4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 * Component: ldb repl_meta_data module
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
35 * Author: Stefan Metzmacher
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/dom_sid.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "libcli/security/security.h"
52 #include "lib/util/tsort.h"
54 struct replmd_private {
56 struct la_entry *la_list;
58 struct la_backlink *la_backlinks;
60 struct nc_entry *prev, *next;
63 uint64_t mod_usn_urgent;
68 struct la_entry *next, *prev;
69 struct drsuapi_DsReplicaLinkedAttribute *la;
72 struct replmd_replicated_request {
73 struct ldb_module *module;
74 struct ldb_request *req;
76 const struct dsdb_schema *schema;
78 /* the controls we pass down */
79 struct ldb_control **controls;
81 /* details for the mode where we apply a bunch of inbound replication meessages */
83 uint32_t index_current;
84 struct dsdb_extended_replicated_objects *objs;
86 struct ldb_message *search_msg;
92 enum urgent_situation {
93 REPL_URGENT_ON_CREATE = 1,
94 REPL_URGENT_ON_UPDATE = 2,
95 REPL_URGENT_ON_DELETE = 4
100 const char *update_name;
101 enum urgent_situation repl_situation;
102 } urgent_objects[] = {
103 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
104 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
105 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
106 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
107 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
108 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
112 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
113 static const char *urgent_attrs[] = {
116 "userAccountControl",
121 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
122 enum urgent_situation situation)
125 for (i=0; urgent_objects[i].update_name; i++) {
127 if ((situation & urgent_objects[i].repl_situation) == 0) {
131 for (j=0; j<objectclass_el->num_values; j++) {
132 const struct ldb_val *v = &objectclass_el->values[j];
133 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
141 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
143 if (ldb_attr_in_list(urgent_attrs, el->name)) {
150 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
153 initialise the module
154 allocate the private structure and build the list
155 of partition DNs for use by replmd_notify()
157 static int replmd_init(struct ldb_module *module)
159 struct replmd_private *replmd_private;
160 struct ldb_context *ldb = ldb_module_get_ctx(module);
162 replmd_private = talloc_zero(module, struct replmd_private);
163 if (replmd_private == NULL) {
165 return LDB_ERR_OPERATIONS_ERROR;
167 ldb_module_set_private(module, replmd_private);
169 return ldb_next_init(module);
173 cleanup our per-transaction contexts
175 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
177 talloc_free(replmd_private->la_ctx);
178 replmd_private->la_list = NULL;
179 replmd_private->la_ctx = NULL;
181 talloc_free(replmd_private->bl_ctx);
182 replmd_private->la_backlinks = NULL;
183 replmd_private->bl_ctx = NULL;
188 struct la_backlink *next, *prev;
189 const char *attr_name;
190 struct GUID forward_guid, target_guid;
195 process a backlinks we accumulated during a transaction, adding and
196 deleting the backlinks from the target objects
198 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl)
200 struct ldb_dn *target_dn, *source_dn;
202 struct ldb_context *ldb = ldb_module_get_ctx(module);
203 struct ldb_message *msg;
204 TALLOC_CTX *tmp_ctx = talloc_new(bl);
210 - construct ldb_message
211 - either an add or a delete
213 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn);
214 if (ret != LDB_SUCCESS) {
215 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
216 GUID_string(bl, &bl->target_guid)));
220 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn);
221 if (ret != LDB_SUCCESS) {
222 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
223 GUID_string(bl, &bl->forward_guid));
224 talloc_free(tmp_ctx);
228 msg = ldb_msg_new(tmp_ctx);
230 ldb_module_oom(module);
231 talloc_free(tmp_ctx);
232 return LDB_ERR_OPERATIONS_ERROR;
235 /* construct a ldb_message for adding/deleting the backlink */
237 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
239 ldb_module_oom(module);
240 talloc_free(tmp_ctx);
241 return LDB_ERR_OPERATIONS_ERROR;
243 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
244 if (ret != LDB_SUCCESS) {
245 talloc_free(tmp_ctx);
248 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
250 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
251 if (ret != LDB_SUCCESS) {
252 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
253 bl->active?"add":"remove",
254 ldb_dn_get_linearized(source_dn),
255 ldb_dn_get_linearized(target_dn),
257 talloc_free(tmp_ctx);
260 talloc_free(tmp_ctx);
265 add a backlink to the list of backlinks to add/delete in the prepare
268 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
269 struct GUID *forward_guid, struct GUID *target_guid,
270 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
272 const struct dsdb_attribute *target_attr;
273 struct la_backlink *bl;
274 struct replmd_private *replmd_private =
275 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
277 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
280 * windows 2003 has a broken schema where the
281 * definition of msDS-IsDomainFor is missing (which is
282 * supposed to be the backlink of the
283 * msDS-HasDomainNCs attribute
288 /* see if its already in the list */
289 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
290 if (GUID_equal(forward_guid, &bl->forward_guid) &&
291 GUID_equal(target_guid, &bl->target_guid) &&
292 (target_attr->lDAPDisplayName == bl->attr_name ||
293 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
299 /* we found an existing one */
300 if (bl->active == active) {
303 DLIST_REMOVE(replmd_private->la_backlinks, bl);
308 if (replmd_private->bl_ctx == NULL) {
309 replmd_private->bl_ctx = talloc_new(replmd_private);
310 if (replmd_private->bl_ctx == NULL) {
311 ldb_module_oom(module);
312 return LDB_ERR_OPERATIONS_ERROR;
317 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
319 ldb_module_oom(module);
320 return LDB_ERR_OPERATIONS_ERROR;
323 /* Ensure the schema does not go away before the bl->attr_name is used */
324 if (!talloc_reference(bl, schema)) {
326 ldb_module_oom(module);
327 return LDB_ERR_OPERATIONS_ERROR;
330 bl->attr_name = target_attr->lDAPDisplayName;
331 bl->forward_guid = *forward_guid;
332 bl->target_guid = *target_guid;
335 /* the caller may ask for this backlink to be processed
338 int ret = replmd_process_backlink(module, bl);
343 DLIST_ADD(replmd_private->la_backlinks, bl);
350 * Callback for most write operations in this module:
352 * notify the repl task that a object has changed. The notifies are
353 * gathered up in the replmd_private structure then written to the
354 * @REPLCHANGED object in each partition during the prepare_commit
356 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
359 struct replmd_replicated_request *ac =
360 talloc_get_type_abort(req->context, struct replmd_replicated_request);
361 struct replmd_private *replmd_private =
362 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
363 struct nc_entry *modified_partition;
364 struct ldb_control *partition_ctrl;
365 const struct dsdb_control_current_partition *partition;
367 struct ldb_control **controls;
369 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
371 /* Remove the 'partition' control from what we pass up the chain */
372 controls = controls_except_specified(ares->controls, ares, partition_ctrl);
374 if (ares->error != LDB_SUCCESS) {
375 return ldb_module_done(ac->req, controls,
376 ares->response, ares->error);
379 if (ares->type != LDB_REPLY_DONE) {
380 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
381 return ldb_module_done(ac->req, NULL,
382 NULL, LDB_ERR_OPERATIONS_ERROR);
385 if (!partition_ctrl) {
386 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
387 return ldb_module_done(ac->req, NULL,
388 NULL, LDB_ERR_OPERATIONS_ERROR);
391 partition = talloc_get_type_abort(partition_ctrl->data,
392 struct dsdb_control_current_partition);
394 if (ac->seq_num > 0) {
395 for (modified_partition = replmd_private->ncs; modified_partition;
396 modified_partition = modified_partition->next) {
397 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
402 if (modified_partition == NULL) {
403 modified_partition = talloc_zero(replmd_private, struct nc_entry);
404 if (!modified_partition) {
405 ldb_oom(ldb_module_get_ctx(ac->module));
406 return ldb_module_done(ac->req, NULL,
407 NULL, LDB_ERR_OPERATIONS_ERROR);
409 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
410 if (!modified_partition->dn) {
411 ldb_oom(ldb_module_get_ctx(ac->module));
412 return ldb_module_done(ac->req, NULL,
413 NULL, LDB_ERR_OPERATIONS_ERROR);
415 DLIST_ADD(replmd_private->ncs, modified_partition);
418 if (ac->seq_num > modified_partition->mod_usn) {
419 modified_partition->mod_usn = ac->seq_num;
421 modified_partition->mod_usn_urgent = ac->seq_num;
426 if (ac->apply_mode) {
430 ret = replmd_replicated_apply_next(ac);
431 if (ret != LDB_SUCCESS) {
432 return ldb_module_done(ac->req, NULL, NULL, ret);
436 /* free the partition control container here, for the
437 * common path. Other cases will have it cleaned up
438 * eventually with the ares */
439 talloc_free(partition_ctrl);
440 return ldb_module_done(ac->req,
441 controls_except_specified(controls, ares, partition_ctrl),
442 ares->response, LDB_SUCCESS);
448 * update a @REPLCHANGED record in each partition if there have been
449 * any writes of replicated data in the partition
451 static int replmd_notify_store(struct ldb_module *module)
453 struct replmd_private *replmd_private =
454 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
456 while (replmd_private->ncs) {
458 struct nc_entry *modified_partition = replmd_private->ncs;
460 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
461 modified_partition->mod_usn,
462 modified_partition->mod_usn_urgent);
463 if (ret != LDB_SUCCESS) {
464 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
465 ldb_dn_get_linearized(modified_partition->dn)));
468 DLIST_REMOVE(replmd_private->ncs, modified_partition);
469 talloc_free(modified_partition);
477 created a replmd_replicated_request context
479 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
480 struct ldb_request *req)
482 struct ldb_context *ldb;
483 struct replmd_replicated_request *ac;
485 ldb = ldb_module_get_ctx(module);
487 ac = talloc_zero(req, struct replmd_replicated_request);
496 ac->schema = dsdb_get_schema(ldb, ac);
498 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
499 "replmd_modify: no dsdb_schema loaded");
500 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
508 add a time element to a record
510 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
512 struct ldb_message_element *el;
515 if (ldb_msg_find_element(msg, attr) != NULL) {
519 s = ldb_timestring(msg, t);
521 return LDB_ERR_OPERATIONS_ERROR;
524 if (ldb_msg_add_string(msg, attr, s) != LDB_SUCCESS) {
525 return LDB_ERR_OPERATIONS_ERROR;
528 el = ldb_msg_find_element(msg, attr);
529 /* always set as replace. This works because on add ops, the flag
531 el->flags = LDB_FLAG_MOD_REPLACE;
537 add a uint64_t element to a record
539 static int add_uint64_element(struct ldb_message *msg, const char *attr, uint64_t v)
541 struct ldb_message_element *el;
543 if (ldb_msg_find_element(msg, attr) != NULL) {
547 if (ldb_msg_add_fmt(msg, attr, "%llu", (unsigned long long)v) != LDB_SUCCESS) {
548 return LDB_ERR_OPERATIONS_ERROR;
551 el = ldb_msg_find_element(msg, attr);
552 /* always set as replace. This works because on add ops, the flag
554 el->flags = LDB_FLAG_MOD_REPLACE;
559 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
560 const struct replPropertyMetaData1 *m2,
561 const uint32_t *rdn_attid)
563 if (m1->attid == m2->attid) {
568 * the rdn attribute should be at the end!
569 * so we need to return a value greater than zero
570 * which means m1 is greater than m2
572 if (m1->attid == *rdn_attid) {
577 * the rdn attribute should be at the end!
