_get_type(req->context, struct replmd_replicated_request);
2410         ldb = ldb_module_get_ctx(ac->module);
2411
2412         if (ares->error != LDB_SUCCESS) {
2413                 return ldb_module_done(ac->req, ares->controls,
2414                                         ares->response, ares->error);
2415         }
2416
2417         if (ares->type != LDB_REPLY_DONE) {
2418                 ldb_set_errstring(ldb,
2419                                   "invalid ldb_reply_type in callback");
2420                 talloc_free(ares);
2421                 return ldb_module_done(ac->req, NULL, NULL,
2422                                         LDB_ERR_OPERATIONS_ERROR);
2423         }
2424
2425         /* TODO:
2426          * - replace the old object with the newly constructed one
2427          */
2428
2429         msg = ldb_msg_new(ac);
2430         if (msg == NULL) {
2431                 ldb_oom(ldb);
2432                 return LDB_ERR_OPERATIONS_ERROR;
2433         }
2434
2435         msg->dn = ac->req->op.rename.newdn;
2436
2437         rdn_name = ldb_dn_get_rdn_name(msg->dn);
2438         if (rdn_name == NULL) {
2439                 talloc_free(ares);
2440                 return ldb_module_done(ac->req, NULL, NULL,
2441                                        ldb_operr(ldb));
2442         }
2443
2444         /* normalize the rdn attribute name */
2445         rdn_attr = dsdb_attribute_by_lDAPDisplayName(ac->schema, rdn_name);
2446         if (rdn_attr == NULL) {
2447                 talloc_free(ares);
2448                 return ldb_module_done(ac->req, NULL, NULL,
2449                                        ldb_operr(ldb));
2450         }
2451         rdn_name = rdn_attr->lDAPDisplayName;
2452
2453         rdn_val = ldb_dn_get_rdn_val(msg->dn);
2454         if (rdn_val == NULL) {
2455                 talloc_free(ares);
2456                 return ldb_module_done(ac->req, NULL, NULL,
2457                                        ldb_operr(ldb));
2458         }
2459
2460         if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2461                 talloc_free(ares);
2462                 return ldb_module_done(ac->req, NULL, NULL,
2463                                        ldb_oom(ldb));
2464         }
2465         if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
2466                 talloc_free(ares);
2467                 return ldb_module_done(ac->req, NULL, NULL,
2468                                        ldb_oom(ldb));
2469         }
2470         if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
2471                 talloc_free(ares);
2472                 return ldb_module_done(ac->req, NULL, NULL,
2473                                        ldb_oom(ldb));
2474         }
2475         if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
2476                 talloc_free(ares);
2477                 return ldb_module_done(ac->req, NULL, NULL,
2478                                        ldb_oom(ldb));
2479         }
2480
2481         /*
2482          * here we let replmd_update_rpmd() only search for
2483          * the existing "replPropertyMetaData" and rdn_name attributes.
2484          *
2485          * We do not want the existing "name" attribute as
2486          * the "name" attribute needs to get the version
2487          * updated on rename even if the rdn value hasn't changed.
2488          *
2489          * This is the diff of the meta data, for a moved user
2490          * on a w2k8r2 server:
2491          *
2492          * # record 1
2493          * -dn: CN=sdf df,CN=Users,DC=bla,DC=base
2494          * +dn: CN=sdf df,OU=TestOU,DC=bla,DC=base
2495          *  replPropertyMetaData:     NDR: struct replPropertyMetaDataBlob
2496          *         version                  : 0x00000001 (1)
2497          *         reserved                 : 0x00000000 (0)
2498          * @@ -66,11 +66,11 @@ replPropertyMetaData:     NDR: struct re
2499          *                      local_usn                : 0x00000000000037a5 (14245)
2500          *                 array: struct replPropertyMetaData1
2501          *                      attid                    : DRSUAPI_ATTID_name (0x90001)
2502          * -                    version                  : 0x00000001 (1)
2503          * -                    originating_change_time  : Wed Feb  9 17:20:49 2011 CET
2504          * +                    version                  : 0x00000002 (2)
2505          * +                    originating_change_time  : Wed Apr  6 15:21:01 2011 CEST
2506          *                      originating_invocation_id: 0d36ca05-5507-4e62-aca3-354bab0d39e1
2507          * -                    originating_usn          : 0x00000000000037a5 (14245)
2508          * -                    local_usn                : 0x00000000000037a5 (14245)
2509          * +                    originating_usn          : 0x0000000000003834 (14388)
2510          * +                    local_usn                : 0x0000000000003834 (14388)
2511          *                 array: struct replPropertyMetaData1
2512          *                      attid                    : DRSUAPI_ATTID_userAccountControl (0x90008)
2513          *                      version                  : 0x00000004 (4)
2514          */
2515         attrs[0] = "replPropertyMetaData";
2516         attrs[1] = "objectClass";
2517         attrs[2] = rdn_name;
2518         attrs[3] = NULL;
2519
2520         ret = replmd_update_rpmd(ac->module, ac->schema, req, attrs,
2521                                  msg, &ac->seq_num, t, &is_urgent);
2522         if (ret == LDB_ERR_REFERRAL) {
2523                 struct ldb_dn *olddn = ac->req->op.rename.olddn;
2524                 struct loadparm_context *lp_ctx;
2525                 char *referral;
2526
2527                 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2528                                          struct loadparm_context);
2529
2530                 referral = talloc_asprintf(req,
2531                                            "ldap://%s/%s",
2532                                            lpcfg_dnsdomain(lp_ctx),
2533                                            ldb_dn_get_linearized(olddn));
2534                 ret = ldb_module_send_referral(req, referral);
2535                 talloc_free(ac);
2536                 return ldb_module_done(req, NULL, NULL, ret);
2537         }
2538
2539         if (ret != LDB_SUCCESS) {
2540                 talloc_free(ares);
2541                 return ldb_module_done(ac->req, NULL, NULL,
2542                                        ldb_error(ldb, ret,
2543                                         "failed to call replmd_update_rpmd()"));
2544         }
2545
2546         if (ac->seq_num == 0) {
2547                 talloc_free(ares);
2548                 return ldb_module_done(ac->req, NULL, NULL,
2549                                        ldb_error(ldb, ret,
2550                                         "internal error seq_num == 0"));
2551         }
2552         ac->is_urgent = is_urgent;
2553
2554         ret = ldb_build_mod_req(&down_req, ldb, ac,
2555                                 msg,
2556                                 req->controls,
2557                                 ac, replmd_op_callback,
2558                                 req);
2559         LDB_REQ_SET_LOCATION(down_req);
2560         if (ret != LDB_SUCCESS) {
2561                 talloc_free(ac);
2562                 return ret;
2563         }
2564
2565         /* current partition control is needed by "replmd_op_callback" */
2566         if (ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID) == NULL) {
2567                 ret = ldb_request_add_control(down_req,
2568                                               DSDB_CONTROL_CURRENT_PARTITION_OID,
2569                                               false, NULL);
2570                 if (ret != LDB_SUCCESS) {
2571                         talloc_free(ac);
2572                         return ret;
2573                 }
2574         }
2575
2576         talloc_steal(down_req, msg);
2577
2578         ret = add_time_element(msg, "whenChanged", t);
2579         if (ret != LDB_SUCCESS) {
2580                 talloc_free(ac);
2581                 return ret;
2582         }
2583
2584         ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2585         if (ret != LDB_SUCCESS) {
2586                 talloc_free(ac);
2587                 return ret;
2588         }
2589
2590         /* go on with the call chain - do the modify after the rename */
2591         return ldb_next_request(ac->module, down_req);
2592 }
2593
2594 /*
2595    remove links from objects that point at this object when an object
2596    is deleted
2597  */
2598 static int replmd_delete_remove_link(struct ldb_module *module,
2599                                      const struct dsdb_schema *schema,
2600                                      struct ldb_dn *dn,
2601                                      struct ldb_message_element *el,
2602                                      const struct dsdb_attribute *sa,
2603                                      struct ldb_request *parent)
2604 {
2605         unsigned int i;
2606         TALLOC_CTX *tmp_ctx = talloc_new(module);
2607         struct ldb_context *ldb = ldb_module_get_ctx(module);
2608
2609         for (i=0; i<el->num_values; i++) {
2610                 struct dsdb_dn *dsdb_dn;
2611                 NTSTATUS status;
2612                 int ret;
2613                 struct GUID guid2;
2614                 struct ldb_message *msg;
2615                 const struct dsdb_attribute *target_attr;
2616                 struct ldb_message_element *el2;
2617                 struct ldb_val dn_val;
2618
2619                 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2620                         continue;
2621                 }
2622
2623                 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2624                 if (!dsdb_dn) {
2625                         talloc_free(tmp_ctx);
2626                         return LDB_ERR_OPERATIONS_ERROR;
2627                 }
2628
2629                 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2630                 if (!NT_STATUS_IS_OK(status)) {
2631                         talloc_free(tmp_ctx);
2632                         return LDB_ERR_OPERATIONS_ERROR;
2633                 }
2634
2635                 /* remove the link */
2636                 msg = ldb_msg_new(tmp_ctx);
2637                 if (!msg) {
2638                         ldb_module_oom(module);
2639                         talloc_free(tmp_ctx);
2640                         return LDB_ERR_OPERATIONS_ERROR;
2641                 }
2642
2643
2644                 msg->dn = dsdb_dn->dn;
2645
2646                 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2647                 if (target_attr == NULL) {
2648                         continue;
2649                 }
2650
2651                 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2652                 if (ret != LDB_SUCCESS) {
2653                         ldb_module_oom(module);
2654                         talloc_free(tmp_ctx);
2655                         return LDB_ERR_OPERATIONS_ERROR;
2656                 }
2657                 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2658                 el2->values = &dn_val;
2659                 el2->num_values = 1;
2660
2661                 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, parent);
2662                 if (ret != LDB_SUCCESS) {
2663                         talloc_free(tmp_ctx);
2664                         return ret;
2665                 }
2666         }
2667         talloc_free(tmp_ctx);
2668         return LDB_SUCCESS;
2669 }
2670
2671
2672 /*
2673   handle update of replication meta data for deletion of objects
2674
2675   This also handles the mapping of delete to a rename operation
2676   to allow deletes to be replicated.
