4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher <metze@samba.org> 2007
8 Copyright (C) Matthieu Patou <mat@samba.org> 2010
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 * Component: ldb repl_meta_data module
29 * Description: - add a unique objectGUID onto every new record,
30 * - handle whenCreated, whenChanged timestamps
31 * - handle uSNCreated, uSNChanged numbers
32 * - handle replPropertyMetaData attribute
35 * Author: Stefan Metzmacher
39 #include "ldb_module.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "dsdb/common/proto.h"
42 #include "../libds/common/flags.h"
43 #include "librpc/gen_ndr/ndr_misc.h"
44 #include "librpc/gen_ndr/ndr_drsuapi.h"
45 #include "librpc/gen_ndr/ndr_drsblobs.h"
46 #include "param/param.h"
47 #include "libcli/security/security.h"
48 #include "lib/util/dlinklist.h"
49 #include "dsdb/samdb/ldb_modules/util.h"
50 #include "lib/util/binsearch.h"
51 #include "libcli/security/session.h"
52 #include "lib/util/tsort.h"
54 struct replmd_private {
56 struct la_entry *la_list;
58 struct la_backlink *la_backlinks;
60 struct nc_entry *prev, *next;
63 uint64_t mod_usn_urgent;
68 struct la_entry *next, *prev;
69 struct drsuapi_DsReplicaLinkedAttribute *la;
72 struct replmd_replicated_request {
73 struct ldb_module *module;
74 struct ldb_request *req;
76 const struct dsdb_schema *schema;
78 /* the controls we pass down */
79 struct ldb_control **controls;
81 /* details for the mode where we apply a bunch of inbound replication meessages */
83 uint32_t index_current;
84 struct dsdb_extended_replicated_objects *objs;
86 struct ldb_message *search_msg;
92 enum urgent_situation {
93 REPL_URGENT_ON_CREATE = 1,
94 REPL_URGENT_ON_UPDATE = 2,
95 REPL_URGENT_ON_DELETE = 4
100 const char *update_name;
101 enum urgent_situation repl_situation;
102 } urgent_objects[] = {
103 {"nTDSDSA", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
104 {"crossRef", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_DELETE)},
105 {"attributeSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
106 {"classSchema", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
107 {"secret", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
108 {"rIDManager", (REPL_URGENT_ON_CREATE | REPL_URGENT_ON_UPDATE)},
112 /* Attributes looked for when updating or deleting, to check for a urgent replication needed */
113 static const char *urgent_attrs[] = {
116 "userAccountControl",
121 static bool replmd_check_urgent_objectclass(const struct ldb_message_element *objectclass_el,
122 enum urgent_situation situation)
125 for (i=0; urgent_objects[i].update_name; i++) {
127 if ((situation & urgent_objects[i].repl_situation) == 0) {
131 for (j=0; j<objectclass_el->num_values; j++) {
132 const struct ldb_val *v = &objectclass_el->values[j];
133 if (ldb_attr_cmp((const char *)v->data, urgent_objects[i].update_name) == 0) {
141 static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
143 if (ldb_attr_in_list(urgent_attrs, el->name)) {
150 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar);
153 initialise the module
154 allocate the private structure and build the list
155 of partition DNs for use by replmd_notify()
157 static int replmd_init(struct ldb_module *module)
159 struct replmd_private *replmd_private;
160 struct ldb_context *ldb = ldb_module_get_ctx(module);
162 replmd_private = talloc_zero(module, struct replmd_private);
163 if (replmd_private == NULL) {
165 return LDB_ERR_OPERATIONS_ERROR;
167 ldb_module_set_private(module, replmd_private);
169 return ldb_next_init(module);
173 cleanup our per-transaction contexts
175 static void replmd_txn_cleanup(struct replmd_private *replmd_private)