578 * so we need to return a value less than zero
579 * which means m2 is greater than m1
581 if (m2->attid == *rdn_attid) {
585 return m1->attid > m2->attid ? 1 : -1;
588 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
589 const struct dsdb_schema *schema,
592 const char *rdn_name;
593 const struct dsdb_attribute *rdn_sa;
595 rdn_name = ldb_dn_get_rdn_name(dn);
597 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
598 return LDB_ERR_OPERATIONS_ERROR;
601 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
602 if (rdn_sa == NULL) {
603 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
604 return LDB_ERR_OPERATIONS_ERROR;
607 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
608 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
610 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
615 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
616 const struct ldb_message_element *e2,
617 const struct dsdb_schema *schema)
619 const struct dsdb_attribute *a1;
620 const struct dsdb_attribute *a2;
623 * TODO: make this faster by caching the dsdb_attribute pointer
624 * on the ldb_messag_element
627 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
628 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
631 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
635 return strcasecmp(e1->name, e2->name);
637 if (a1->attributeID_id == a2->attributeID_id) {
640 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
643 static void replmd_ldb_message_sort(struct ldb_message *msg,
644 const struct dsdb_schema *schema)
646 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
649 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
650 const struct GUID *invocation_id, uint64_t seq_num,
651 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
655 fix up linked attributes in replmd_add.
656 This involves setting up the right meta-data in extended DN
657 components, and creating backlinks to the object
659 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
660 uint64_t seq_num, const struct GUID *invocationId, time_t t,
661 struct GUID *guid, const struct dsdb_attribute *sa)
664 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
665 struct ldb_context *ldb = ldb_module_get_ctx(module);
667 /* We will take a reference to the schema in replmd_add_backlink */
668 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
671 unix_to_nt_time(&now, t);
673 for (i=0; i<el->num_values; i++) {
674 struct ldb_val *v = &el->values[i];
675 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
676 struct GUID target_guid;
680 /* note that the DN already has the extended
681 components from the extended_dn_store module */
682 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
683 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
684 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid);
685 if (ret != LDB_SUCCESS) {
686 talloc_free(tmp_ctx);
689 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
690 if (ret != LDB_SUCCESS) {
691 talloc_free(tmp_ctx);
696 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
697 seq_num, seq_num, now, 0, false);
698 if (ret != LDB_SUCCESS) {
699 talloc_free(tmp_ctx);
703 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
704 if (ret != LDB_SUCCESS) {
705 talloc_free(tmp_ctx);
710 talloc_free(tmp_ctx);
716 intercept add requests
718 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
720 struct ldb_context *ldb;
721 struct ldb_control *control;
722 struct replmd_replicated_request *ac;
723 enum ndr_err_code ndr_err;
724 struct ldb_request *down_req;
725 struct ldb_message *msg;
726 const DATA_BLOB *guid_blob;
728 struct replPropertyMetaDataBlob nmd;
729 struct ldb_val nmd_value;
730 const struct GUID *our_invocation_id;
731 time_t t = time(NULL);
736 unsigned int functional_level;
738 bool allow_add_guid = false;
739 bool remove_current_guid = false;
740 bool is_urgent = false;
741 struct ldb_message_element *objectclass_el;
743 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
744 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
746 allow_add_guid = true;
749 /* do not manipulate our control entries */
750 if (ldb_dn_is_special(req->op.add.message->dn)) {
751 return ldb_next_request(module, req);
754 ldb = ldb_module_get_ctx(module);
756 functional_level = dsdb_functional_level(ldb);
758 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
760 ac = replmd_ctx_init(module, req);
762 return LDB_ERR_OPERATIONS_ERROR;
765 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
766 if ( guid_blob != NULL ) {
767 if( !allow_add_guid ) {
768 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
769 "replmd_add: it's not allowed to add an object with objectGUID\n");
771 return LDB_ERR_UNWILLING_TO_PERFORM;
773 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
774 if ( !NT_STATUS_IS_OK(status)) {
775 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
776 "replmd_add: Unable to parse as a GUID the attribute objectGUID\n");
778 return LDB_ERR_UNWILLING_TO_PERFORM;
780 /* we remove this attribute as it can be a string and will not be treated
781 correctly and then we will readd it latter on in the good format*/
782 remove_current_guid = true;
786 guid = GUID_random();
789 /* Get a sequence number from the backend */
790 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
791 if (ret != LDB_SUCCESS) {
796 /* get our invocationId */
797 our_invocation_id = samdb_ntds_invocation_id(ldb);
798 if (!our_invocation_id) {
799 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
800 "replmd_add: unable to find invocationId\n");
802 return LDB_ERR_OPERATIONS_ERROR;
805 /* we have to copy the message as the caller might have it as a const */
806 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
810 return LDB_ERR_OPERATIONS_ERROR;
813 /* generated times */
814 unix_to_nt_time(&now, t);
815 time_str = ldb_timestring(msg, t);
819 return LDB_ERR_OPERATIONS_ERROR;
821 if (remove_current_guid) {
822 ldb_msg_remove_attr(msg,"objectGUID");
826 * remove autogenerated attributes
828 ldb_msg_remove_attr(msg, "whenCreated");
829 ldb_msg_remove_attr(msg, "whenChanged");
830 ldb_msg_remove_attr(msg, "uSNCreated");
831 ldb_msg_remove_attr(msg, "uSNChanged");
832 ldb_msg_remove_attr(msg, "replPropertyMetaData");
835 * readd replicated attributes
837 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
838 if (ret != LDB_SUCCESS) {
844 /* build the replication meta_data */
847 nmd.ctr.ctr1.count = msg->num_elements;
848 nmd.ctr.ctr1.array = talloc_array(msg,
849 struct replPropertyMetaData1,
851 if (!nmd.ctr.ctr1.array) {
854 return LDB_ERR_OPERATIONS_ERROR;
857 for (i=0; i < msg->num_elements; i++) {
858 struct ldb_message_element *e = &msg->elements[i];
859 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
860 const struct dsdb_attribute *sa;
862 if (e->name[0] == '@') continue;
864 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
866 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
867 "replmd_add: attribute '%s' not defined in schema\n",
870 return LDB_ERR_NO_SUCH_ATTRIBUTE;
873 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
874 /* if the attribute is not replicated (0x00000001)
875 * or constructed (0x00000004) it has no metadata
880 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
881 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa);
882 if (ret != LDB_SUCCESS) {
886 /* linked attributes are not stored in
887 replPropertyMetaData in FL above w2k */
891 m->attid = sa->attributeID_id;
893 m->originating_change_time = now;
894 m->originating_invocation_id = *our_invocation_id;
895 m->originating_usn = ac->seq_num;
896 m->local_usn = ac->seq_num;
900 /* fix meta data count */
901 nmd.ctr.ctr1.count = ni;
904 * sort meta data array, and move the rdn attribute entry to the end
906 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
907 if (ret != LDB_SUCCESS) {
912 /* generated NDR encoded values */
913 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
915 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
916 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
919 return LDB_ERR_OPERATIONS_ERROR;
923 * add the autogenerated values
925 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
926 if (ret != LDB_SUCCESS) {
931 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
932 if (ret != LDB_SUCCESS) {
937 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
938 if (ret != LDB_SUCCESS) {
943 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
944 if (ret != LDB_SUCCESS) {
949 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
950 if (ret != LDB_SUCCESS) {
957 * sort the attributes by attid before storing the object
959 replmd_ldb_message_sort(msg, ac->schema);
961 objectclass_el = ldb_msg_find_element(msg, "objectClass");
962 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
963 REPL_URGENT_ON_CREATE);
965 ac->is_urgent = is_urgent;
966 ret = ldb_build_add_req(&down_req, ldb, ac,
969 ac, replmd_op_callback,
972 if (ret != LDB_SUCCESS) {
977 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
978 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
979 if (ret != LDB_SUCCESS) {
985 /* mark the control done */
987 control->critical = 0;
990 /* go on with the call chain */
991 return ldb_next_request(module, down_req);
996 * update the replPropertyMetaData for one element
998 static int replmd_update_rpmd_element(struct ldb_context *ldb,
999 struct ldb_message *msg,
1000 struct ldb_message_element *el,
1001 struct ldb_message_element *old_el,
1002 struct replPropertyMetaDataBlob *omd,
1003 const struct dsdb_schema *schema,
1005 const struct GUID *our_invocation_id,
1009 const struct dsdb_attribute *a;
1010 struct replPropertyMetaData1 *md1;
1012 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1014 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1016 return LDB_ERR_OPERATIONS_ERROR;
1019 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1023 /* if the attribute's value haven't changed then return LDB_SUCCESS */
1024 if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1028 for (i=0; i<omd->ctr.ctr1.count; i++) {
1029 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1032 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1033 /* linked attributes are not stored in
1034 replPropertyMetaData in FL above w2k, but we do
1035 raise the seqnum for the object */
1036 if (*seq_num == 0 &&
1037 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1038 return LDB_ERR_OPERATIONS_ERROR;
1043 if (i == omd->ctr.ctr1.count) {
1044 /* we need to add a new one */
1045 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1046 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1047 if (omd->ctr.ctr1.array == NULL) {
1049 return LDB_ERR_OPERATIONS_ERROR;
1051 omd->ctr.ctr1.count++;
1052 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1055 /* Get a new sequence number from the backend. We only do this
1056 * if we have a change that requires a new
1057 * replPropertyMetaData element
1059 if (*seq_num == 0) {
1060 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1061 if (ret != LDB_SUCCESS) {
1062 return LDB_ERR_OPERATIONS_ERROR;
1066 md1 = &omd->ctr.ctr1.array[i];
1068 md1->attid = a->attributeID_id;
1069 md1->originating_change_time = now;
1070 md1->originating_invocation_id = *our_invocation_id;
1071 md1->originating_usn = *seq_num;
1072 md1->local_usn = *seq_num;
1077 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1079 uint32_t count = omd.ctr.ctr1.count;
1082 for (i=0; i < count; i++) {
1083 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1084 if (max < m.local_usn) {
1092 * update the replPropertyMetaData object each time we modify an
1093 * object. This is needed for DRS replication, as the merge on the
1094 * client is based on this object
1096 static int replmd_update_rpmd(struct ldb_module *module,
1097 const struct dsdb_schema *schema,
1098 struct ldb_request *req,
1099 struct ldb_message *msg, uint64_t *seq_num,
1103 const struct ldb_val *omd_value;
1104 enum ndr_err_code ndr_err;
1105 struct replPropertyMetaDataBlob omd;
1108 const struct GUID *our_invocation_id;
1110 const char *attrs[] = { "replPropertyMetaData", "*", NULL };
1111 const char *attrs2[] = { "uSNChanged", "objectClass", NULL };
1112 struct ldb_result *res;
1113 struct ldb_context *ldb;
1114 struct ldb_message_element *objectclass_el;
1115 enum urgent_situation situation;
1116 bool rodc, rmd_is_provided;
1118 ldb = ldb_module_get_ctx(module);
1120 our_invocation_id = samdb_ntds_invocation_id(ldb);
1121 if (!our_invocation_id) {