2677  */
2678 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2679 {
2680         int ret = LDB_ERR_OTHER;
2681         bool retb, disallow_move_on_delete;
2682         struct ldb_dn *old_dn, *new_dn;
2683         const char *rdn_name;
2684         const struct ldb_val *rdn_value, *new_rdn_value;
2685         struct GUID guid;
2686         struct ldb_context *ldb = ldb_module_get_ctx(module);
2687         const struct dsdb_schema *schema;
2688         struct ldb_message *msg, *old_msg;
2689         struct ldb_message_element *el;
2690         TALLOC_CTX *tmp_ctx;
2691         struct ldb_result *res, *parent_res;
2692         const char *preserved_attrs[] = {
2693                 /* yes, this really is a hard coded list. See MS-ADTS
2694                    section 3.1.1.5.5.1.1 */
2695                 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2696                 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2697                 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2698                 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2699                 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2700                 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2701                 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2702                 "whenChanged", NULL};
2703         unsigned int i, el_count = 0;
2704         enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2705                                                 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2706         enum deletion_state deletion_state, next_deletion_state;
2707         bool enabled;
2708
2709         if (ldb_dn_is_special(req->op.del.dn)) {
2710                 return ldb_next_request(module, req);
2711         }
2712
2713         tmp_ctx = talloc_new(ldb);
2714         if (!tmp_ctx) {
2715                 ldb_oom(ldb);
2716                 return LDB_ERR_OPERATIONS_ERROR;
2717         }
2718
2719         schema = dsdb_get_schema(ldb, tmp_ctx);
2720         if (!schema) {
2721                 return LDB_ERR_OPERATIONS_ERROR;
2722         }
2723
2724         old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2725
2726         /* we need the complete msg off disk, so we can work out which
2727            attributes need to be removed */
2728         ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2729                                     DSDB_FLAG_NEXT_MODULE |
2730                                     DSDB_SEARCH_SHOW_RECYCLED |
2731                                     DSDB_SEARCH_REVEAL_INTERNALS |
2732                                     DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT, req);
2733         if (ret != LDB_SUCCESS) {
2734                 talloc_free(tmp_ctx);
2735                 return ret;
2736         }
2737         old_msg = res->msgs[0];
2738
2739
2740         ret = dsdb_recyclebin_enabled(module, &enabled);
2741         if (ret != LDB_SUCCESS) {
2742                 talloc_free(tmp_ctx);
2743                 return ret;
2744         }
2745
2746         if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2747                 if (!enabled) {
2748                         deletion_state = OBJECT_TOMBSTONE;
2749                         next_deletion_state = OBJECT_REMOVED;
2750                 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2751                         deletion_state = OBJECT_RECYCLED;
2752                         next_deletion_state = OBJECT_REMOVED;
2753                 } else {
2754                         deletion_state = OBJECT_DELETED;
2755                         next_deletion_state = OBJECT_RECYCLED;
2756                 }
2757         } else {
2758                 deletion_state = OBJECT_NOT_DELETED;
2759                 if (enabled) {
2760                         next_deletion_state = OBJECT_DELETED;
2761                 } else {
2762                         next_deletion_state = OBJECT_TOMBSTONE;
2763                 }
2764         }
2765
2766         if (next_deletion_state == OBJECT_REMOVED) {
2767                 struct auth_session_info *session_info =
2768                                 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2769                 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2770                         ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2771                                         ldb_dn_get_linearized(old_msg->dn));
2772                         return LDB_ERR_UNWILLING_TO_PERFORM;
2773                 }
2774
2775                 /* it is already deleted - really remove it this time */
2776                 talloc_free(tmp_ctx);
2777                 return ldb_next_request(module, req);
2778         }
2779
2780         rdn_name = ldb_dn_get_rdn_name(old_dn);
2781         rdn_value = ldb_dn_get_rdn_val(old_dn);
2782         if ((rdn_name == NULL) || (rdn_value == NULL)) {
2783                 talloc_free(tmp_ctx);
2784                 return ldb_operr(ldb);
2785         }
2786
2787         msg = ldb_msg_new(tmp_ctx);
2788         if (msg == NULL) {
2789                 ldb_module_oom(module);
2790                 talloc_free(tmp_ctx);
2791                 return LDB_ERR_OPERATIONS_ERROR;
2792         }
2793
2794         msg->dn = old_dn;
2795
2796         if (deletion_state == OBJECT_NOT_DELETED){
2797                 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2798                 disallow_move_on_delete =
2799                         (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
2800                                 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2801
2802                 /* work out where we will be renaming this object to */
2803                 if (!disallow_move_on_delete) {
2804                         ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
2805                                                           &new_dn);
2806                         if (ret != LDB_SUCCESS) {
2807                                 /* this is probably an attempted delete on a partition
2808                                  * that doesn't allow delete operations, such as the
2809                                  * schema partition */
2810                                 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2811                                                            ldb_dn_get_linearized(old_dn));
2812                                 talloc_free(tmp_ctx);
2813                                 return LDB_ERR_UNWILLING_TO_PERFORM;
2814                         }
2815                 } else {
2816                         new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
2817                         if (new_dn == NULL) {
2818                                 ldb_module_oom(module);
2819                                 talloc_free(tmp_ctx);
2820                                 return LDB_ERR_OPERATIONS_ERROR;
2821                         }
2822                 }
2823
2824                 /* get the objects GUID from the search we just did */
2825                 guid = samdb_result_guid(old_msg, "objectGUID");
2826
2827                 /* Add a formatted child */
2828                 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2829                                                 rdn_name,
2830                                                 ldb_dn_escape_value(tmp_ctx, *rdn_value),
2831                                                 GUID_string(tmp_ctx, &guid));
2832                 if (!retb) {
2833                         DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2834                                         ldb_dn_get_linearized(new_dn)));
2835                         talloc_free(tmp_ctx);
2836                         return LDB_ERR_OPERATIONS_ERROR;
2837                 }
2838
2839                 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2840                 if (ret != LDB_SUCCESS) {
2841                         DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2842                         ldb_module_oom(module);
2843                         talloc_free(tmp_ctx);
2844                         return ret;
2845                 }
2846                 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
2847         }
2848
2849         /*
2850           now we need to modify the object in the following ways:
2851
2852           - add isDeleted=TRUE
2853           - update rDN and name, with new rDN
2854           - remove linked attributes
2855           - remove objectCategory and sAMAccountType
2856           - remove attribs not on the preserved list
2857              - preserved if in above list, or is rDN
2858           - remove all linked attribs from this object
2859           - remove all links from other objects to this object
2860           - add lastKnownParent
2861           - update replPropertyMetaData?
2862
2863           see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2864          */
2865
2866         /* we need the storage form of the parent GUID */
2867         ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2868                                     ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2869                                     DSDB_FLAG_NEXT_MODULE |
2870                                     DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2871                                     DSDB_SEARCH_REVEAL_INTERNALS|
2872                                     DSDB_SEARCH_SHOW_RECYCLED, req);
2873         if (ret != LDB_SUCCESS) {
2874                 talloc_free(tmp_ctx);
2875                 return ret;
2876         }
2877
2878         if (deletion_state == OBJECT_NOT_DELETED){
2879                 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2880                                                    ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2881                 if (ret != LDB_SUCCESS) {
2882                         DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2883                         ldb_module_oom(module);
2884                         talloc_free(tmp_ctx);
2885                         return ret;
2886                 }
2887                 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2888         }
2889
2890         switch (next_deletion_state){
2891
2892         case OBJECT_DELETED:
2893
2894                 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2895                 if (ret != LDB_SUCCESS) {
2896                         DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
2897                         ldb_module_oom(module);
2898                         talloc_free(tmp_ctx);
2899                         return ret;
2900                 }
2901                 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2902
2903                 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_DELETE, NULL);
2904                 if (ret != LDB_SUCCESS) {
2905                         talloc_free(tmp_ctx);
2906                         ldb_module_oom(module);
2907                         return ret;
2908                 }
2909
2910                 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_DELETE, NULL);
2911                 if (ret != LDB_SUCCESS) {
2912                         talloc_free(tmp_ctx);
2913                         ldb_module_oom(module);
2914                         return ret;
2915                 }
2916
2917                 break;
2918
2919         case OBJECT_RECYCLED:
2920         case OBJECT_TOMBSTONE:
2921
2922                 /* we also mark it as recycled, meaning this object can't be
2923                    recovered (we are stripping its attributes) */
2924                 if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008_R2) {
2925                         ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
2926                         if (ret != LDB_SUCCESS) {
2927                                 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
2928                                 ldb_module_oom(module);
2929                                 talloc_free(tmp_ctx);
2930                                 return ret;
2931                         }
2932                         msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2933                 }
2934
2935                 /* work out which of the old attributes we will be removing */
2936                 for (i=0; i<old_msg->num_elements; i++) {
2937                         const struct dsdb_attribute *sa;
2938                         el = &old_msg->elements[i];
2939                         sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2940                         if (!sa) {
2941                                 talloc_free(tmp_ctx);
2942                                 return LDB_ERR_OPERATIONS_ERROR;
2943                         }
2944                         if (ldb_attr_cmp(el->name, rdn_name) == 0) {
2945                                 /* don't remove the rDN */
2946                                 continue;
2947                         }
2948                         if (sa->linkID && sa->linkID & 1) {
2949                                 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa, req);
2950                                 if (ret != LDB_SUCCESS) {
2951                                         talloc_free(tmp_ctx);
2952                                         return LDB_ERR_OPERATIONS_ERROR;
2953                                 }
2954                                 continue;
2955                         }
2956                         if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
2957                                 continue;
2958                         }
2959                         ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
2960                         if (ret != LDB_SUCCESS) {
2961                                 talloc_free(tmp_ctx);
2962                                 ldb_module_oom(module);
2963                                 return ret;
2964                         }
2965                 }
2966                 break;
2967
2968         default:
2969                 break;
2970         }
2971
2972         if (deletion_state == OBJECT_NOT_DELETED) {
2973                 const struct dsdb_attribute *sa;
2974
2975                 /* work out what the new rdn value is, for updating the
2976                    rDN and name fields */
2977                 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
2978                 if (new_rdn_value == NULL) {
2979                         talloc_free(tmp_ctx);
2980                         return ldb_operr(ldb);
2981                 }
2982
2983                 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
2984                 if (!sa) {
2985                         talloc_free(tmp_ctx);
2986                         return LDB_ERR_OPERATIONS_ERROR;
2987                 }
2988
2989                 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
2990                                         &el);
2991                 if (ret != LDB_SUCCESS) {
2992                         talloc_free(tmp_ctx);
2993                         return ret;
2994                 }
2995                 el->flags = LDB_FLAG_MOD_REPLACE;
2996
2997                 el = ldb_msg_find_element(old_msg, "name");
2998                 if (el) {
2999                         ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
3000                         if (ret != LDB_SUCCESS) {
3001                                 talloc_free(tmp_ctx);
3002                                 return ret;
3003                         }
3004                         el->flags = LDB_FLAG_MOD_REPLACE;
3005                 }
3006         }
3007
3008         ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE, req);
3009         if (ret != LDB_SUCCESS) {
3010                 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
3011                                        ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
3012                 talloc_free(tmp_ctx);
3013                 return ret;
3014         }
3015
3016         if (deletion_state == OBJECT_NOT_DELETED) {
3017                 /* now rename onto the new DN */
3018                 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE, req);
3019                 if (ret != LDB_SUCCESS){
3020                         DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
3021                                  ldb_dn_get_linearized(old_dn),
3022                                  ldb_dn_get_linearized(new_dn),
3023                                  ldb_errstring(ldb)));
3024                         talloc_free(tmp_ctx);
3025                         return ret;
3026                 }
3027         }
3028
3029         talloc_free(tmp_ctx);
3030
3031         return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
3032 }
3033
3034
3035
3036 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
3037 {
3038         return ret;
3039 }
3040
3041 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
3042 {
3043         int ret = LDB_ERR_OTHER;
3044         /* TODO: do some error mapping */
3045         return ret;
3046 }
3047
3048
3049 static struct replPropertyMetaData1 *
3050 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
3051                                         enum drsuapi_DsAttributeId attid)
3052 {
3053         uint32_t i;
3054         struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
3055
3056         for (i = 0; i < rpmd_ctr->count; i++) {
3057                 if (rpmd_ctr->array[i].attid == attid) {
3058                         return &rpmd_ctr->array[i];
3059                 }
3060         }
3061         return NULL;
3062 }
3063
3064
3065 /*
3066    return true if an update is newer than an existing entry
3067    see section 5.11 of MS-ADTS
3068 */
3069 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
3070                                    const struct GUID *update_invocation_id,
3071                                    uint32_t current_version,
3072                                    uint32_t update_version,
3073                                    NTTIME current_change_time,
3074                                    NTTIME update_change_time)
3075 {
3076         if (update_version != current_version) {
3077                 return update_version > current_version;
3078         }
3079         if (update_change_time != current_change_time) {
3080                 return update_change_time > current_change_time;
3081         }
3082         return GUID_compare(update_invocation_id, current_invocation_id) > 0;
3083 }
3084
3085 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
3086                                                   struct replPropertyMetaData1 *new_m)
3087 {
3088         return replmd_update_is_newer(&cur_m->originating_invocation_id,
3089                                       &new_m->originating_invocation_id,
3090                                       cur_m->version,
3091                                       new_m->version,
3092                                       cur_m->originating_change_time,
3093                                       new_m->originating_change_time);
3094 }
3095
3096
3097 /*
3098   form a conflict DN
3099  */
3100 static struct ldb_dn *replmd_conflict_dn(TALLOC_CTX *mem_ctx, struct ldb_dn *dn, struct GUID *guid)
3101 {
3102         const struct ldb_val *rdn_val;
3103         const char *rdn_name;
3104         struct ldb_dn *new_dn;
3105
3106         rdn_val = ldb_dn_get_rdn_val(dn);
3107         rdn_name = ldb_dn_get_rdn_name(dn);
3108         if (!rdn_val || !rdn_name) {
3109                 return NULL;
3110         }
3111
3112         new_dn = ldb_dn_copy(mem_ctx, dn);
3113         if (!new_dn) {
3114                 return NULL;
3115         }
3116
3117         if (!ldb_dn_remove_child_components(new_dn, 1)) {
3118                 return NULL;
3119         }
3120
3121         if (!ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ACNF:%s",
3122                                   rdn_name,
3123                                   ldb_dn_escape_value(new_dn, *rdn_val),
3124                                   GUID_string(new_dn, guid))) {
3125                 return NULL;
3126         }
3127
3128         return new_dn;
3129 }
3130
3131
3132 /*
3133   perform a modify operation which sets the rDN and name attributes to
3134   their current values. This has the effect of changing these
3135   attributes to have been last updated by the current DC. This is
3136   needed to ensure that renames performed as part of conflict
3137   resolution are propogated to other DCs
3138  */
3139 static int replmd_name_modify(struct replmd_replicated_request *ar,
3140                               struct ldb_request *req, struct ldb_dn *dn)
3141 {
3142         struct ldb_message *msg;
3143         const char *rdn_name;
3144         const struct ldb_val *rdn_val;
3145         const struct dsdb_attribute *rdn_attr;
3146         int ret;
3147
3148         msg = ldb_msg_new(req);
3149         if (msg == NULL) {
3150                 goto failed;
3151         }
3152         msg->dn = dn;
3153
3154         rdn_name = ldb_dn_get_rdn_name(dn);
3155         if (rdn_name == NULL) {
3156                 goto failed;
3157         }
3158
3159         /* normalize the rdn attribute name */
3160         rdn_attr = dsdb_attribute_by_lDAPDisplayName(ar->schema, rdn_name);
3161         if (rdn_attr == NULL) {
3162                 goto failed;
3163         }
3164         rdn_name = rdn_attr->lDAPDisplayName;
3165
3166         rdn_val = ldb_dn_get_rdn_val(dn);
3167         if (rdn_val == NULL) {
3168                 goto failed;
3169         }
3170
3171         if (ldb_msg_add_empty(msg, rdn_name, LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3172                 goto failed;
3173         }
3174         if (ldb_msg_add_value(msg, rdn_name, rdn_val, NULL) != 0) {
3175                 goto failed;
3176         }
3177         if (ldb_msg_add_empty(msg, "name", LDB_FLAG_MOD_REPLACE, NULL) != 0) {
3178                 goto failed;
3179         }
3180         if (ldb_msg_add_value(msg, "name", rdn_val, NULL) != 0) {
3181                 goto failed;
3182         }
3183
3184         ret = dsdb_module_modify(ar->module, msg, DSDB_FLAG_OWN_MODULE, req);
3185         if (ret != LDB_SUCCESS) {
3186                 DEBUG(0,(__location__ ": Failed to modify rDN/name of conflict DN '%s' - %s",
3187                          ldb_dn_get_linearized(dn),
3188                          ldb_errstring(ldb_module_get_ctx(ar->module))));
3189                 return ret;
3190         }
3191
3192         talloc_free(msg);
3193
3194         return LDB_SUCCESS;
3195
3196 failed:
3197         talloc_free(msg);
3198         DEBUG(0,(__location__ ": Failed to setup modify rDN/name of conflict DN '%s'",
3199                  ldb_dn_get_linearized(dn)));
3200         return LDB_ERR_OPERATIONS_ERROR;
3201 }
3202
3203
3204 /*
3205   callback for conflict DN handling where we have renamed the incoming
3206   record. After renaming it, we need to ensure the change of name and
3207   rDN for the incoming record is seen as an originating update by this DC.