1122 /* this happens during an initial vampire while
1123 updating the schema */
1124 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1128 unix_to_nt_time(&now, t);
1130 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1131 rmd_is_provided = true;
1133 rmd_is_provided = false;
1136 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1137 * otherwise we consider we are updating */
1138 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1139 situation = REPL_URGENT_ON_DELETE;
1141 situation = REPL_URGENT_ON_UPDATE;
1144 if (rmd_is_provided) {
1145 /* In this case the change_replmetadata control was supplied */
1146 /* We check that it's the only attribute that is provided
1147 * (it's a rare case so it's better to keep the code simplier)
1148 * We also check that the highest local_usn is bigger than
1151 if( msg->num_elements != 1 ||
1152 strncmp(msg->elements[0].name,
1153 "replPropertyMetaData", 20) ) {
1154 DEBUG(0,(__location__ ": changereplmetada control called without "\
1155 "a specified replPropertyMetaData attribute or with others\n"));
1156 return LDB_ERR_OPERATIONS_ERROR;
1158 if (situation == REPL_URGENT_ON_DELETE) {
1159 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1160 return LDB_ERR_OPERATIONS_ERROR;
1162 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1164 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1165 ldb_dn_get_linearized(msg->dn)));
1166 return LDB_ERR_OPERATIONS_ERROR;
1168 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1169 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1170 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1171 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1172 ldb_dn_get_linearized(msg->dn)));
1173 return LDB_ERR_OPERATIONS_ERROR;
1175 *seq_num = find_max_local_usn(omd);
1177 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1178 DSDB_FLAG_NEXT_MODULE |
1179 DSDB_SEARCH_SHOW_DELETED |
1180 DSDB_SEARCH_SHOW_EXTENDED_DN |
1181 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1182 DSDB_SEARCH_REVEAL_INTERNALS);
1184 if (ret != LDB_SUCCESS || res->count != 1) {
1185 DEBUG(0,(__location__ ": Object %s failed to find uSNChanged\n",
1186 ldb_dn_get_linearized(msg->dn)));
1187 return LDB_ERR_OPERATIONS_ERROR;
1190 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1191 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1196 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1197 if (*seq_num <= db_seq) {
1198 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1199 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1200 (long long)*seq_num, (long long)db_seq));
1201 return LDB_ERR_OPERATIONS_ERROR;
1205 /* search for the existing replPropertyMetaDataBlob. We need
1206 * to use REVEAL and ask for DNs in storage format to support
1207 * the check for values being the same in
1208 * replmd_update_rpmd_element()
1210 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1211 DSDB_FLAG_NEXT_MODULE |
1212 DSDB_SEARCH_SHOW_DELETED |
1213 DSDB_SEARCH_SHOW_EXTENDED_DN |
1214 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1215 DSDB_SEARCH_REVEAL_INTERNALS);
1216 if (ret != LDB_SUCCESS || res->count != 1) {
1217 DEBUG(0,(__location__ ": Object %s failed to find replPropertyMetaData\n",
1218 ldb_dn_get_linearized(msg->dn)));
1219 return LDB_ERR_OPERATIONS_ERROR;
1222 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1223 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1228 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1230 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1231 ldb_dn_get_linearized(msg->dn)));
1232 return LDB_ERR_OPERATIONS_ERROR;
1235 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1236 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1237 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1238 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1239 ldb_dn_get_linearized(msg->dn)));
1240 return LDB_ERR_OPERATIONS_ERROR;
1243 if (omd.version != 1) {
1244 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1245 omd.version, ldb_dn_get_linearized(msg->dn)));
1246 return LDB_ERR_OPERATIONS_ERROR;
1249 /*we have elements that will be modified*/
1250 if (msg->num_elements > 0) {
1251 /*if we are RODC and this is a DRSR update then its ok*/
1252 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1253 ret = samdb_rodc(ldb, &rodc);
1254 if (ret != LDB_SUCCESS) {
1255 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1257 ldb_asprintf_errstring(ldb, "RODC modify is forbidden\n");
1258 return LDB_ERR_REFERRAL;
1263 for (i=0; i<msg->num_elements; i++) {
1264 struct ldb_message_element *old_el;
1265 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1266 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1267 our_invocation_id, now);
1268 if (ret != LDB_SUCCESS) {
1272 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1273 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1279 * replmd_update_rpmd_element has done an update if the
1282 if (*seq_num != 0) {
1283 struct ldb_val *md_value;
1284 struct ldb_message_element *el;
1286 md_value = talloc(msg, struct ldb_val);
1287 if (md_value == NULL) {
1289 return LDB_ERR_OPERATIONS_ERROR;
1292 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1293 if (ret != LDB_SUCCESS) {
1297 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1298 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1299 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1300 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1301 ldb_dn_get_linearized(msg->dn)));
1302 return LDB_ERR_OPERATIONS_ERROR;
1305 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1306 if (ret != LDB_SUCCESS) {
1307 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1308 ldb_dn_get_linearized(msg->dn)));
1313 el->values = md_value;
1320 struct dsdb_dn *dsdb_dn;
1325 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1327 return GUID_compare(pdn1->guid, pdn2->guid);
1330 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn, int count, struct GUID *guid, struct ldb_dn *dn)
1332 struct parsed_dn *ret;
1333 if (dn && GUID_all_zero(guid)) {
1334 /* when updating a link using DRS, we sometimes get a
1335 NULL GUID. We then need to try and match by DN */
1337 for (i=0; i<count; i++) {
1338 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1339 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1345 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1350 get a series of message element values as an array of DNs and GUIDs
1351 the result is sorted by GUID
1353 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1354 struct ldb_message_element *el, struct parsed_dn **pdn,
1355 const char *ldap_oid)
1358 struct ldb_context *ldb = ldb_module_get_ctx(module);
1365 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1367 ldb_module_oom(module);
1368 return LDB_ERR_OPERATIONS_ERROR;
1371 for (i=0; i<el->num_values; i++) {
1372 struct ldb_val *v = &el->values[i];
1375 struct parsed_dn *p;
1379 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1380 if (p->dsdb_dn == NULL) {
1381 return LDB_ERR_INVALID_DN_SYNTAX;
1384 dn = p->dsdb_dn->dn;
1386 p->guid = talloc(*pdn, struct GUID);
1387 if (p->guid == NULL) {
1388 ldb_module_oom(module);
1389 return LDB_ERR_OPERATIONS_ERROR;
1392 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1393 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1394 /* we got a DN without a GUID - go find the GUID */
1395 int ret = dsdb_module_guid_by_dn(module, dn, p->guid);
1396 if (ret != LDB_SUCCESS) {
1397 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1398 ldb_dn_get_linearized(dn));
1401 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1402 if (ret != LDB_SUCCESS) {
1405 } else if (!NT_STATUS_IS_OK(status)) {
1406 return LDB_ERR_OPERATIONS_ERROR;
1409 /* keep a pointer to the original ldb_val */
1413 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1419 build a new extended DN, including all meta data fields
1421 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1422 RMD_ADDTIME = originating_add_time
1423 RMD_INVOCID = originating_invocation_id
1424 RMD_CHANGETIME = originating_change_time
1425 RMD_ORIGINATING_USN = originating_usn
1426 RMD_LOCAL_USN = local_usn
1427 RMD_VERSION = version
1429 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1430 const struct GUID *invocation_id, uint64_t seq_num,
1431 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1433 struct ldb_dn *dn = dsdb_dn->dn;
1434 const char *tstring, *usn_string, *flags_string;
1435 struct ldb_val tval;
1437 struct ldb_val usnv, local_usnv;
1438 struct ldb_val vers, flagsv;
1441 const char *dnstring;
1443 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1445 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1447 return LDB_ERR_OPERATIONS_ERROR;
1449 tval = data_blob_string_const(tstring);
1451 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1453 return LDB_ERR_OPERATIONS_ERROR;
1455 usnv = data_blob_string_const(usn_string);
1457 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1459 return LDB_ERR_OPERATIONS_ERROR;
1461 local_usnv = data_blob_string_const(usn_string);
1463 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1465 return LDB_ERR_OPERATIONS_ERROR;
1467 vers = data_blob_string_const(vstring);
1469 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1470 if (!NT_STATUS_IS_OK(status)) {
1471 return LDB_ERR_OPERATIONS_ERROR;
1474 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1475 if (!flags_string) {
1476 return LDB_ERR_OPERATIONS_ERROR;
1478 flagsv = data_blob_string_const(flags_string);
1480 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1481 if (ret != LDB_SUCCESS) return ret;
1482 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1483 if (ret != LDB_SUCCESS) return ret;
1484 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1485 if (ret != LDB_SUCCESS) return ret;
1486 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1487 if (ret != LDB_SUCCESS) return ret;
1488 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1489 if (ret != LDB_SUCCESS) return ret;
1490 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1491 if (ret != LDB_SUCCESS) return ret;
1492 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1493 if (ret != LDB_SUCCESS) return ret;
1495 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1496 if (dnstring == NULL) {
1497 return LDB_ERR_OPERATIONS_ERROR;
1499 *v = data_blob_string_const(dnstring);
1504 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1505 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1506 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1507 uint32_t version, bool deleted);
1510 check if any links need upgrading from w2k format
1512 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1514 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1517 for (i=0; i<count; i++) {
1522 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1523 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1527 /* it's an old one that needs upgrading */
1528 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1530 if (ret != LDB_SUCCESS) {
1538 update an extended DN, including all meta data fields
1540 see replmd_build_la_val for value names
1542 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1543 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1544 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1545 uint32_t version, bool deleted)
1547 struct ldb_dn *dn = dsdb_dn->dn;
1548 const char *tstring, *usn_string, *flags_string;
1549 struct ldb_val tval;
1551 struct ldb_val usnv, local_usnv;
1552 struct ldb_val vers, flagsv;
1553 const struct ldb_val *old_addtime;
1554 uint32_t old_version;
1557 const char *dnstring;
1559 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1561 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1563 return LDB_ERR_OPERATIONS_ERROR;
1565 tval = data_blob_string_const(tstring);
1567 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1569 return LDB_ERR_OPERATIONS_ERROR;
1571 usnv = data_blob_string_const(usn_string);
1573 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1575 return LDB_ERR_OPERATIONS_ERROR;
1577 local_usnv = data_blob_string_const(usn_string);
1579 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1580 if (!NT_STATUS_IS_OK(status)) {
1581 return LDB_ERR_OPERATIONS_ERROR;
1584 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1585 if (!flags_string) {
1586 return LDB_ERR_OPERATIONS_ERROR;
1588 flagsv = data_blob_string_const(flags_string);
1590 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1591 if (ret != LDB_SUCCESS) return ret;
1593 /* get the ADDTIME from the original */
1594 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1595 if (old_addtime == NULL) {
1596 old_addtime = &tval;
1598 if (dsdb_dn != old_dsdb_dn) {
1599 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1600 if (ret != LDB_SUCCESS) return ret;
1603 /* use our invocation id */
1604 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1605 if (ret != LDB_SUCCESS) return ret;
1607 /* changetime is the current time */
1608 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1609 if (ret != LDB_SUCCESS) return ret;
1611 /* update the USN */
1612 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1613 if (ret != LDB_SUCCESS) return ret;
1615 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1616 if (ret != LDB_SUCCESS) return ret;
1618 /* increase the version by 1 */
1619 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1620 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1621 version = old_version+1;
1623 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1624 vers = data_blob_string_const(vstring);
1625 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1626 if (ret != LDB_SUCCESS) return ret;
1628 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1629 if (dnstring == NULL) {
1630 return LDB_ERR_OPERATIONS_ERROR;
1632 *v = data_blob_string_const(dnstring);
1638 handle adding a linked attribute
1640 static int replmd_modify_la_add(struct ldb_module *module,
1641 const struct dsdb_schema *schema,
1642 struct ldb_message *msg,
1643 struct ldb_message_element *el,
1644 struct ldb_message_element *old_el,
1645 const struct dsdb_attribute *schema_attr,
1648 struct GUID *msg_guid)
1651 struct parsed_dn *dns, *old_dns;
1652 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1654 struct ldb_val *new_values = NULL;
1655 unsigned int num_new_values = 0;
1656 unsigned old_num_values = old_el?old_el->num_values:0;
1657 const struct GUID *invocation_id;
1658 struct ldb_context *ldb = ldb_module_get_ctx(module);
1661 unix_to_nt_time(&now, t);
1663 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1664 if (ret != LDB_SUCCESS) {
1665 talloc_free(tmp_ctx);
1669 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1670 if (ret != LDB_SUCCESS) {
1671 talloc_free(tmp_ctx);
1675 invocation_id = samdb_ntds_invocation_id(ldb);
1676 if (!invocation_id) {
1677 talloc_free(tmp_ctx);
1678 return LDB_ERR_OPERATIONS_ERROR;
1681 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1682 if (ret != LDB_SUCCESS) {
1683 talloc_free(tmp_ctx);
1687 /* for each new value, see if it exists already with the same GUID */
1688 for (i=0; i<el->num_values; i++) {
1689 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1691 /* this is a new linked attribute value */
1692 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1693 if (new_values == NULL) {
1694 ldb_module_oom(module);
1695 talloc_free(tmp_ctx);
1696 return LDB_ERR_OPERATIONS_ERROR;
1698 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1699 invocation_id, seq_num, seq_num, now, 0, false);
1700 if (ret != LDB_SUCCESS) {
1701 talloc_free(tmp_ctx);
1706 /* this is only allowed if the GUID was
1707 previously deleted. */
1708 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1710 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1711 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1712 el->name, GUID_string(tmp_ctx, p->guid));
1713 talloc_free(tmp_ctx);
1714 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1716 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1717 invocation_id, seq_num, seq_num, now, 0, false);
1718 if (ret != LDB_SUCCESS) {
1719 talloc_free(tmp_ctx);
1724 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1725 if (ret != LDB_SUCCESS) {
1726 talloc_free(tmp_ctx);
1731 /* add the new ones on to the end of the old values, constructing a new el->values */
1732 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1734 old_num_values+num_new_values);
1735 if (el->values == NULL) {
1736 ldb_module_oom(module);
1737 return LDB_ERR_OPERATIONS_ERROR;
1740 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1741 el->num_values = old_num_values + num_new_values;
1743 talloc_steal(msg->elements, el->values);
1744 talloc_steal(el->values, new_values);
1746 talloc_free(tmp_ctx);
1748 /* we now tell the backend to replace all existing values
1749 with the one we have constructed */
1750 el->flags = LDB_FLAG_MOD_REPLACE;
1757 handle deleting all active linked attributes
1759 static int replmd_modify_la_delete(struct ldb_module *module,
1760 const struct dsdb_schema *schema,
1761 struct ldb_message *msg,
1762 struct ldb_message_element *el,
1763 struct ldb_message_element *old_el,
1764 const struct dsdb_attribute *schema_attr,
1767 struct GUID *msg_guid)
1770 struct parsed_dn *dns, *old_dns;
1771 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1773 const struct GUID *invocation_id;
1774 struct ldb_context *ldb = ldb_module_get_ctx(module);
1777 unix_to_nt_time(&now, t);
1779 /* check if there is nothing to delete */
1780 if ((!old_el || old_el->num_values == 0) &&
1781 el->num_values == 0) {
1785 if (!old_el || old_el->num_values == 0) {
1786 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1789 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1790 if (ret != LDB_SUCCESS) {
1791 talloc_free(tmp_ctx);
1795 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1796 if (ret != LDB_SUCCESS) {
1797 talloc_free(tmp_ctx);
1801 invocation_id = samdb_ntds_invocation_id(ldb);
1802 if (!invocation_id) {
1803 return LDB_ERR_OPERATIONS_ERROR;
1806 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1807 if (ret != LDB_SUCCESS) {
1808 talloc_free(tmp_ctx);
1814 /* see if we are being asked to delete any links that
1815 don't exist or are already deleted */
1816 for (i=0; i<el->num_values; i++) {
1817 struct parsed_dn *p = &dns[i];
1818 struct parsed_dn *p2;
1821 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1823 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1824 el->name, GUID_string(tmp_ctx, p->guid));
1825 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1827 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1828 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1829 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1830 el->name, GUID_string(tmp_ctx, p->guid));
1831 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1835 /* for each new value, see if it exists already with the same GUID
1836 if it is not already deleted and matches the delete list then delete it
1838 for (i=0; i<old_el->num_values; i++) {
1839 struct parsed_dn *p = &old_dns[i];
1842 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1846 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1847 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1849 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
1850 invocation_id, seq_num, seq_num, now, 0, true);
1851 if (ret != LDB_SUCCESS) {
1852 talloc_free(tmp_ctx);
1856 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
1857 if (ret != LDB_SUCCESS) {
1858 talloc_free(tmp_ctx);
1863 el->values = talloc_steal(msg->elements, old_el->values);
1864 el->num_values = old_el->num_values;
1866 talloc_free(tmp_ctx);
1868 /* we now tell the backend to replace all existing values
1869 with the one we have constructed */
1870 el->flags = LDB_FLAG_MOD_REPLACE;
1876 handle replacing a linked attribute
1878 static int replmd_modify_la_replace(struct ldb_module *module,
1879 const struct dsdb_schema *schema,
1880 struct ldb_message *msg,
1881 struct ldb_message_element *el,
1882 struct ldb_message_element *old_el,
1883 const struct dsdb_attribute *schema_attr,
1886 struct GUID *msg_guid)
1889 struct parsed_dn *dns, *old_dns;
1890 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1892 const struct GUID *invocation_id;
1893 struct ldb_context *ldb = ldb_module_get_ctx(module);
1894 struct ldb_val *new_values = NULL;
1895 unsigned int num_new_values = 0;
1896 unsigned int old_num_values = old_el?old_el->num_values:0;
1899 unix_to_nt_time(&now, t);
1901 /* check if there is nothing to replace */
1902 if ((!old_el || old_el->num_values == 0) &&
1903 el->num_values == 0) {
1907 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1908 if (ret != LDB_SUCCESS) {
1909 talloc_free(tmp_ctx);
1913 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1914 if (ret != LDB_SUCCESS) {
1915 talloc_free(tmp_ctx);
1919 invocation_id = samdb_ntds_invocation_id(ldb);
1920 if (!invocation_id) {
1921 return LDB_ERR_OPERATIONS_ERROR;
1924 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1925 if (ret != LDB_SUCCESS) {
1926 talloc_free(tmp_ctx);
1930 /* mark all the old ones as deleted */
1931 for (i=0; i<old_num_values; i++) {
1932 struct parsed_dn *old_p = &old_dns[i];
1933 struct parsed_dn *p;
1934 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
1936 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1938 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
1939 if (ret != LDB_SUCCESS) {
1940 talloc_free(tmp_ctx);
1944 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
1946 /* we don't delete it if we are re-adding it */
1950 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
1951 invocation_id, seq_num, seq_num, now, 0, true);
1952 if (ret != LDB_SUCCESS) {
1953 talloc_free(tmp_ctx);
1958 /* for each new value, either update its meta-data, or add it
1961 for (i=0; i<el->num_values; i++) {
1962 struct parsed_dn *p = &dns[i], *old_p;
1965 (old_p = parsed_dn_find(old_dns,
1966 old_num_values, p->guid, NULL)) != NULL) {
1967 /* update in place */
1968 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn,
1969 old_p->dsdb_dn, invocation_id,
1970 seq_num, seq_num, now, 0, false);
1971 if (ret != LDB_SUCCESS) {
1972 talloc_free(tmp_ctx);
1977 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
1979 if (new_values == NULL) {
1980 ldb_module_oom(module);
1981 talloc_free(tmp_ctx);
1982 return LDB_ERR_OPERATIONS_ERROR;
1984 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1985 invocation_id, seq_num, seq_num, now, 0, false);
1986 if (ret != LDB_SUCCESS) {
1987 talloc_free(tmp_ctx);
1993 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
1994 if (ret != LDB_SUCCESS) {
1995 talloc_free(tmp_ctx);
2000 /* add the new values to the end of old_el */
2001 if (num_new_values != 0) {
2002 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2003 struct ldb_val, old_num_values+num_new_values);
2004 if (el->values == NULL) {
2005 ldb_module_oom(module);
2006 return LDB_ERR_OPERATIONS_ERROR;
2008 memcpy(&el->values[old_num_values], &new_values[0],
2009 sizeof(struct ldb_val)*num_new_values);
2010 el->num_values = old_num_values + num_new_values;
2011 talloc_steal(msg->elements, new_values);
2013 el->values = old_el->values;
2014 el->num_values = old_el->num_values;
2015 talloc_steal(msg->elements, el->values);
2018 talloc_free(tmp_ctx);
2020 /* we now tell the backend to replace all existing values
2021 with the one we have constructed */
2022 el->flags = LDB_FLAG_MOD_REPLACE;
2029 handle linked attributes in modify requests
2031 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2032 struct ldb_message *msg,
2033 uint64_t seq_num, time_t t)
2035 struct ldb_result *res;
2038 struct ldb_context *ldb = ldb_module_get_ctx(module);
2039 struct ldb_message *old_msg;
2041 const struct dsdb_schema *schema;
2042 struct GUID old_guid;
2045 /* there the replmd_update_rpmd code has already
2046 * checked and saw that there are no linked
2051 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2052 /* don't do anything special for linked attributes */
2056 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2057 DSDB_FLAG_NEXT_MODULE |
2058 DSDB_SEARCH_SHOW_DELETED |
2059 DSDB_SEARCH_REVEAL_INTERNALS |
2060 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2061 if (ret != LDB_SUCCESS) {
2064 schema = dsdb_get_schema(ldb, res);
2066 return LDB_ERR_OPERATIONS_ERROR;
2069 old_msg = res->msgs[0];
2071 old_guid = samdb_result_guid(old_msg, "objectGUID");
2073 for (i=0; i<msg->num_elements; i++) {
2074 struct ldb_message_element *el = &msg->elements[i];
2075 struct ldb_message_element *old_el, *new_el;
2076 const struct dsdb_attribute *schema_attr
2077 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2079 ldb_asprintf_errstring(ldb,
2080 "attribute %s is not a valid attribute in schema", el->name);
2081 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2083 if (schema_attr->linkID == 0) {
2086 if ((schema_attr->linkID & 1) == 1) {