3208  */
3209 static int replmd_op_name_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
3210 {
3211         struct replmd_replicated_request *ar =
3212                 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3213         int ret;
3214
3215         if (ares->error != LDB_SUCCESS) {
3216                 /* call the normal callback for everything except success */
3217                 return replmd_op_callback(req, ares);
3218         }
3219
3220         /* perform a modify of the rDN and name of the record */
3221         ret = replmd_name_modify(ar, req, req->op.add.message->dn);
3222         if (ret != LDB_SUCCESS) {
3223                 ares->error = ret;
3224                 return replmd_op_callback(req, ares);
3225         }
3226
3227         return replmd_op_callback(req, ares);
3228 }
3229
3230 /*
3231   callback for replmd_replicated_apply_add()
3232   This copes with the creation of conflict records in the case where
3233   the DN exists, but with a different objectGUID
3234  */
3235 static int replmd_op_add_callback(struct ldb_request *req, struct ldb_reply *ares)
3236 {
3237         struct ldb_dn *conflict_dn;
3238         struct replmd_replicated_request *ar =
3239                 talloc_get_type_abort(req->context, struct replmd_replicated_request);
3240         struct ldb_result *res;
3241         const char *attrs[] = { "replPropertyMetaData", "objectGUID", NULL };
3242         int ret;
3243         const struct ldb_val *rmd_value, *omd_value;
3244         struct replPropertyMetaDataBlob omd, rmd;
3245         enum ndr_err_code ndr_err;
3246         bool rename_incoming_record;
3247         struct replPropertyMetaData1 *rmd_name, *omd_name;
3248
3249         if (ares->error != LDB_ERR_ENTRY_ALREADY_EXISTS) {
3250                 /* call the normal callback for everything except
3251                    conflicts */
3252                 return replmd_op_callback(req, ares);
3253         }
3254
3255         /*
3256          * we have a conflict, and need to decide if we will keep the
3257          * new record or the old record
3258          */
3259         conflict_dn = req->op.add.message->dn;
3260
3261         /*
3262          * first we need the replPropertyMetaData attribute from the
3263          * old record
3264          */
3265         ret = dsdb_module_search_dn(ar->module, req, &res, conflict_dn,
3266                                     attrs,
3267                                     DSDB_FLAG_NEXT_MODULE |
3268                                     DSDB_SEARCH_SHOW_DELETED |
3269                                     DSDB_SEARCH_SHOW_RECYCLED, req);
3270         if (ret != LDB_SUCCESS) {
3271                 DEBUG(0,(__location__ ": Unable to find object for conflicting record '%s'\n",
3272                          ldb_dn_get_linearized(conflict_dn)));
3273                 goto failed;
3274         }
3275
3276         omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
3277         if (omd_value == NULL) {
3278                 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for conflicting record '%s'\n",
3279                          ldb_dn_get_linearized(conflict_dn)));
3280                 goto failed;
3281         }
3282
3283         ndr_err = ndr_pull_struct_blob(omd_value, res->msgs[0], &omd,
3284                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3285         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3286                 DEBUG(0,(__location__ ": Failed to parse old replPropertyMetaData for %s\n",
3287                          ldb_dn_get_linearized(conflict_dn)));
3288                 goto failed;
3289         }
3290
3291         /*
3292          * and the replPropertyMetaData attribute from the
3293          * new record
3294          */
3295         rmd_value = ldb_msg_find_ldb_val(req->op.add.message, "replPropertyMetaData");
3296         if (rmd_value == NULL) {
3297                 DEBUG(0,(__location__ ": Unable to find replPropertyMetaData for new record '%s'\n",
3298                          ldb_dn_get_linearized(conflict_dn)));
3299                 goto failed;
3300         }
3301
3302         ndr_err = ndr_pull_struct_blob(rmd_value, req, &rmd,
3303                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3304         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3305                 DEBUG(0,(__location__ ": Failed to parse new replPropertyMetaData for %s\n",
3306                          ldb_dn_get_linearized(conflict_dn)));
3307                 goto failed;
3308         }
3309
3310         /* we decide which is newer based on the RPMD on the name
3311            attribute.  See [MS-DRSR] ResolveNameConflict */
3312         rmd_name = replmd_replPropertyMetaData1_find_attid(&rmd, DRSUAPI_ATTID_name);
3313         omd_name = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTID_name);
3314         if (!rmd_name || !omd_name) {
3315                 DEBUG(0,(__location__ ": Failed to find name attribute in replPropertyMetaData for %s\n",
3316                          ldb_dn_get_linearized(conflict_dn)));
3317                 goto failed;
3318         }
3319
3320         rename_incoming_record = !replmd_replPropertyMetaData1_is_newer(omd_name, rmd_name);
3321
3322         if (rename_incoming_record) {
3323                 struct GUID guid;
3324                 struct ldb_dn *new_dn;
3325                 struct ldb_message *new_msg;
3326
3327                 guid = samdb_result_guid(req->op.add.message, "objectGUID");
3328                 if (GUID_all_zero(&guid)) {
3329                         DEBUG(0,(__location__ ": Failed to find objectGUID for conflicting incoming record %s\n",
3330                                  ldb_dn_get_linearized(conflict_dn)));
3331                         goto failed;
3332                 }
3333                 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3334                 if (new_dn == NULL) {
3335                         DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3336                                  ldb_dn_get_linearized(conflict_dn)));
3337                         goto failed;
3338                 }
3339
3340                 DEBUG(1,(__location__ ": Resolving conflict record via incoming rename '%s' -> '%s'\n",
3341                          ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3342
3343                 /* re-submit the request, but with a different
3344                    callback, so we don't loop forever. */
3345                 new_msg = ldb_msg_copy_shallow(req, req->op.add.message);
3346                 if (!new_msg) {
3347                         goto failed;
3348                         DEBUG(0,(__location__ ": Failed to copy conflict DN message for %s\n",
3349                                  ldb_dn_get_linearized(conflict_dn)));
3350                 }
3351                 new_msg->dn = new_dn;
3352                 req->op.add.message = new_msg;
3353                 req->callback = replmd_op_name_modify_callback;
3354
3355                 return ldb_next_request(ar->module, req);
3356         } else {
3357                 /* we are renaming the existing record */
3358                 struct GUID guid;
3359                 struct ldb_dn *new_dn;
3360
3361                 guid = samdb_result_guid(res->msgs[0], "objectGUID");
3362                 if (GUID_all_zero(&guid)) {
3363                         DEBUG(0,(__location__ ": Failed to find objectGUID for existing conflict record %s\n",
3364                                  ldb_dn_get_linearized(conflict_dn)));
3365                         goto failed;
3366                 }
3367
3368                 new_dn = replmd_conflict_dn(req, conflict_dn, &guid);
3369                 if (new_dn == NULL) {
3370                         DEBUG(0,(__location__ ": Failed to form conflict DN for %s\n",
3371                                  ldb_dn_get_linearized(conflict_dn)));
3372                         goto failed;
3373                 }
3374
3375                 DEBUG(1,(__location__ ": Resolving conflict record via existing rename '%s' -> '%s'\n",
3376                          ldb_dn_get_linearized(conflict_dn), ldb_dn_get_linearized(new_dn)));
3377
3378                 ret = dsdb_module_rename(ar->module, conflict_dn, new_dn,
3379                                          DSDB_FLAG_OWN_MODULE, req);
3380                 if (ret != LDB_SUCCESS) {
3381                         DEBUG(0,(__location__ ": Failed to rename conflict dn '%s' to '%s' - %s\n",
3382                                  ldb_dn_get_linearized(conflict_dn),
3383                                  ldb_dn_get_linearized(new_dn),
3384                                  ldb_errstring(ldb_module_get_ctx(ar->module))));
3385                         goto failed;
3386                 }
3387
3388                 /*
3389                  * now we need to ensure that the rename is seen as an
3390                  * originating update. We do that with a modify.
3391                  */
3392                 ret = replmd_name_modify(ar, req, new_dn);
3393                 if (ret != LDB_SUCCESS) {
3394                         goto failed;
3395                 }
3396
3397                 req->callback = replmd_op_callback;
3398
3399                 return ldb_next_request(ar->module, req);
3400         }
3401
3402 failed:
3403         /* on failure do the original callback. This means replication
3404          * will stop with an error, but there is not much else we can
3405          * do
3406          */
3407         return replmd_op_callback(req, ares);
3408 }
3409
3410 /*
3411   this is called when a new object comes in over DRS
3412  */
3413 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
3414 {
3415         struct ldb_context *ldb;
3416         struct ldb_request *change_req;
3417         enum ndr_err_code ndr_err;
3418         struct ldb_message *msg;
3419         struct replPropertyMetaDataBlob *md;
3420         struct ldb_val md_value;
3421         unsigned int i;
3422         int ret;
3423
3424         /*
3425          * TODO: check if the parent object exist
3426          */
3427
3428         /*
3429          * TODO: handle the conflict case where an object with the
3430          *       same name exist
3431          */
3432
3433         ldb = ldb_module_get_ctx(ar->module);
3434         msg = ar->objs->objects[ar->index_current].msg;
3435         md = ar->objs->objects[ar->index_current].meta_data;
3436
3437         ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3438         if (ret != LDB_SUCCESS) {
3439                 return replmd_replicated_request_error(ar, ret);
3440         }
3441
3442         ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
3443         if (ret != LDB_SUCCESS) {
3444                 return replmd_replicated_request_error(ar, ret);
3445         }
3446
3447         ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3448         if (ret != LDB_SUCCESS) {
3449                 return replmd_replicated_request_error(ar, ret);
3450         }
3451
3452         ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
3453         if (ret != LDB_SUCCESS) {
3454                 return replmd_replicated_request_error(ar, ret);
3455         }
3456
3457         ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3458         if (ret != LDB_SUCCESS) {
3459                 return replmd_replicated_request_error(ar, ret);
3460         }
3461
3462         /* remove any message elements that have zero values */
3463         for (i=0; i<msg->num_elements; i++) {
3464                 struct ldb_message_element *el = &msg->elements[i];
3465
3466                 if (el->num_values == 0) {
3467                         DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
3468                                  el->name));
3469                         memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
3470                         msg->num_elements--;
3471                         i--;
3472                         continue;
3473                 }
3474         }
3475
3476         /*
3477          * the meta data array is already sorted by the caller
3478          */
3479         for (i=0; i < md->ctr.ctr1.count; i++) {
3480                 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
3481         }
3482         ndr_err = ndr_push_struct_blob(&md_value, msg, md,
3483                                        (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3484         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3485                 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3486                 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3487         }
3488         ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
3489         if (ret != LDB_SUCCESS) {
3490                 return replmd_replicated_request_error(ar, ret);
3491         }
3492
3493         replmd_ldb_message_sort(msg, ar->schema);
3494
3495         if (DEBUGLVL(4)) {
3496                 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
3497                 DEBUG(4, ("DRS replication add message:\n%s\n", s));
3498                 talloc_free(s);
3499         }
3500
3501         ret = ldb_build_add_req(&change_req,
3502                                 ldb,
3503                                 ar,
3504                                 msg,
3505                                 ar->controls,
3506                                 ar,
3507                                 replmd_op_add_callback,
3508                                 ar->req);
3509         LDB_REQ_SET_LOCATION(change_req);
3510         if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3511
3512         /* current partition control needed by "repmd_op_callback" */
3513         ret = ldb_request_add_control(change_req,
3514                                       DSDB_CONTROL_CURRENT_PARTITION_OID,
3515                                       false, NULL);