2087 /* Odd is for the target. Illegal to modify */
2088 ldb_asprintf_errstring(ldb,
2089 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2090 return LDB_ERR_UNWILLING_TO_PERFORM;
2092 old_el = ldb_msg_find_element(old_msg, el->name);
2093 switch (el->flags & LDB_FLAG_MOD_MASK) {
2094 case LDB_FLAG_MOD_REPLACE:
2095 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2097 case LDB_FLAG_MOD_DELETE:
2098 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2100 case LDB_FLAG_MOD_ADD:
2101 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2104 ldb_asprintf_errstring(ldb,
2105 "invalid flags 0x%x for %s linked attribute",
2106 el->flags, el->name);
2107 return LDB_ERR_UNWILLING_TO_PERFORM;
2109 if (ret != LDB_SUCCESS) {
2113 ldb_msg_remove_attr(old_msg, el->name);
2115 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2116 new_el->num_values = el->num_values;
2117 new_el->values = talloc_steal(msg->elements, el->values);
2119 /* TODO: this relises a bit too heavily on the exact
2120 behaviour of ldb_msg_find_element and
2121 ldb_msg_remove_element */
2122 old_el = ldb_msg_find_element(msg, el->name);
2124 ldb_msg_remove_element(msg, old_el);
2135 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2137 struct ldb_context *ldb;
2138 struct replmd_replicated_request *ac;
2139 struct ldb_request *down_req;
2140 struct ldb_message *msg;
2141 time_t t = time(NULL);
2143 bool is_urgent = false;
2144 struct loadparm_context *lp_ctx;
2146 unsigned int functional_level;
2148 /* do not manipulate our control entries */
2149 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2150 return ldb_next_request(module, req);
2153 ldb = ldb_module_get_ctx(module);
2154 functional_level = dsdb_functional_level(ldb);
2156 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2157 struct loadparm_context);
2159 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2161 ac = replmd_ctx_init(module, req);
2163 return LDB_ERR_OPERATIONS_ERROR;
2166 /* we have to copy the message as the caller might have it as a const */
2167 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2171 return LDB_ERR_OPERATIONS_ERROR;
2174 ldb_msg_remove_attr(msg, "whenChanged");
2175 ldb_msg_remove_attr(msg, "uSNChanged");
2177 ret = replmd_update_rpmd(module, ac->schema, req, msg, &ac->seq_num, t, &is_urgent);
2178 if (ret == LDB_ERR_REFERRAL) {
2179 referral = talloc_asprintf(req,
2181 lpcfg_dnsdomain(lp_ctx),
2182 ldb_dn_get_linearized(msg->dn));
2183 ret = ldb_module_send_referral(req, referral);
2185 return ldb_module_done(req, NULL, NULL, ret);
2188 if (ret != LDB_SUCCESS) {
2193 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t);
2194 if (ret != LDB_SUCCESS) {
2200 * - replace the old object with the newly constructed one
2203 ac->is_urgent = is_urgent;
2205 ret = ldb_build_mod_req(&down_req, ldb, ac,
2208 ac, replmd_op_callback,
2210 if (ret != LDB_SUCCESS) {
2215 /* If we are in functional level 2000, then
2216 * replmd_modify_handle_linked_attribs will have done
2218 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2219 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2220 if (ret != LDB_SUCCESS) {
2226 talloc_steal(down_req, msg);
2228 /* we only change whenChanged and uSNChanged if the seq_num
2230 if (ac->seq_num != 0) {
2231 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
2236 if (add_uint64_element(msg, "uSNChanged", ac->seq_num) != LDB_SUCCESS) {
2242 /* go on with the call chain */
2243 return ldb_next_request(module, down_req);
2246 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2249 handle a rename request
2251 On a rename we need to do an extra ldb_modify which sets the
2252 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2254 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2256 struct ldb_context *ldb;
2257 struct replmd_replicated_request *ac;
2259 struct ldb_request *down_req;
2261 /* do not manipulate our control entries */
2262 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2263 return ldb_next_request(module, req);
2266 ldb = ldb_module_get_ctx(module);
2268 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2270 ac = replmd_ctx_init(module, req);
2272 return LDB_ERR_OPERATIONS_ERROR;
2274 ret = ldb_build_rename_req(&down_req, ldb, ac,
2275 ac->req->op.rename.olddn,
2276 ac->req->op.rename.newdn,
2278 ac, replmd_rename_callback,
2281 if (ret != LDB_SUCCESS) {
2286 /* go on with the call chain */
2287 return ldb_next_request(module, down_req);
2290 /* After the rename is compleated, update the whenchanged etc */
2291 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2293 struct ldb_context *ldb;
2294 struct replmd_replicated_request *ac;
2295 struct ldb_request *down_req;
2296 struct ldb_message *msg;
2297 time_t t = time(NULL);
2300 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2301 ldb = ldb_module_get_ctx(ac->module);
2303 if (ares->error != LDB_SUCCESS) {
2304 return ldb_module_done(ac->req, ares->controls,
2305 ares->response, ares->error);
2308 if (ares->type != LDB_REPLY_DONE) {
2309 ldb_set_errstring(ldb,
2310 "invalid ldb_reply_type in callback");
2312 return ldb_module_done(ac->req, NULL, NULL,
2313 LDB_ERR_OPERATIONS_ERROR);
2316 /* Get a sequence number from the backend */
2317 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
2318 if (ret != LDB_SUCCESS) {
2323 * - replace the old object with the newly constructed one
2326 msg = ldb_msg_new(ac);
2329 return LDB_ERR_OPERATIONS_ERROR;
2332 msg->dn = ac->req->op.rename.newdn;
2334 ret = ldb_build_mod_req(&down_req, ldb, ac,
2337 ac, replmd_op_callback,
2340 if (ret != LDB_SUCCESS) {
2344 talloc_steal(down_req, msg);
2346 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
2351 if (add_uint64_element(msg, "uSNChanged", ac->seq_num) != LDB_SUCCESS) {
2356 /* go on with the call chain - do the modify after the rename */
2357 return ldb_next_request(ac->module, down_req);
2361 remove links from objects that point at this object when an object
2364 static int replmd_delete_remove_link(struct ldb_module *module,
2365 const struct dsdb_schema *schema,
2367 struct ldb_message_element *el,
2368 const struct dsdb_attribute *sa)
2371 TALLOC_CTX *tmp_ctx = talloc_new(module);
2372 struct ldb_context *ldb = ldb_module_get_ctx(module);
2374 for (i=0; i<el->num_values; i++) {
2375 struct dsdb_dn *dsdb_dn;
2379 struct ldb_message *msg;
2380 const struct dsdb_attribute *target_attr;
2381 struct ldb_message_element *el2;
2382 struct ldb_val dn_val;
2384 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2388 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2390 talloc_free(tmp_ctx);
2391 return LDB_ERR_OPERATIONS_ERROR;
2394 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2395 if (!NT_STATUS_IS_OK(status)) {
2396 talloc_free(tmp_ctx);
2397 return LDB_ERR_OPERATIONS_ERROR;
2400 /* remove the link */
2401 msg = ldb_msg_new(tmp_ctx);
2403 ldb_module_oom(module);
2404 talloc_free(tmp_ctx);
2405 return LDB_ERR_OPERATIONS_ERROR;
2409 msg->dn = dsdb_dn->dn;
2411 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2412 if (target_attr == NULL) {
2416 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2417 if (ret != LDB_SUCCESS) {
2418 ldb_module_oom(module);
2419 talloc_free(tmp_ctx);
2420 return LDB_ERR_OPERATIONS_ERROR;
2422 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2423 el2->values = &dn_val;
2424 el2->num_values = 1;
2426 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2427 if (ret != LDB_SUCCESS) {
2428 talloc_free(tmp_ctx);
2432 talloc_free(tmp_ctx);
2438 handle update of replication meta data for deletion of objects
2440 This also handles the mapping of delete to a rename operation
2441 to allow deletes to be replicated.
2443 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2445 int ret = LDB_ERR_OTHER;
2447 struct ldb_dn *old_dn, *new_dn;
2448 const char *rdn_name;
2449 const struct ldb_val *rdn_value, *new_rdn_value;
2451 struct ldb_context *ldb = ldb_module_get_ctx(module);
2452 const struct dsdb_schema *schema;
2453 struct ldb_message *msg, *old_msg;
2454 struct ldb_message_element *el;
2455 TALLOC_CTX *tmp_ctx;
2456 struct ldb_result *res, *parent_res;
2457 const char *preserved_attrs[] = {
2458 /* yes, this really is a hard coded list. See MS-ADTS
2459 section 3.1.1.5.5.1.1 */
2460 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2461 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2462 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2463 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2464 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2465 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2466 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2467 "whenChanged", NULL};
2468 unsigned int i, el_count = 0;
2469 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2470 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2471 enum deletion_state deletion_state, next_deletion_state;
2474 if (ldb_dn_is_special(req->op.del.dn)) {
2475 return ldb_next_request(module, req);
2478 tmp_ctx = talloc_new(ldb);
2481 return LDB_ERR_OPERATIONS_ERROR;
2484 schema = dsdb_get_schema(ldb, tmp_ctx);
2486 return LDB_ERR_OPERATIONS_ERROR;
2489 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2491 /* we need the complete msg off disk, so we can work out which
2492 attributes need to be removed */
2493 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2494 DSDB_FLAG_NEXT_MODULE |
2495 DSDB_SEARCH_SHOW_DELETED |
2496 DSDB_SEARCH_REVEAL_INTERNALS |
2497 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2498 if (ret != LDB_SUCCESS) {
2499 talloc_free(tmp_ctx);
2502 old_msg = res->msgs[0];
2505 ret = dsdb_recyclebin_enabled(module, &enabled);
2506 if (ret != LDB_SUCCESS) {
2507 talloc_free(tmp_ctx);
2511 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2513 deletion_state = OBJECT_TOMBSTONE;
2514 next_deletion_state = OBJECT_REMOVED;
2515 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2516 deletion_state = OBJECT_RECYCLED;
2517 next_deletion_state = OBJECT_REMOVED;
2519 deletion_state = OBJECT_DELETED;
2520 next_deletion_state = OBJECT_RECYCLED;
2523 deletion_state = OBJECT_NOT_DELETED;
2525 next_deletion_state = OBJECT_DELETED;
2527 next_deletion_state = OBJECT_TOMBSTONE;
2531 if (next_deletion_state == OBJECT_REMOVED) {
2532 struct auth_session_info *session_info =
2533 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2534 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2535 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2536 ldb_dn_get_linearized(old_msg->dn));
2537 return LDB_ERR_UNWILLING_TO_PERFORM;
2540 /* it is already deleted - really remove it this time */
2541 talloc_free(tmp_ctx);
2542 return ldb_next_request(module, req);
2545 rdn_name = ldb_dn_get_rdn_name(old_dn);
2546 rdn_value = ldb_dn_get_rdn_val(old_dn);
2548 msg = ldb_msg_new(tmp_ctx);
2550 ldb_module_oom(module);
2551 talloc_free(tmp_ctx);
2552 return LDB_ERR_OPERATIONS_ERROR;
2557 if (deletion_state == OBJECT_NOT_DELETED){
2558 /* work out where we will be renaming this object to */
2559 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn, &new_dn);
2560 if (ret != LDB_SUCCESS) {
2561 /* this is probably an attempted delete on a partition
2562 * that doesn't allow delete operations, such as the
2563 * schema partition */
2564 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2565 ldb_dn_get_linearized(old_dn));
2566 talloc_free(tmp_ctx);
2567 return LDB_ERR_UNWILLING_TO_PERFORM;
2570 /* get the objects GUID from the search we just did */
2571 guid = samdb_result_guid(old_msg, "objectGUID");
2573 /* Add a formatted child */
2574 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2577 GUID_string(tmp_ctx, &guid));
2579 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2580 ldb_dn_get_linearized(new_dn)));
2581 talloc_free(tmp_ctx);
2582 return LDB_ERR_OPERATIONS_ERROR;
2585 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2586 if (ret != LDB_SUCCESS) {
2587 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2588 ldb_module_oom(module);
2589 talloc_free(tmp_ctx);
2592 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2596 now we need to modify the object in the following ways:
2598 - add isDeleted=TRUE
2599 - update rDN and name, with new rDN
2600 - remove linked attributes
2601 - remove objectCategory and sAMAccountType
2602 - remove attribs not on the preserved list
2603 - preserved if in above list, or is rDN
2604 - remove all linked attribs from this object
2605 - remove all links from other objects to this object
2606 - add lastKnownParent
2607 - update replPropertyMetaData?