3516         if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3517
3518         return ldb_next_request(ar->module, change_req);
3519 }
3520
3521 /*
3522   handle renames that come in over DRS replication
3523  */
3524 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
3525                                            struct ldb_message *msg,
3526                                            struct replPropertyMetaDataBlob *rmd,
3527                                            struct replPropertyMetaDataBlob *omd,
3528                                            struct ldb_request *parent)
3529 {
3530         struct replPropertyMetaData1 *md_remote;
3531         struct replPropertyMetaData1 *md_local;
3532
3533         if (ldb_dn_compare(msg->dn, ar->search_msg->dn) == 0) {
3534                 /* no rename */
3535                 return LDB_SUCCESS;
3536         }
3537
3538         /* now we need to check for double renames. We could have a
3539          * local rename pending which our replication partner hasn't
3540          * received yet. We choose which one wins by looking at the
3541          * attribute stamps on the two objects, the newer one wins
3542          */
3543         md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
3544         md_local  = replmd_replPropertyMetaData1_find_attid(omd, DRSUAPI_ATTID_name);
3545         /* if there is no name attribute then we have to assume the
3546            object we've received is in fact newer */
3547         if (!md_remote || !md_local ||
3548             replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
3549                 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
3550                          ldb_dn_get_linearized(ar->search_msg->dn),
3551                          ldb_dn_get_linearized(msg->dn)));
3552                 /* pass rename to the next module
3553                  * so it doesn't appear as an originating update */
3554                 return dsdb_module_rename(ar->module,
3555                                           ar->search_msg->dn, msg->dn,
3556                                           DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX, parent);
3557         }
3558
3559         /* we're going to keep our old object */
3560         DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
3561                  ldb_dn_get_linearized(ar->search_msg->dn),
3562                  ldb_dn_get_linearized(msg->dn)));
3563         return LDB_SUCCESS;
3564 }
3565
3566
3567 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
3568 {
3569         struct ldb_context *ldb;
3570         struct ldb_request *change_req;
3571         enum ndr_err_code ndr_err;
3572         struct ldb_message *msg;
3573         struct replPropertyMetaDataBlob *rmd;
3574         struct replPropertyMetaDataBlob omd;
3575         const struct ldb_val *omd_value;
3576         struct replPropertyMetaDataBlob nmd;
3577         struct ldb_val nmd_value;
3578         unsigned int i;
3579         uint32_t j,ni=0;
3580         unsigned int removed_attrs = 0;
3581         int ret;
3582
3583         ldb = ldb_module_get_ctx(ar->module);
3584         msg = ar->objs->objects[ar->index_current].msg;
3585         rmd = ar->objs->objects[ar->index_current].meta_data;
3586         ZERO_STRUCT(omd);
3587         omd.version = 1;
3588
3589         /* find existing meta data */
3590         omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
3591         if (omd_value) {
3592                 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
3593                                                (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3594                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3595                         NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3596                         return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3597                 }
3598
3599                 if (omd.version != 1) {
3600                         return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3601                 }
3602         }
3603
3604         /* handle renames that come in over DRS */
3605         ret = replmd_replicated_handle_rename(ar, msg, rmd, &omd, ar->req);
3606         if (ret != LDB_SUCCESS) {
3607                 ldb_debug(ldb, LDB_DEBUG_FATAL,
3608                           "replmd_replicated_request rename %s => %s failed - %s\n",
3609                           ldb_dn_get_linearized(ar->search_msg->dn),
3610                           ldb_dn_get_linearized(msg->dn),
3611                           ldb_errstring(ldb));
3612                 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
3613         }
3614
3615         ZERO_STRUCT(nmd);
3616         nmd.version = 1;
3617         nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3618         nmd.ctr.ctr1.array = talloc_array(ar,
3619                                           struct replPropertyMetaData1,
3620                                           nmd.ctr.ctr1.count);
3621         if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3622
3623         /* first copy the old meta data */
3624         for (i=0; i < omd.ctr.ctr1.count; i++) {
3625                 nmd.ctr.ctr1.array[ni]  = omd.ctr.ctr1.array[i];
3626                 ni++;
3627         }
3628
3629         ar->seq_num = 0;
3630         /* now merge in the new meta data */
3631         for (i=0; i < rmd->ctr.ctr1.count; i++) {
3632                 bool found = false;
3633
3634                 for (j=0; j < ni; j++) {
3635                         bool cmp;
3636
3637                         if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
3638                                 continue;
3639                         }
3640
3641                         cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
3642                                                                     &rmd->ctr.ctr1.array[i]);
3643                         if (cmp) {
3644                                 /* replace the entry */
3645                                 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
3646                                 if (ar->seq_num == 0) {
3647                                         ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3648                                         if (ret != LDB_SUCCESS) {
3649                                                 return replmd_replicated_request_error(ar, ret);
3650                                         }
3651                                 }
3652                                 nmd.ctr.ctr1.array[j].local_usn = ar->seq_num;
3653                                 found = true;
3654                                 break;
3655                         }
3656
3657                         if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) {
3658                                 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
3659                                          msg->elements[i-removed_attrs].name,
3660                                          ldb_dn_get_linearized(msg->dn),
3661                                          GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
3662                         }
3663
3664                         /* we don't want to apply this change so remove the attribute */
3665                         ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
3666                         removed_attrs++;
3667
3668                         found = true;
3669                         break;
3670                 }
3671
3672                 if (found) continue;
3673
3674                 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
3675                 if (ar->seq_num == 0) {
3676                         ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3677                         if (ret != LDB_SUCCESS) {
3678                                 return replmd_replicated_request_error(ar, ret);
3679                         }
3680                 }
3681                 nmd.ctr.ctr1.array[ni].local_usn = ar->seq_num;
3682                 ni++;
3683         }
3684
3685         /*
3686          * finally correct the size of the meta_data array
3687          */
3688         nmd.ctr.ctr1.count = ni;
3689
3690         /*
3691          * the rdn attribute (the alias for the name attribute),
3692          * 'cn' for most objects is the last entry in the meta data array
3693          * we have stored
3694          *
3695          * sort the new meta data array
3696          */
3697         ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
3698         if (ret != LDB_SUCCESS) {
3699                 return ret;
3700         }
3701
3702         /*
3703          * check if some replicated attributes left, otherwise skip the ldb_modify() call
3704          */
3705         if (msg->num_elements == 0) {
3706                 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
3707                           ar->index_current);
3708
3709                 ar->index_current++;
3710                 return replmd_replicated_apply_next(ar);
3711         }
3712
3713         ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
3714                   ar->index_current, msg->num_elements);
3715
3716         /* create the meta data value */
3717         ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
3718                                        (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3719         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3720                 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3721                 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3722         }
3723
3724         /*
3725          * when we know that we'll modify the record, add the whenChanged, uSNChanged
3726          * and replPopertyMetaData attributes
3727          */
3728         ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3729         if (ret != LDB_SUCCESS) {
3730                 return replmd_replicated_request_error(ar, ret);
3731         }
3732         ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3733         if (ret != LDB_SUCCESS) {
3734                 return replmd_replicated_request_error(ar, ret);
3735         }
3736         ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
3737         if (ret != LDB_SUCCESS) {
3738                 return replmd_replicated_request_error(ar, ret);
3739         }
3740
3741         replmd_ldb_message_sort(msg, ar->schema);
3742
3743         /* we want to replace the old values */
3744         for (i=0; i < msg->num_elements; i++) {
3745                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
3746         }
3747
3748         if (DEBUGLVL(4)) {
3749                 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3750                 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
3751                 talloc_free(s);
3752         }
3753
3754         ret = ldb_build_mod_req(&change_req,
3755                                 ldb,
3756                                 ar,
3757                                 msg,
3758                                 ar->controls,
3759                                 ar,
3760                                 replmd_op_callback,
3761                                 ar->req);
3762         LDB_REQ_SET_LOCATION(change_req);
3763         if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3764
3765         /* current partition control needed by "repmd_op_callback" */
3766         ret = ldb_request_add_control(change_req,
3767                                       DSDB_CONTROL_CURRENT_PARTITION_OID,
3768                                       false, NULL);
3769         if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3770
3771         return ldb_next_request(ar->module, change_req);
3772 }
3773
3774 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
3775                                                    struct ldb_reply *ares)
3776 {
3777         struct replmd_replicated_request *ar = talloc_get_type(req->context,
3778                                                struct replmd_replicated_request);
3779         int ret;
3780
3781         if (!ares) {
3782                 return ldb_module_done(ar->req, NULL, NULL,
3783                                         LDB_ERR_OPERATIONS_ERROR);
3784         }
3785         if (ares->error != LDB_SUCCESS &&
3786             ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3787                 return ldb_module_done(ar->req, ares->controls,
3788                                         ares->response, ares->error);
3789         }
3790
3791         switch (ares->type) {
3792         case LDB_REPLY_ENTRY:
3793                 ar->search_msg = talloc_steal(ar, ares->message);
3794                 break;
3795
3796         case LDB_REPLY_REFERRAL:
3797                 /* we ignore referrals */
3798                 break;
3799
3800         case LDB_REPLY_DONE:
3801                 if (ar->search_msg != NULL) {
3802                         ret = replmd_replicated_apply_merge(ar);
3803                 } else {
3804                         ret = replmd_replicated_apply_add(ar);
3805                 }
3806                 if (ret != LDB_SUCCESS) {
3807                         return ldb_module_done(ar->req, NULL, NULL, ret);
3808                 }
3809         }
3810
3811         talloc_free(ares);
3812         return LDB_SUCCESS;
3813 }
3814
3815 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
3816
3817 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
3818 {
3819         struct ldb_context *ldb;
3820         int ret;
3821         char *tmp_str;
3822         char *filter;
3823         struct ldb_request *search_req;
3824         struct ldb_search_options_control *options;
3825
3826         if (ar->index_current >= ar->objs->num_objects) {
3827                 /* done with it, go to next stage */
3828                 return replmd_replicated_uptodate_vector(ar);