2609 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2612 /* we need the storage form of the parent GUID */
2613 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2614 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2615 DSDB_FLAG_NEXT_MODULE |
2616 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2617 DSDB_SEARCH_REVEAL_INTERNALS|
2618 DSDB_SEARCH_SHOW_DELETED);
2619 if (ret != LDB_SUCCESS) {
2620 talloc_free(tmp_ctx);
2624 if (deletion_state == OBJECT_NOT_DELETED){
2625 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2626 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2627 if (ret != LDB_SUCCESS) {
2628 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2629 ldb_module_oom(module);
2630 talloc_free(tmp_ctx);
2633 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2636 switch (next_deletion_state){
2638 case OBJECT_DELETED:
2640 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2641 if (ret != LDB_SUCCESS) {
2642 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
2643 ldb_module_oom(module);
2644 talloc_free(tmp_ctx);
2647 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2649 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_DELETE, NULL);
2650 if (ret != LDB_SUCCESS) {
2651 talloc_free(tmp_ctx);
2652 ldb_module_oom(module);
2656 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_DELETE, NULL);
2657 if (ret != LDB_SUCCESS) {
2658 talloc_free(tmp_ctx);
2659 ldb_module_oom(module);
2665 case OBJECT_RECYCLED:
2666 case OBJECT_TOMBSTONE:
2668 /* we also mark it as recycled, meaning this object can't be
2669 recovered (we are stripping its attributes) */
2670 if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008_R2) {
2671 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
2672 if (ret != LDB_SUCCESS) {
2673 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
2674 ldb_module_oom(module);
2675 talloc_free(tmp_ctx);
2678 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2681 /* work out which of the old attributes we will be removing */
2682 for (i=0; i<old_msg->num_elements; i++) {
2683 const struct dsdb_attribute *sa;
2684 el = &old_msg->elements[i];
2685 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2687 talloc_free(tmp_ctx);
2688 return LDB_ERR_OPERATIONS_ERROR;
2690 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
2691 /* don't remove the rDN */
2694 if (sa->linkID && sa->linkID & 1) {
2695 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa);
2696 if (ret != LDB_SUCCESS) {
2697 talloc_free(tmp_ctx);
2698 return LDB_ERR_OPERATIONS_ERROR;
2702 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
2705 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
2706 if (ret != LDB_SUCCESS) {
2707 talloc_free(tmp_ctx);
2708 ldb_module_oom(module);
2718 if (deletion_state == OBJECT_NOT_DELETED) {
2719 /* work out what the new rdn value is, for updating the
2720 rDN and name fields */
2721 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
2723 ret = ldb_msg_add_value(msg, strlower_talloc(tmp_ctx, rdn_name), new_rdn_value, &el);
2724 if (ret != LDB_SUCCESS) {
2725 talloc_free(tmp_ctx);
2728 el->flags = LDB_FLAG_MOD_REPLACE;
2730 el = ldb_msg_find_element(old_msg, "name");
2732 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
2733 if (ret != LDB_SUCCESS) {
2734 talloc_free(tmp_ctx);
2737 el->flags = LDB_FLAG_MOD_REPLACE;
2741 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2742 if (ret != LDB_SUCCESS) {
2743 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
2744 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
2745 talloc_free(tmp_ctx);
2749 if (deletion_state == OBJECT_NOT_DELETED) {
2750 /* now rename onto the new DN */
2751 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE);
2752 if (ret != LDB_SUCCESS){
2753 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
2754 ldb_dn_get_linearized(old_dn),
2755 ldb_dn_get_linearized(new_dn),
2756 ldb_errstring(ldb)));
2757 talloc_free(tmp_ctx);
2762 talloc_free(tmp_ctx);
2764 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
2769 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
2774 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
2776 int ret = LDB_ERR_OTHER;
2777 /* TODO: do some error mapping */
2781 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
2783 struct ldb_context *ldb;
2784 struct ldb_request *change_req;
2785 enum ndr_err_code ndr_err;
2786 struct ldb_message *msg;
2787 struct replPropertyMetaDataBlob *md;
2788 struct ldb_val md_value;
2793 * TODO: check if the parent object exist
2797 * TODO: handle the conflict case where an object with the
2801 ldb = ldb_module_get_ctx(ar->module);
2802 msg = ar->objs->objects[ar->index_current].msg;
2803 md = ar->objs->objects[ar->index_current].meta_data;
2805 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
2806 if (ret != LDB_SUCCESS) {
2807 return replmd_replicated_request_error(ar, ret);
2810 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
2811 if (ret != LDB_SUCCESS) {
2812 return replmd_replicated_request_error(ar, ret);
2815 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
2816 if (ret != LDB_SUCCESS) {
2817 return replmd_replicated_request_error(ar, ret);
2820 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
2821 if (ret != LDB_SUCCESS) {
2822 return replmd_replicated_request_error(ar, ret);
2825 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
2826 if (ret != LDB_SUCCESS) {
2827 return replmd_replicated_request_error(ar, ret);
2830 /* remove any message elements that have zero values */
2831 for (i=0; i<msg->num_elements; i++) {
2832 struct ldb_message_element *el = &msg->elements[i];
2834 if (el->num_values == 0) {
2835 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
2837 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
2838 msg->num_elements--;
2845 * the meta data array is already sorted by the caller
2847 for (i=0; i < md->ctr.ctr1.count; i++) {
2848 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
2850 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
2851 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
2852 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2853 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2854 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
2856 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
2857 if (ret != LDB_SUCCESS) {
2858 return replmd_replicated_request_error(ar, ret);
2861 replmd_ldb_message_sort(msg, ar->schema);
2864 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
2865 DEBUG(4, ("DRS replication add message:\n%s\n", s));
2869 ret = ldb_build_add_req(&change_req,
2877 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
2879 return ldb_next_request(ar->module, change_req);
2883 return true if an update is newer than an existing entry
2884 see section 5.11 of MS-ADTS
2886 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
2887 const struct GUID *update_invocation_id,
2888 uint32_t current_version,
2889 uint32_t update_version,
2890 NTTIME current_change_time,
2891 NTTIME update_change_time)
2893 if (update_version != current_version) {
2894 return update_version > current_version;
2896 if (update_change_time > current_change_time) {
2899 if (update_change_time == current_change_time) {
2900 return GUID_compare(update_invocation_id, current_invocation_id) > 0;
2905 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
2906 struct replPropertyMetaData1 *new_m)
2908 return replmd_update_is_newer(&cur_m->originating_invocation_id,
2909 &new_m->originating_invocation_id,
2912 cur_m->originating_change_time,
2913 new_m->originating_change_time);
2916 static struct replPropertyMetaData1 *
2917 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
2918 enum drsuapi_DsAttributeId attid)
2921 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
2923 for (i = 0; i < rpmd_ctr->count; i++) {
2924 if (rpmd_ctr->array[i].attid == attid) {
2925 return &rpmd_ctr->array[i];
2931 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
2933 struct ldb_context *ldb;
2934 struct ldb_request *change_req;
2935 enum ndr_err_code ndr_err;
2936 struct ldb_message *msg;
2937 struct replPropertyMetaDataBlob *rmd;
2938 struct replPropertyMetaDataBlob omd;
2939 const struct ldb_val *omd_value;
2940 struct replPropertyMetaDataBlob nmd;
2941 struct ldb_val nmd_value;
2942 struct replPropertyMetaData1 *md_remote;
2943 struct replPropertyMetaData1 *md_local;
2946 unsigned int removed_attrs = 0;
2949 ldb = ldb_module_get_ctx(ar->module);
2950 msg = ar->objs->objects[ar->index_current].msg;
2951 rmd = ar->objs->objects[ar->index_current].meta_data;
2955 /* find existing meta data */
2956 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
2958 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
2959 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
2960 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2961 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2962 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
2965 if (omd.version != 1) {
2966 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
2970 /* check if remote 'name' has change,
2971 * which indicates a rename operation */
2972 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTRIBUTE_name);
2974 md_local = replmd_replPropertyMetaData1_find_attid(&omd, DRSUAPI_ATTRIBUTE_name);
2975 SMB_ASSERT(md_local);
2976 if (replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
2977 SMB_ASSERT(ldb_dn_compare(msg->dn, ar->search_msg->dn) != 0);
2978 /* TODO: Find appropriate local name (dn) for the object
2979 * and modify msg->dn appropriately */
2981 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
2982 ldb_dn_get_linearized(ar->search_msg->dn),
2983 ldb_dn_get_linearized(msg->dn)));
2984 /* pass rename to the next module
2985 * so it doesn't appear as an originating update */
2986 ret = dsdb_module_rename(ar->module,
2987 ar->search_msg->dn, msg->dn,
2988 DSDB_FLAG_NEXT_MODULE);
2989 if (ret != LDB_SUCCESS) {
2990 ldb_debug(ldb, LDB_DEBUG_FATAL,
2991 "replmd_replicated_request rename %s => %s failed - %s\n",
2992 ldb_dn_get_linearized(ar->search_msg->dn),
2993 ldb_dn_get_linearized(msg->dn),
2994 ldb_errstring(ldb));
2995 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
3002 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3003 nmd.ctr.ctr1.array = talloc_array(ar,
3004 struct replPropertyMetaData1,
3005 nmd.ctr.ctr1.count);
3006 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3008 /* first copy the old meta data */
3009 for (i=0; i < omd.ctr.ctr1.count; i++) {
3010 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
3014 /* now merge in the new meta data */
3015 for (i=0; i < rmd->ctr.ctr1.count; i++) {
3018 for (j=0; j < ni; j++) {
3021 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
3025 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
3026 &rmd->ctr.ctr1.array[i]);
3028 /* replace the entry */
3029 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
3034 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) {
3035 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
3036 msg->elements[i-removed_attrs].name,
3037 ldb_dn_get_linearized(msg->dn),
3038 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
3041 /* we don't want to apply this change so remove the attribute */
3042 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
3049 if (found) continue;
3051 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
3056 * finally correct the size of the meta_data array
3058 nmd.ctr.ctr1.count = ni;
3061 * the rdn attribute (the alias for the name attribute),
3062 * 'cn' for most objects is the last entry in the meta data array
3065 * sort the new meta data array
3067 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
3068 if (ret != LDB_SUCCESS) {
3073 * check if some replicated attributes left, otherwise skip the ldb_modify() call
3075 if (msg->num_elements == 0) {
3076 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
3079 ar->index_current++;
3080 return replmd_replicated_apply_next(ar);
3083 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
3084 ar->index_current, msg->num_elements);
3086 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3087 if (ret != LDB_SUCCESS) {
3088 return replmd_replicated_request_error(ar, ret);
3091 for (i=0; i<ni; i++) {
3092 nmd.ctr.ctr1.array[i].local_usn = ar->seq_num;
3095 /* create the meta data value */
3096 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
3097 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3098 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3099 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3100 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3104 * when we know that we'll modify the record, add the whenChanged, uSNChanged
3105 * and replPopertyMetaData attributes
3107 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3108 if (ret != LDB_SUCCESS) {
3109 return replmd_replicated_request_error(ar, ret);
3111 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3112 if (ret != LDB_SUCCESS) {
3113 return replmd_replicated_request_error(ar, ret);
3115 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
3116 if (ret != LDB_SUCCESS) {
3117 return replmd_replicated_request_error(ar, ret);
3120 replmd_ldb_message_sort(msg, ar->schema);
3122 /* we want to replace the old values */
3123 for (i=0; i < msg->num_elements; i++) {
3124 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
3128 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3129 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
3133 ret = ldb_build_mod_req(&change_req,
3141 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3143 return ldb_next_request(ar->module, change_req);
3146 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
3147 struct ldb_reply *ares)
3149 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3150 struct replmd_replicated_request);
3154 return ldb_module_done(ar->req, NULL, NULL,
3155 LDB_ERR_OPERATIONS_ERROR);
3157 if (ares->error != LDB_SUCCESS &&
3158 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3159 return ldb_module_done(ar->req, ares->controls,
3160 ares->response, ares->error);
3163 switch (ares->type) {
3164 case LDB_REPLY_ENTRY:
3165 ar->search_msg = talloc_steal(ar, ares->message);
3168 case LDB_REPLY_REFERRAL:
3169 /* we ignore referrals */
3172 case LDB_REPLY_DONE:
3173 if (ar->search_msg != NULL) {
3174 ret = replmd_replicated_apply_merge(ar);
3176 ret = replmd_replicated_apply_add(ar);
3178 if (ret != LDB_SUCCESS) {
3179 return ldb_module_done(ar->req, NULL, NULL, ret);
3187 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
3189 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
3191 struct ldb_context *ldb;
3195 struct ldb_request *search_req;
3196 struct ldb_search_options_control *options;
3198 if (ar->index_current >= ar->objs->num_objects) {
3199 /* done with it, go to next stage */
3200 return replmd_replicated_uptodate_vector(ar);
3203 ldb = ldb_module_get_ctx(ar->module);
3204 ar->search_msg = NULL;
3206 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
3207 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3209 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3210 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3211 talloc_free(tmp_str);
3213 ret = ldb_build_search_req(&search_req,
3222 replmd_replicated_apply_search_callback,
3225 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_DELETED_OID, true, NULL);
3226 if (ret != LDB_SUCCESS) {
3230 /* we need to cope with cross-partition links, so search for
3231 the GUID over all partitions */
3232 options = talloc(search_req, struct ldb_search_options_control);
3233 if (options == NULL) {
3234 DEBUG(0, (__location__ ": out of memory\n"));
3235 return LDB_ERR_OPERATIONS_ERROR;
3237 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
3239 ret = ldb_request_add_control(search_req,
3240 LDB_CONTROL_SEARCH_OPTIONS_OID,
3242 if (ret != LDB_SUCCESS) {
3246 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3248 return ldb_next_request(ar->module, search_req);
3251 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
3252 struct ldb_reply *ares)
3254 struct ldb_context *ldb;
3255 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3256 struct replmd_replicated_request);
3257 ldb = ldb_module_get_ctx(ar->module);
3260 return ldb_module_done(ar->req, NULL, NULL,
3261 LDB_ERR_OPERATIONS_ERROR);
3263 if (ares->error != LDB_SUCCESS) {
3264 return ldb_module_done(ar->req, ares->controls,
3265 ares->response, ares->error);
3268 if (ares->type != LDB_REPLY_DONE) {
3269 ldb_set_errstring(ldb, "Invalid reply type\n!");
3270 return ldb_module_done(ar->req, NULL, NULL,
3271 LDB_ERR_OPERATIONS_ERROR);
3276 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3279 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
3281 struct ldb_context *ldb;
3282 struct ldb_request *change_req;
3283 enum ndr_err_code ndr_err;
3284 struct ldb_message *msg;
3285 struct replUpToDateVectorBlob ouv;
3286 const struct ldb_val *ouv_value;
3287 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
3288 struct replUpToDateVectorBlob nuv;
3289 struct ldb_val nuv_value;
3290 struct ldb_message_element *nuv_el = NULL;
3291 const struct GUID *our_invocation_id;
3292 struct ldb_message_element *orf_el = NULL;
3293 struct repsFromToBlob nrf;
3294 struct ldb_val *nrf_value = NULL;
3295 struct ldb_message_element *nrf_el = NULL;
3299 time_t t = time(NULL);
3303 ldb = ldb_module_get_ctx(ar->module);
3304 ruv = ar->objs->uptodateness_vector;
3310 unix_to_nt_time(&now, t);
3313 * first create the new replUpToDateVector
3315 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
3317 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
3318 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
3319 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3320 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3321 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3324 if (ouv.version != 2) {
3325 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3330 * the new uptodateness vector will at least
3331 * contain 1 entry, one for the source_dsa
3333 * plus optional values from our old vector and the one from the source_dsa
3335 nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
3336 if (ruv) nuv.ctr.ctr2.count += ruv->count;
3337 nuv.ctr.ctr2.cursors = talloc_array(ar,
3338 struct drsuapi_DsReplicaCursor2,
3339 nuv.ctr.ctr2.count);
3340 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3342 /* first copy the old vector */
3343 for (i=0; i < ouv.ctr.ctr2.count; i++) {
3344 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
3348 /* get our invocation_id if we have one already attached to the ldb */
3349 our_invocation_id = samdb_ntds_invocation_id(ldb);
3351 /* merge in the source_dsa vector is available */
3352 for (i=0; (ruv && i < ruv->count); i++) {
3355 if (our_invocation_id &&
3356 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3357 our_invocation_id)) {
3361 for (j=0; j < ni; j++) {
3362 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3363 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3370 * we update only the highest_usn and not the latest_sync_success time,
3371 * because the last success stands for direct replication
3373 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
3374 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
3379 if (found) continue;
3381 /* if it's not there yet, add it */
3382 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
3387 * merge in the current highwatermark for the source_dsa
3390 for (j=0; j < ni; j++) {
3391 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
3392 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3399 * here we update the highest_usn and last_sync_success time
3400 * because we're directly replicating from the source_dsa
3402 * and use the tmp_highest_usn because this is what we have just applied
3405 nuv.ctr.ctr2.cursors[j].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3406 nuv.ctr.ctr2.cursors[j].last_sync_success = now;
3411 * here we update the highest_usn and last_sync_success time
3412 * because we're directly replicating from the source_dsa
3414 * and use the tmp_highest_usn because this is what we have just applied
3417 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
3418 nuv.ctr.ctr2.cursors[ni].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3419 nuv.ctr.ctr2.cursors[ni].last_sync_success = now;
3424 * finally correct the size of the cursors array
3426 nuv.ctr.ctr2.count = ni;
3431 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
3434 * create the change ldb_message
3436 msg = ldb_msg_new(ar);
3437 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3438 msg->dn = ar->search_msg->dn;
3440 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
3441 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
3442 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3443 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3444 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3446 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
3447 if (ret != LDB_SUCCESS) {
3448 return replmd_replicated_request_error(ar, ret);
3450 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
3453 * now create the new repsFrom value from the given repsFromTo1 structure
3457 nrf.ctr.ctr1 = *ar->objs->source_dsa;
3458 /* and fix some values... */
3459 nrf.ctr.ctr1.consecutive_sync_failures = 0;
3460 nrf.ctr.ctr1.last_success = now;
3461 nrf.ctr.ctr1.last_attempt = now;
3462 nrf.ctr.ctr1.result_last_attempt = WERR_OK;
3463 nrf.ctr.ctr1.highwatermark.highest_usn = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
3466 * first see if we already have a repsFrom value for the current source dsa
3467 * if so we'll later replace this value
3469 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
3471 for (i=0; i < orf_el->num_values; i++) {
3472 struct repsFromToBlob *trf;
3474 trf = talloc(ar, struct repsFromToBlob);
3475 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3477 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
3478 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
3479 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3480 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3481 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3484 if (trf->version != 1) {
3485 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3489 * we compare the source dsa objectGUID not the invocation_id
3490 * because we want only one repsFrom value per source dsa
3491 * and when the invocation_id of the source dsa has changed we don't need
3492 * the old repsFrom with the old invocation_id
3494 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
3495 &ar->objs->source_dsa->source_dsa_obj_guid)) {
3501 nrf_value = &orf_el->values[i];
3506 * copy over all old values to the new ldb_message
3508 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
3509 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3514 * if we haven't found an old repsFrom value for the current source dsa
3515 * we'll add a new value
3518 struct ldb_val zero_value;
3519 ZERO_STRUCT(zero_value);
3520 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
3521 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3523 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
3526 /* we now fill the value which is already attached to ldb_message */
3527 ndr_err = ndr_push_struct_blob(nrf_value, msg,
3529 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
3530 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3531 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3532 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3536 * the ldb_message_element for the attribute, has all the old values and the new one
3537 * so we'll replace the whole attribute with all values
3539 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
3542 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3543 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
3547 /* prepare the ldb_modify() request */
3548 ret = ldb_build_mod_req(&change_req,
3554 replmd_replicated_uptodate_modify_callback,
3556 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3558 return ldb_next_request(ar->module, change_req);
3561 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
3562 struct ldb_reply *ares)
3564 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3565 struct replmd_replicated_request);
3569 return ldb_module_done(ar->req, NULL, NULL,
3570 LDB_ERR_OPERATIONS_ERROR);
3572 if (ares->error != LDB_SUCCESS &&
3573 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3574 return ldb_module_done(ar->req, ares->controls,
3575 ares->response, ares->error);
3578 switch (ares->type) {
3579 case LDB_REPLY_ENTRY:
3580 ar->search_msg = talloc_steal(ar, ares->message);
3583 case LDB_REPLY_REFERRAL:
3584 /* we ignore referrals */
3587 case LDB_REPLY_DONE:
3588 if (ar->search_msg == NULL) {
3589 ret = replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3591 ret = replmd_replicated_uptodate_modify(ar);
3593 if (ret != LDB_SUCCESS) {
3594 return ldb_module_done(ar->req, NULL, NULL, ret);
3603 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
3605 struct ldb_context *ldb;
3607 static const char *attrs[] = {
3608 "replUpToDateVector",
3612 struct ldb_request *search_req;
3614 ldb = ldb_module_get_ctx(ar->module);
3615 ar->search_msg = NULL;
3617 ret = ldb_build_search_req(&search_req,
3620 ar->objs->partition_dn,
3626 replmd_replicated_uptodate_search_callback,
3628 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3630 return ldb_next_request(ar->module, search_req);
3635 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
3637 struct ldb_context *ldb;
3638 struct dsdb_extended_replicated_objects *objs;
3639 struct replmd_replicated_request *ar;
3640 struct ldb_control **ctrls;
3643 struct replmd_private *replmd_private =
3644 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
3646 ldb = ldb_module_get_ctx(module);
3648 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
3650 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
3652 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
3653 return LDB_ERR_PROTOCOL_ERROR;