3829         }
3830
3831         ldb = ldb_module_get_ctx(ar->module);
3832         ar->search_msg = NULL;
3833
3834         tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
3835         if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3836
3837         filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3838         if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3839         talloc_free(tmp_str);
3840
3841         ret = ldb_build_search_req(&search_req,
3842                                    ldb,
3843                                    ar,
3844                                    NULL,
3845                                    LDB_SCOPE_SUBTREE,
3846                                    filter,
3847                                    NULL,
3848                                    NULL,
3849                                    ar,
3850                                    replmd_replicated_apply_search_callback,
3851                                    ar->req);
3852         LDB_REQ_SET_LOCATION(search_req);
3853
3854         ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
3855                                       true, NULL);
3856         if (ret != LDB_SUCCESS) {
3857                 return ret;
3858         }
3859
3860         /* we need to cope with cross-partition links, so search for
3861            the GUID over all partitions */
3862         options = talloc(search_req, struct ldb_search_options_control);
3863         if (options == NULL) {
3864                 DEBUG(0, (__location__ ": out of memory\n"));
3865                 return LDB_ERR_OPERATIONS_ERROR;
3866         }
3867         options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
3868
3869         ret = ldb_request_add_control(search_req,
3870                                       LDB_CONTROL_SEARCH_OPTIONS_OID,
3871                                       true, options);
3872         if (ret != LDB_SUCCESS) {
3873                 return ret;
3874         }
3875
3876         return ldb_next_request(ar->module, search_req);
3877 }
3878
3879 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
3880                                                       struct ldb_reply *ares)
3881 {
3882         struct ldb_context *ldb;
3883         struct replmd_replicated_request *ar = talloc_get_type(req->context,
3884                                                struct replmd_replicated_request);
3885         ldb = ldb_module_get_ctx(ar->module);
3886
3887         if (!ares) {
3888                 return ldb_module_done(ar->req, NULL, NULL,
3889                                         LDB_ERR_OPERATIONS_ERROR);
3890         }
3891         if (ares->error != LDB_SUCCESS) {
3892                 return ldb_module_done(ar->req, ares->controls,
3893                                         ares->response, ares->error);
3894         }
3895
3896         if (ares->type != LDB_REPLY_DONE) {
3897                 ldb_set_errstring(ldb, "Invalid reply type\n!");
3898                 return ldb_module_done(ar->req, NULL, NULL,
3899                                         LDB_ERR_OPERATIONS_ERROR);
3900         }
3901
3902         talloc_free(ares);
3903
3904         return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3905 }
3906
3907 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
3908 {
3909         struct ldb_context *ldb;
3910         struct ldb_request *change_req;
3911         enum ndr_err_code ndr_err;
3912         struct ldb_message *msg;
3913         struct replUpToDateVectorBlob ouv;
3914         const struct ldb_val *ouv_value;
3915         const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
3916         struct replUpToDateVectorBlob nuv;
3917         struct ldb_val nuv_value;
3918         struct ldb_message_element *nuv_el = NULL;
3919         const struct GUID *our_invocation_id;
3920         struct ldb_message_element *orf_el = NULL;
3921         struct repsFromToBlob nrf;
3922         struct ldb_val *nrf_value = NULL;
3923         struct ldb_message_element *nrf_el = NULL;
3924         unsigned int i;
3925         uint32_t j,ni=0;
3926         bool found = false;
3927         time_t t = time(NULL);
3928         NTTIME now;
3929         int ret;
3930         uint32_t instanceType;
3931
3932         ldb = ldb_module_get_ctx(ar->module);
3933         ruv = ar->objs->uptodateness_vector;
3934         ZERO_STRUCT(ouv);
3935         ouv.version = 2;
3936         ZERO_STRUCT(nuv);
3937         nuv.version = 2;
3938
3939         unix_to_nt_time(&now, t);
3940
3941         instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
3942         if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
3943                 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
3944                          ldb_dn_get_linearized(ar->search_msg->dn)));
3945                 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3946         }
3947
3948         /*
3949          * first create the new replUpToDateVector
3950          */
3951         ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
3952         if (ouv_value) {
3953                 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
3954                                                (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
3955                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3956                         NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3957                         return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3958                 }
3959
3960                 if (ouv.version != 2) {
3961                         return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3962                 }
3963         }
3964
3965         /*
3966          * the new uptodateness vector will at least
3967          * contain 1 entry, one for the source_dsa
3968          *
3969          * plus optional values from our old vector and the one from the source_dsa
3970          */
3971         nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
3972         if (ruv) nuv.ctr.ctr2.count += ruv->count;
3973         nuv.ctr.ctr2.cursors = talloc_array(ar,
3974                                             struct drsuapi_DsReplicaCursor2,
3975                                             nuv.ctr.ctr2.count);
3976         if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3977
3978         /* first copy the old vector */
3979         for (i=0; i < ouv.ctr.ctr2.count; i++) {
3980                 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
3981                 ni++;
3982         }
3983
3984         /* get our invocation_id if we have one already attached to the ldb */
3985         our_invocation_id = samdb_ntds_invocation_id(ldb);
3986
3987         /* merge in the source_dsa vector is available */
3988         for (i=0; (ruv && i < ruv->count); i++) {
3989                 found = false;
3990
3991                 if (our_invocation_id &&
3992                     GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3993                                our_invocation_id)) {
3994                         continue;
3995                 }
3996
3997                 for (j=0; j < ni; j++) {
3998                         if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3999                                         &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
4000                                 continue;
4001                         }
4002
4003                         found = true;
4004
4005                         /*
4006                          * we update only the highest_usn and not the latest_sync_success time,
4007                          * because the last success stands for direct replication
4008                          */
4009                         if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
4010                                 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
4011                         }
4012                         break;
4013                 }
4014
4015                 if (found) continue;
4016
4017                 /* if it's not there yet, add it */
4018                 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
4019                 ni++;
4020         }
4021
4022         /*
4023          * merge in the current highwatermark for the source_dsa
4024          */
4025         found = false;
4026         for (j=0; j < ni; j++) {
4027                 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
4028                                 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
4029                         continue;
4030                 }
4031
4032                 found = true;
4033
4034                 /*
4035                  * here we update the highest_usn and last_sync_success time
4036                  * because we're directly replicating from the source_dsa
4037                  *
4038                  * and use the tmp_highest_usn because this is what we have just applied
4039                  * to our ldb
4040                  */
4041                 nuv.ctr.ctr2.cursors[j].highest_usn             = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
4042                 nuv.ctr.ctr2.cursors[j].last_sync_success       = now;
4043                 break;
4044         }
4045         if (!found) {
4046                 /*
4047                  * here we update the highest_usn and last_sync_success time
4048                  * because we're directly replicating from the source_dsa
4049                  *
4050                  * and use the tmp_highest_usn because this is what we have just applied
4051                  * to our ldb
4052                  */
4053                 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
4054                 nuv.ctr.ctr2.cursors[ni].highest_usn            = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
4055                 nuv.ctr.ctr2.cursors[ni].last_sync_success      = now;
4056                 ni++;
4057         }
4058
4059         /*
4060          * finally correct the size of the cursors array
4061          */
4062         nuv.ctr.ctr2.count = ni;
4063
4064         /*
4065          * sort the cursors
4066          */
4067         TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
4068
4069         /*
4070          * create the change ldb_message
4071          */
4072         msg = ldb_msg_new(ar);
4073         if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4074         msg->dn = ar->search_msg->dn;
4075
4076         ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
4077                                        (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
4078         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4079                 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4080                 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4081         }
4082         ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
4083         if (ret != LDB_SUCCESS) {
4084                 return replmd_replicated_request_error(ar, ret);
4085         }
4086         nuv_el->flags = LDB_FLAG_MOD_REPLACE;
4087
4088         /*
4089          * now create the new repsFrom value from the given repsFromTo1 structure
4090          */
4091         ZERO_STRUCT(nrf);
4092         nrf.version                                     = 1;
4093         nrf.ctr.ctr1                                    = *ar->objs->source_dsa;
4094         nrf.ctr.ctr1.highwatermark.highest_usn          = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
4095
4096         /*
4097          * first see if we already have a repsFrom value for the current source dsa
4098          * if so we'll later replace this value
4099          */
4100         orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
4101         if (orf_el) {
4102                 for (i=0; i < orf_el->num_values; i++) {
4103                         struct repsFromToBlob *trf;
4104
4105                         trf = talloc(ar, struct repsFromToBlob);
4106                         if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4107
4108                         ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
4109                                                        (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
4110                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4111                                 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4112                                 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4113                         }
4114
4115                         if (trf->version != 1) {
4116                                 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4117                         }
4118
4119                         /*
4120                          * we compare the source dsa objectGUID not the invocation_id
4121                          * because we want only one repsFrom value per source dsa
4122                          * and when the invocation_id of the source dsa has changed we don't need
4123                          * the old repsFrom with the old invocation_id
4124                          */
4125                         if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
4126                                         &ar->objs->source_dsa->source_dsa_obj_guid)) {
4127                                 talloc_free(trf);
4128                                 continue;
4129                         }
4130
4131                         talloc_free(trf);
4132                         nrf_value = &orf_el->values[i];
4133                         break;
4134                 }
4135
4136                 /*
4137                  * copy over all old values to the new ldb_message
4138                  */
4139                 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
4140                 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4141                 *nrf_el = *orf_el;
4142         }
4143
4144         /*
4145          * if we haven't found an old repsFrom value for the current source dsa
4146          * we'll add a new value
4147          */
4148         if (!nrf_value) {
4149                 struct ldb_val zero_value;
4150                 ZERO_STRUCT(zero_value);
4151                 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
4152                 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4153
4154                 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
4155         }
4156
4157         /* we now fill the value which is already attached to ldb_message */
4158         ndr_err = ndr_push_struct_blob(nrf_value, msg,
4159                                        &nrf,
4160                                        (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
4161         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
4162                 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
4163                 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
4164         }
4165
4166         /*
4167          * the ldb_message_element for the attribute, has all the old values and the new one
4168          * so we'll replace the whole attribute with all values
4169          */
4170         nrf_el->flags = LDB_FLAG_MOD_REPLACE;
4171
4172         if (DEBUGLVL(4)) {
4173                 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
4174                 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
4175                 talloc_free(s);
4176         }
4177
4178         /* prepare the ldb_modify() request */
4179         ret = ldb_build_mod_req(&change_req,
4180                                 ldb,
4181                                 ar,
4182                                 msg,
4183                                 ar->controls,
4184                                 ar,
4185                                 replmd_replicated_uptodate_modify_callback,
4186                                 ar->req);
4187         LDB_REQ_SET_LOCATION(change_req);
4188         if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4189
4190         return ldb_next_request(ar->module, change_req);
4191 }
4192
4193 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
4194                                                       struct ldb_reply *ares)
4195 {
4196         struct replmd_replicated_request *ar = talloc_get_type(req->context,
4197                                                struct replmd_replicated_request);
4198         int ret;
4199
4200         if (!ares) {
4201                 return ldb_module_done(ar->req, NULL, NULL,
4202                                         LDB_ERR_OPERATIONS_ERROR);
4203         }
4204         if (ares->error != LDB_SUCCESS &&
4205             ares->error != LDB_ERR_NO_SUCH_OBJECT) {
4206                 return ldb_module_done(ar->req, ares->controls,
4207                                         ares->response, ares->error);
4208         }
4209
4210         switch (ares->type) {
4211         case LDB_REPLY_ENTRY:
4212                 ar->search_msg = talloc_steal(ar, ares->message);
4213                 break;
4214
4215         case LDB_REPLY_REFERRAL:
4216                 /* we ignore referrals */
4217                 break;
4218
4219         case LDB_REPLY_DONE:
4220                 if (ar->search_msg == NULL) {
4221                         ret = replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
4222                 } else {
4223                         ret = replmd_replicated_uptodate_modify(ar);
4224                 }
4225                 if (ret != LDB_SUCCESS) {
4226                         return ldb_module_done(ar->req, NULL, NULL, ret);
4227                 }
4228         }
4229
4230         talloc_free(ares);
4231         return LDB_SUCCESS;
4232 }
4233
4234
4235 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
4236 {
4237         struct ldb_context *ldb;
4238         int ret;
4239         static const char *attrs[] = {
4240                 "replUpToDateVector",
4241                 "repsFrom",
4242                 "instanceType",
4243                 NULL
4244         };
4245         struct ldb_request *search_req;
4246
4247         ldb = ldb_module_get_ctx(ar->module);
4248         ar->search_msg = NULL;
4249
4250         ret = ldb_build_search_req(&search_req,
4251                                    ldb,
4252                                    ar,
4253                                    ar->objs->partition_dn,
4254                                    LDB_SCOPE_BASE,
4255                                    "(objectClass=*)",
4256                                    attrs,
4257                                    NULL,
4258                                    ar,
4259                                    replmd_replicated_uptodate_search_callback,
4260                                    ar->req);
4261         LDB_REQ_SET_LOCATION(search_req);
4262         if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
4263
4264         return ldb_next_request(ar->module, search_req);
4265 }
4266
4267
4268
4269 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
4270 {
4271         struct ldb_context *ldb;
4272         struct dsdb_extended_replicated_objects *objs;
4273         struct replmd_replicated_request *ar;
4274         struct ldb_control **ctrls;
4275         int ret;
4276         uint32_t i;
4277         struct replmd_private *replmd_private =
4278                 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4279
4280         ldb = ldb_module_get_ctx(module);
4281
4282         ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
4283
4284         objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
4285         if (!objs) {
4286                 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
4287                 return LDB_ERR_PROTOCOL_ERROR;
4288         }
4289
4290         if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
4291                 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
4292                           objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
4293                 return LDB_ERR_PROTOCOL_ERROR;
4294         }
4295
4296         ar = replmd_ctx_init(module, req);
4297         if (!ar)
4298                 return LDB_ERR_OPERATIONS_ERROR;
4299
4300         /* Set the flags to have the replmd_op_callback run over the full set of objects */
4301         ar->apply_mode = true;
4302         ar->objs = objs;
4303         ar->schema = dsdb_get_schema(ldb, ar);
4304         if (!ar->schema) {
4305                 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
4306                 talloc_free(ar);
4307                 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
4308                 return LDB_ERR_CONSTRAINT_VIOLATION;
4309         }
4310
4311         ctrls = req->controls;
4312
4313         if (req->controls) {
4314                 req->controls = talloc_memdup(ar, req->controls,
4315                                               talloc_get_size(req->controls));
4316                 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
4317         }
4318
4319         /* This allows layers further down to know if a change came in over replication */
4320         ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
4321         if (ret != LDB_SUCCESS) {
4322                 return ret;
4323         }
4324
4325         /* If this change contained linked attributes in the body
4326          * (rather than in the links section) we need to update
4327          * backlinks in linked_attributes */
4328         ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
4329         if (ret != LDB_SUCCESS) {
4330                 return ret;
4331         }
4332
4333         ar->controls = req->controls;
4334         req->controls = ctrls;
4335
4336         DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
4337
4338         /* save away the linked attributes for the end of the
4339            transaction */
4340         for (i=0; i<ar->objs->linked_attributes_count; i++) {
4341                 struct la_entry *la_entry;
4342
4343                 if (replmd_private->la_ctx == NULL) {
4344                         replmd_private->la_ctx = talloc_new(replmd_private);
4345                 }
4346                 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
4347                 if (la_entry == NULL) {
4348                         ldb_oom(ldb);
4349                         return LDB_ERR_OPERATIONS_ERROR;
4350                 }
4351                 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
4352                 if (la_entry->la == NULL) {
4353                         talloc_free(la_entry);
4354                         ldb_oom(ldb);
4355                         return LDB_ERR_OPERATIONS_ERROR;
4356                 }
4357                 *la_entry->la = ar->objs->linked_attributes[i];
4358
4359                 /* we need to steal the non-scalars so they stay
4360                    around until the end of the transaction */
4361                 talloc_steal(la_entry->la, la_entry->la->identifier);
4362                 talloc_steal(la_entry->la, la_entry->la->value.blob);
4363
4364                 DLIST_ADD(replmd_private->la_list, la_entry);
4365         }
4366
4367         return replmd_replicated_apply_next(ar);
4368 }
4369
4370 /*
4371   process one linked attribute structure
4372  */
4373 static int replmd_process_linked_attribute(struct ldb_module *module,
4374                                            struct la_entry *la_entry,
4375                                            struct ldb_request *parent)
4376 {
4377         struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
4378         struct ldb_context *ldb = ldb_module_get_ctx(module);
4379         struct ldb_message *msg;
4380         TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
4381         const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
4382         int ret;
4383         const struct dsdb_attribute *attr;
4384         struct dsdb_dn *dsdb_dn;
4385         uint64_t seq_num = 0;
4386         struct ldb_message_element *old_el;
4387         WERROR status;
4388         time_t t = time(NULL);
4389         struct ldb_result *res;
4390         const char *attrs[2];
4391         struct parsed_dn *pdn_list, *pdn;
4392         struct GUID guid = GUID_zero();
4393         NTSTATUS ntstatus;
4394         bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
4395         const struct GUID *our_invocation_id;
4396
4397 /*
4398 linked_attributes[0]:
4399      &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
4400         identifier               : *
4401             identifier: struct drsuapi_DsReplicaObjectIdentifier
4402                 __ndr_size               : 0x0000003a (58)
4403                 __ndr_size_sid           : 0x00000000 (0)
4404                 guid                     : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
4405                 sid                      : S-0-0
4406                 __ndr_size_dn            : 0x00000000 (0)
4407                 dn                       : ''
4408         attid                    : DRSUAPI_ATTID_member (0x1F)
4409         value: struct drsuapi_DsAttributeValue
4410             __ndr_size               : 0x0000007e (126)
4411             blob                     : *
4412                 blob                     : DATA_BLOB length=126
4413         flags                    : 0x00000001 (1)
4414                1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
4415         originating_add_time     : Wed Sep  2 22:20:01 2009 EST
4416         meta_data: struct drsuapi_DsReplicaMetaData
4417             version                  : 0x00000015 (21)
4418             originating_change_time  : Wed Sep  2 23:39:07 2009 EST
4419             originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
4420             originating_usn          : 0x000000000001e19c (123292)
4421
4422 (for cases where the link is to a normal DN)
4423      &target: struct drsuapi_DsReplicaObjectIdentifier3
4424         __ndr_size               : 0x0000007e (126)
4425         __ndr_size_sid           : 0x0000001c (28)
4426         guid                     : 7639e594-db75-4086-b0d4-67890ae46031
4427         sid                      : S-1-5-21-2848215498-2472035911-1947525656-19924
4428         __ndr_size_dn            : 0x00000022 (34)
4429         dn                       : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
4430  */
4431
4432         /* find the attribute being modified */
4433         attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
4434         if (attr == NULL) {
4435                 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
4436                 talloc_free(tmp_ctx);
4437                 return LDB_ERR_OPERATIONS_ERROR;
4438         }
4439
4440         attrs[0] = attr->lDAPDisplayName;
4441         attrs[1] = NULL;
4442
4443         /* get the existing message from the db for the object with
4444            this GUID, returning attribute being modified. We will then
4445            use this msg as the basis for a modify call */
4446         ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
4447                                  DSDB_FLAG_NEXT_MODULE |
4448                                  DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
4449                                  DSDB_SEARCH_SHOW_RECYCLED |
4450                                  DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
4451                                  DSDB_SEARCH_REVEAL_INTERNALS,
4452                                  parent,
4453                                  "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
4454         if (ret != LDB_SUCCESS) {
4455                 talloc_free(tmp_ctx);
4456                 return ret;
4457         }