3656 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
3657 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
3658 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
3659 return LDB_ERR_PROTOCOL_ERROR;
3662 ar = replmd_ctx_init(module, req);
3664 return LDB_ERR_OPERATIONS_ERROR;
3666 /* Set the flags to have the replmd_op_callback run over the full set of objects */
3667 ar->apply_mode = true;
3669 ar->schema = dsdb_get_schema(ldb, ar);
3671 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
3673 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
3674 return LDB_ERR_CONSTRAINT_VIOLATION;
3677 ctrls = req->controls;
3679 if (req->controls) {
3680 req->controls = talloc_memdup(ar, req->controls,
3681 talloc_get_size(req->controls));
3682 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3685 /* This allows layers further down to know if a change came in over replication */
3686 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
3687 if (ret != LDB_SUCCESS) {
3691 /* If this change contained linked attributes in the body
3692 * (rather than in the links section) we need to update
3693 * backlinks in linked_attributes */
3694 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
3695 if (ret != LDB_SUCCESS) {
3699 ar->controls = req->controls;
3700 req->controls = ctrls;
3702 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
3704 /* save away the linked attributes for the end of the
3706 for (i=0; i<ar->objs->linked_attributes_count; i++) {
3707 struct la_entry *la_entry;
3709 if (replmd_private->la_ctx == NULL) {
3710 replmd_private->la_ctx = talloc_new(replmd_private);
3712 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
3713 if (la_entry == NULL) {
3715 return LDB_ERR_OPERATIONS_ERROR;
3717 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
3718 if (la_entry->la == NULL) {
3719 talloc_free(la_entry);
3721 return LDB_ERR_OPERATIONS_ERROR;
3723 *la_entry->la = ar->objs->linked_attributes[i];
3725 /* we need to steal the non-scalars so they stay
3726 around until the end of the transaction */
3727 talloc_steal(la_entry->la, la_entry->la->identifier);
3728 talloc_steal(la_entry->la, la_entry->la->value.blob);
3730 DLIST_ADD(replmd_private->la_list, la_entry);
3733 return replmd_replicated_apply_next(ar);
3737 process one linked attribute structure
3739 static int replmd_process_linked_attribute(struct ldb_module *module,
3740 struct la_entry *la_entry)
3742 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
3743 struct ldb_context *ldb = ldb_module_get_ctx(module);
3744 struct ldb_message *msg;
3745 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
3746 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
3748 const struct dsdb_attribute *attr;
3749 struct dsdb_dn *dsdb_dn;
3750 uint64_t seq_num = 0;
3751 struct ldb_message_element *old_el;
3753 time_t t = time(NULL);
3754 struct ldb_result *res;
3755 const char *attrs[2];
3756 struct parsed_dn *pdn_list, *pdn;
3757 struct GUID guid = GUID_zero();
3759 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
3760 const struct GUID *our_invocation_id;
3763 linked_attributes[0]:
3764 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
3766 identifier: struct drsuapi_DsReplicaObjectIdentifier
3767 __ndr_size : 0x0000003a (58)
3768 __ndr_size_sid : 0x00000000 (0)
3769 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
3771 __ndr_size_dn : 0x00000000 (0)
3773 attid : DRSUAPI_ATTRIBUTE_member (0x1F)
3774 value: struct drsuapi_DsAttributeValue
3775 __ndr_size : 0x0000007e (126)
3777 blob : DATA_BLOB length=126
3778 flags : 0x00000001 (1)
3779 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
3780 originating_add_time : Wed Sep 2 22:20:01 2009 EST
3781 meta_data: struct drsuapi_DsReplicaMetaData
3782 version : 0x00000015 (21)
3783 originating_change_time : Wed Sep 2 23:39:07 2009 EST
3784 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
3785 originating_usn : 0x000000000001e19c (123292)
3787 (for cases where the link is to a normal DN)
3788 &target: struct drsuapi_DsReplicaObjectIdentifier3
3789 __ndr_size : 0x0000007e (126)
3790 __ndr_size_sid : 0x0000001c (28)
3791 guid : 7639e594-db75-4086-b0d4-67890ae46031
3792 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
3793 __ndr_size_dn : 0x00000022 (34)
3794 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
3797 /* find the attribute being modified */
3798 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
3800 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
3801 talloc_free(tmp_ctx);
3802 return LDB_ERR_OPERATIONS_ERROR;
3805 attrs[0] = attr->lDAPDisplayName;
3808 /* get the existing message from the db for the object with
3809 this GUID, returning attribute being modified. We will then
3810 use this msg as the basis for a modify call */
3811 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
3812 DSDB_FLAG_NEXT_MODULE |
3813 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
3814 DSDB_SEARCH_SHOW_DELETED |
3815 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
3816 DSDB_SEARCH_REVEAL_INTERNALS,
3817 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
3818 if (ret != LDB_SUCCESS) {
3819 talloc_free(tmp_ctx);
3822 if (res->count != 1) {
3823 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
3824 GUID_string(tmp_ctx, &la->identifier->guid));
3825 talloc_free(tmp_ctx);
3826 return LDB_ERR_NO_SUCH_OBJECT;
3830 if (msg->num_elements == 0) {
3831 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
3832 if (ret != LDB_SUCCESS) {
3833 ldb_module_oom(module);
3834 talloc_free(tmp_ctx);
3835 return LDB_ERR_OPERATIONS_ERROR;
3838 old_el = &msg->elements[0];
3839 old_el->flags = LDB_FLAG_MOD_REPLACE;
3842 /* parse the existing links */
3843 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid);
3844 if (ret != LDB_SUCCESS) {
3845 talloc_free(tmp_ctx);
3849 /* get our invocationId */
3850 our_invocation_id = samdb_ntds_invocation_id(ldb);
3851 if (!our_invocation_id) {
3852 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
3853 talloc_free(tmp_ctx);
3854 return LDB_ERR_OPERATIONS_ERROR;
3857 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
3858 if (ret != LDB_SUCCESS) {
3859 talloc_free(tmp_ctx);
3863 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
3864 if (!W_ERROR_IS_OK(status)) {
3865 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
3866 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
3867 return LDB_ERR_OPERATIONS_ERROR;
3870 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
3871 if (!NT_STATUS_IS_OK(ntstatus) && active) {
3872 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
3874 ldb_dn_get_linearized(dsdb_dn->dn),
3875 ldb_dn_get_linearized(msg->dn));
3876 return LDB_ERR_OPERATIONS_ERROR;
3879 /* re-resolve the DN by GUID, as the DRS server may give us an
3881 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn);
3882 if (ret != LDB_SUCCESS) {
3883 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s",
3884 GUID_string(tmp_ctx, &guid),
3885 ldb_dn_get_linearized(dsdb_dn->dn)));
3888 /* see if this link already exists */
3889 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
3891 /* see if this update is newer than what we have already */
3892 struct GUID invocation_id = GUID_zero();
3893 uint32_t version = 0;
3894 NTTIME change_time = 0;
3895 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
3897 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
3898 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
3899 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
3901 if (!replmd_update_is_newer(&invocation_id,
3902 &la->meta_data.originating_invocation_id,
3904 la->meta_data.version,
3906 la->meta_data.originating_change_time)) {
3907 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
3908 old_el->name, ldb_dn_get_linearized(msg->dn),
3909 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
3910 talloc_free(tmp_ctx);
3914 /* get a seq_num for this change */
3915 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
3916 if (ret != LDB_SUCCESS) {
3917 talloc_free(tmp_ctx);
3921 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
3922 /* remove the existing backlink */
3923 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
3924 if (ret != LDB_SUCCESS) {
3925 talloc_free(tmp_ctx);
3930 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
3931 &la->meta_data.originating_invocation_id,
3932 la->meta_data.originating_usn, seq_num,
3933 la->meta_data.originating_change_time,
3934 la->meta_data.version,
3936 if (ret != LDB_SUCCESS) {
3937 talloc_free(tmp_ctx);
3942 /* add the new backlink */
3943 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
3944 if (ret != LDB_SUCCESS) {
3945 talloc_free(tmp_ctx);
3950 /* get a seq_num for this change */
3951 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
3952 if (ret != LDB_SUCCESS) {
3953 talloc_free(tmp_ctx);
3957 old_el->values = talloc_realloc(msg->elements, old_el->values,
3958 struct ldb_val, old_el->num_values+1);
3959 if (!old_el->values) {
3960 ldb_module_oom(module);
3961 return LDB_ERR_OPERATIONS_ERROR;
3963 old_el->num_values++;
3965 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
3966 &la->meta_data.originating_invocation_id,
3967 la->meta_data.originating_usn, seq_num,
3968 la->meta_data.originating_change_time,
3969 la->meta_data.version,
3970 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
3971 if (ret != LDB_SUCCESS) {
3972 talloc_free(tmp_ctx);
3977 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
3979 if (ret != LDB_SUCCESS) {
3980 talloc_free(tmp_ctx);
3986 /* we only change whenChanged and uSNChanged if the seq_num
3988 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
3989 talloc_free(tmp_ctx);
3990 return LDB_ERR_OPERATIONS_ERROR;
3993 if (add_uint64_element(msg, "uSNChanged", seq_num) != LDB_SUCCESS) {
3994 talloc_free(tmp_ctx);
3995 return LDB_ERR_OPERATIONS_ERROR;
3998 ret = dsdb_check_single_valued_link(attr, old_el);
3999 if (ret != LDB_SUCCESS) {
4000 talloc_free(tmp_ctx);
4004 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX);
4005 if (ret != LDB_SUCCESS) {
4006 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
4008 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
4009 talloc_free(tmp_ctx);
4013 talloc_free(tmp_ctx);
4018 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
4020 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
4021 return replmd_extended_replicated_objects(module, req);
4024 return ldb_next_request(module, req);
4029 we hook into the transaction operations to allow us to
4030 perform the linked attribute updates at the end of the whole
4031 transaction. This allows a forward linked attribute to be created
4032 before the object is created. During a vampire, w2k8 sends us linked
4033 attributes before the objects they are part of.
4035 static int replmd_start_transaction(struct ldb_module *module)
4037 /* create our private structure for this transaction */
4038 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
4039 struct replmd_private);
4040 replmd_txn_cleanup(replmd_private);
4042 /* free any leftover mod_usn records from cancelled
4044 while (replmd_private->ncs) {
4045 struct nc_entry *e = replmd_private->ncs;
4046 DLIST_REMOVE(replmd_private->ncs, e);
4050 return ldb_next_start_trans(module);
4054 on prepare commit we loop over our queued la_context structures and
4057 static int replmd_prepare_commit(struct ldb_module *module)
4059 struct replmd_private *replmd_private =
4060 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4061 struct la_entry *la, *prev;
4062 struct la_backlink *bl;
4065 /* walk the list backwards, to do the first entry first, as we
4066 * added the entries with DLIST_ADD() which puts them at the
4067 * start of the list */
4068 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
4069 prev = DLIST_PREV(la);
4070 DLIST_REMOVE(replmd_private->la_list, la);
4071 ret = replmd_process_linked_attribute(module, la);
4072 if (ret != LDB_SUCCESS) {
4073 replmd_txn_cleanup(replmd_private);
4078 /* process our backlink list, creating and deleting backlinks
4080 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
4081 ret = replmd_process_backlink(module, bl);
4082 if (ret != LDB_SUCCESS) {
4083 replmd_txn_cleanup(replmd_private);
4088 replmd_txn_cleanup(replmd_private);
4090 /* possibly change @REPLCHANGED */
4091 ret = replmd_notify_store(module);
4092 if (ret != LDB_SUCCESS) {
4096 return ldb_next_prepare_commit(module);
4099 static int replmd_del_transaction(struct ldb_module *module)
4101 struct replmd_private *replmd_private =
4102 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4103 replmd_txn_cleanup(replmd_private);
4105 return ldb_next_del_trans(module);
4109 _PUBLIC_ const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
4110 .name = "repl_meta_data",
4111 .init_context = replmd_init,
4113 .modify = replmd_modify,
4114 .rename = replmd_rename,
4115 .del = replmd_delete,
4116 .extended = replmd_extended,
4117 .start_transaction = replmd_start_transaction,
4118 .prepare_commit = replmd_prepare_commit,
4119 .del_transaction = replmd_del_transaction,