4458         if (res->count != 1) {
4459                 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
4460                                        GUID_string(tmp_ctx, &la->identifier->guid));
4461                 talloc_free(tmp_ctx);
4462                 return LDB_ERR_NO_SUCH_OBJECT;
4463         }
4464         msg = res->msgs[0];
4465
4466         if (msg->num_elements == 0) {
4467                 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
4468                 if (ret != LDB_SUCCESS) {
4469                         ldb_module_oom(module);
4470                         talloc_free(tmp_ctx);
4471                         return LDB_ERR_OPERATIONS_ERROR;
4472                 }
4473         } else {
4474                 old_el = &msg->elements[0];
4475                 old_el->flags = LDB_FLAG_MOD_REPLACE;
4476         }
4477
4478         /* parse the existing links */
4479         ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid, parent);
4480         if (ret != LDB_SUCCESS) {
4481                 talloc_free(tmp_ctx);
4482                 return ret;
4483         }
4484
4485         /* get our invocationId */
4486         our_invocation_id = samdb_ntds_invocation_id(ldb);
4487         if (!our_invocation_id) {
4488                 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
4489                 talloc_free(tmp_ctx);
4490                 return LDB_ERR_OPERATIONS_ERROR;
4491         }
4492
4493         ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
4494         if (ret != LDB_SUCCESS) {
4495                 talloc_free(tmp_ctx);
4496                 return ret;
4497         }
4498
4499         status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
4500         if (!W_ERROR_IS_OK(status)) {
4501                 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
4502                                        old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
4503                 return LDB_ERR_OPERATIONS_ERROR;
4504         }
4505
4506         ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
4507         if (!NT_STATUS_IS_OK(ntstatus) && active) {
4508                 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
4509                                        old_el->name,
4510                                        ldb_dn_get_linearized(dsdb_dn->dn),
4511                                        ldb_dn_get_linearized(msg->dn));
4512                 return LDB_ERR_OPERATIONS_ERROR;
4513         }
4514
4515         /* re-resolve the DN by GUID, as the DRS server may give us an
4516            old DN value */
4517         ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn, parent);
4518         if (ret != LDB_SUCCESS) {
4519                 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s",
4520                          GUID_string(tmp_ctx, &guid),
4521                          ldb_dn_get_linearized(dsdb_dn->dn)));
4522         }
4523
4524         /* see if this link already exists */
4525         pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
4526         if (pdn != NULL) {
4527                 /* see if this update is newer than what we have already */
4528                 struct GUID invocation_id = GUID_zero();
4529                 uint32_t version = 0;
4530                 uint32_t originating_usn = 0;
4531                 NTTIME change_time = 0;
4532                 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
4533
4534                 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
4535                 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
4536                 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
4537                 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
4538
4539                 if (!replmd_update_is_newer(&invocation_id,
4540                                             &la->meta_data.originating_invocation_id,
4541                                             version,
4542                                             la->meta_data.version,
4543                                             change_time,
4544                                             la->meta_data.originating_change_time)) {
4545                         DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
4546                                  old_el->name, ldb_dn_get_linearized(msg->dn),
4547                                  GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
4548                         talloc_free(tmp_ctx);
4549                         return LDB_SUCCESS;
4550                 }
4551
4552                 /* get a seq_num for this change */
4553                 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4554                 if (ret != LDB_SUCCESS) {
4555                         talloc_free(tmp_ctx);
4556                         return ret;
4557                 }
4558
4559                 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
4560                         /* remove the existing backlink */
4561                         ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
4562                         if (ret != LDB_SUCCESS) {
4563                                 talloc_free(tmp_ctx);
4564                                 return ret;
4565                         }
4566                 }
4567
4568                 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
4569                                            &la->meta_data.originating_invocation_id,
4570                                            la->meta_data.originating_usn, seq_num,
4571                                            la->meta_data.originating_change_time,
4572                                            la->meta_data.version,
4573                                            !active);
4574                 if (ret != LDB_SUCCESS) {
4575                         talloc_free(tmp_ctx);
4576                         return ret;
4577                 }
4578
4579                 if (active) {
4580                         /* add the new backlink */
4581                         ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
4582                         if (ret != LDB_SUCCESS) {
4583                                 talloc_free(tmp_ctx);
4584                                 return ret;
4585                         }
4586                 }
4587         } else {
4588                 /* get a seq_num for this change */
4589                 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4590                 if (ret != LDB_SUCCESS) {
4591                         talloc_free(tmp_ctx);
4592                         return ret;
4593                 }
4594
4595                 old_el->values = talloc_realloc(msg->elements, old_el->values,
4596                                                 struct ldb_val, old_el->num_values+1);
4597                 if (!old_el->values) {
4598                         ldb_module_oom(module);
4599                         return LDB_ERR_OPERATIONS_ERROR;
4600                 }
4601                 old_el->num_values++;
4602
4603                 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
4604                                           &la->meta_data.originating_invocation_id,
4605                                           la->meta_data.originating_usn, seq_num,
4606                                           la->meta_data.originating_change_time,
4607                                           la->meta_data.version,
4608                                           (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
4609                 if (ret != LDB_SUCCESS) {
4610                         talloc_free(tmp_ctx);
4611                         return ret;
4612                 }
4613
4614                 if (active) {
4615                         ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
4616                                                   true, attr, false);
4617                         if (ret != LDB_SUCCESS) {
4618                                 talloc_free(tmp_ctx);
4619                                 return ret;
4620                         }
4621                 }
4622         }
4623
4624         /* we only change whenChanged and uSNChanged if the seq_num
4625            has changed */
4626         if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
4627                 talloc_free(tmp_ctx);
4628                 return ldb_operr(ldb);
4629         }
4630
4631         if (add_uint64_element(ldb, msg, "uSNChanged",
4632                                seq_num) != LDB_SUCCESS) {
4633                 talloc_free(tmp_ctx);
4634                 return ldb_operr(ldb);
4635         }
4636
4637         old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
4638         if (old_el == NULL) {
4639                 talloc_free(tmp_ctx);
4640                 return ldb_operr(ldb);
4641         }
4642
4643         ret = dsdb_check_single_valued_link(attr, old_el);
4644         if (ret != LDB_SUCCESS) {
4645                 talloc_free(tmp_ctx);
4646                 return ret;
4647         }
4648
4649         old_el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
4650
4651         ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE, parent);
4652         if (ret != LDB_SUCCESS) {
4653                 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
4654                           ldb_errstring(ldb),
4655                           ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
4656                 talloc_free(tmp_ctx);
4657                 return ret;
4658         }
4659
4660         talloc_free(tmp_ctx);
4661
4662         return ret;
4663 }
4664
4665 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
4666 {
4667         if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
4668                 return replmd_extended_replicated_objects(module, req);
4669         }
4670
4671         return ldb_next_request(module, req);
4672 }
4673
4674
4675 /*
4676   we hook into the transaction operations to allow us to
4677   perform the linked attribute updates at the end of the whole
4678   transaction. This allows a forward linked attribute to be created
4679   before the object is created. During a vampire, w2k8 sends us linked
4680   attributes before the objects they are part of.
4681  */
4682 static int replmd_start_transaction(struct ldb_module *module)
4683 {
4684         /* create our private structure for this transaction */
4685         struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
4686                                                                 struct replmd_private);
4687         replmd_txn_cleanup(replmd_private);
4688
4689         /* free any leftover mod_usn records from cancelled
4690            transactions */
4691         while (replmd_private->ncs) {
4692                 struct nc_entry *e = replmd_private->ncs;
4693                 DLIST_REMOVE(replmd_private->ncs, e);
4694                 talloc_free(e);
4695         }
4696
4697         return ldb_next_start_trans(module);
4698 }
4699
4700 /*
4701   on prepare commit we loop over our queued la_context structures and
4702   apply each of them
4703  */
4704 static int replmd_prepare_commit(struct ldb_module *module)
4705 {
4706         struct replmd_private *replmd_private =
4707                 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4708         struct la_entry *la, *prev;
4709         struct la_backlink *bl;
4710         int ret;
4711
4712         /* walk the list backwards, to do the first entry first, as we
4713          * added the entries with DLIST_ADD() which puts them at the
4714          * start of the list */
4715         for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
4716                 prev = DLIST_PREV(la);
4717                 DLIST_REMOVE(replmd_private->la_list, la);
4718                 ret = replmd_process_linked_attribute(module, la, NULL);
4719                 if (ret != LDB_SUCCESS) {
4720                         replmd_txn_cleanup(replmd_private);
4721                         return ret;
4722                 }
4723         }
4724
4725         /* process our backlink list, creating and deleting backlinks
4726            as necessary */
4727         for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
4728                 ret = replmd_process_backlink(module, bl, NULL);
4729                 if (ret != LDB_SUCCESS) {
4730                         replmd_txn_cleanup(replmd_private);
4731                         return ret;
4732                 }
4733         }
4734
4735         replmd_txn_cleanup(replmd_private);
4736
4737         /* possibly change @REPLCHANGED */
4738         ret = replmd_notify_store(module, NULL);
4739         if (ret != LDB_SUCCESS) {
4740                 return ret;
4741         }
4742
4743         return ldb_next_prepare_commit(module);
4744 }
4745
4746 static int replmd_del_transaction(struct ldb_module *module)
4747 {
4748         struct replmd_private *replmd_private =
4749                 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4750         replmd_txn_cleanup(replmd_private);
4751
4752         return ldb_next_del_trans(module);
4753 }
4754
4755
4756 static const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
4757         .name          = "repl_meta_data",
4758         .init_context      = replmd_init,
4759         .add               = replmd_add,
4760         .modify            = replmd_modify,
4761         .rename            = replmd_rename,
4762         .del               = replmd_delete,
4763         .extended          = replmd_extended,
4764         .start_transaction = replmd_start_transaction,
4765         .prepare_commit    = replmd_prepare_commit,
4766         .del_transaction   = replmd_del_transaction,
4767 };
4768
4769 int ldb_repl_meta_data_module_init(const char *version)
4770 {
4771         LDB_MODULE_CHECK_VERSION(version);
4772         return ldb_register_module(&ldb_repl_meta_data_module_ops);
4773 }