177 talloc_free(replmd_private->la_ctx);
178 replmd_private->la_list = NULL;
179 replmd_private->la_ctx = NULL;
181 talloc_free(replmd_private->bl_ctx);
182 replmd_private->la_backlinks = NULL;
183 replmd_private->bl_ctx = NULL;
188 struct la_backlink *next, *prev;
189 const char *attr_name;
190 struct GUID forward_guid, target_guid;
195 process a backlinks we accumulated during a transaction, adding and
196 deleting the backlinks from the target objects
198 static int replmd_process_backlink(struct ldb_module *module, struct la_backlink *bl)
200 struct ldb_dn *target_dn, *source_dn;
202 struct ldb_context *ldb = ldb_module_get_ctx(module);
203 struct ldb_message *msg;
204 TALLOC_CTX *tmp_ctx = talloc_new(bl);
210 - construct ldb_message
211 - either an add or a delete
213 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->target_guid, &target_dn);
214 if (ret != LDB_SUCCESS) {
215 DEBUG(2,(__location__ ": WARNING: Failed to find target DN for linked attribute with GUID %s\n",
216 GUID_string(bl, &bl->target_guid)));
220 ret = dsdb_module_dn_by_guid(module, tmp_ctx, &bl->forward_guid, &source_dn);
221 if (ret != LDB_SUCCESS) {
222 ldb_asprintf_errstring(ldb, "Failed to find source DN for linked attribute with GUID %s\n",
223 GUID_string(bl, &bl->forward_guid));
224 talloc_free(tmp_ctx);
228 msg = ldb_msg_new(tmp_ctx);
230 ldb_module_oom(module);
231 talloc_free(tmp_ctx);
232 return LDB_ERR_OPERATIONS_ERROR;
235 /* construct a ldb_message for adding/deleting the backlink */
237 dn_string = ldb_dn_get_extended_linearized(tmp_ctx, source_dn, 1);
239 ldb_module_oom(module);
240 talloc_free(tmp_ctx);
241 return LDB_ERR_OPERATIONS_ERROR;
243 ret = ldb_msg_add_steal_string(msg, bl->attr_name, dn_string);
244 if (ret != LDB_SUCCESS) {
245 talloc_free(tmp_ctx);
248 msg->elements[0].flags = bl->active?LDB_FLAG_MOD_ADD:LDB_FLAG_MOD_DELETE;
250 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
251 if (ret != LDB_SUCCESS) {
252 ldb_asprintf_errstring(ldb, "Failed to %s backlink from %s to %s - %s",
253 bl->active?"add":"remove",
254 ldb_dn_get_linearized(source_dn),
255 ldb_dn_get_linearized(target_dn),
257 talloc_free(tmp_ctx);
260 talloc_free(tmp_ctx);
265 add a backlink to the list of backlinks to add/delete in the prepare
268 static int replmd_add_backlink(struct ldb_module *module, const struct dsdb_schema *schema,
269 struct GUID *forward_guid, struct GUID *target_guid,
270 bool active, const struct dsdb_attribute *schema_attr, bool immediate)
272 const struct dsdb_attribute *target_attr;
273 struct la_backlink *bl;
274 struct replmd_private *replmd_private =
275 talloc_get_type_abort(ldb_module_get_private(module), struct replmd_private);
277 target_attr = dsdb_attribute_by_linkID(schema, schema_attr->linkID ^ 1);
280 * windows 2003 has a broken schema where the
281 * definition of msDS-IsDomainFor is missing (which is
282 * supposed to be the backlink of the
283 * msDS-HasDomainNCs attribute
288 /* see if its already in the list */
289 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
290 if (GUID_equal(forward_guid, &bl->forward_guid) &&
291 GUID_equal(target_guid, &bl->target_guid) &&
292 (target_attr->lDAPDisplayName == bl->attr_name ||
293 strcmp(target_attr->lDAPDisplayName, bl->attr_name) == 0)) {
299 /* we found an existing one */
300 if (bl->active == active) {
303 DLIST_REMOVE(replmd_private->la_backlinks, bl);
308 if (replmd_private->bl_ctx == NULL) {
309 replmd_private->bl_ctx = talloc_new(replmd_private);
310 if (replmd_private->bl_ctx == NULL) {
311 ldb_module_oom(module);
312 return LDB_ERR_OPERATIONS_ERROR;
317 bl = talloc(replmd_private->bl_ctx, struct la_backlink);
319 ldb_module_oom(module);
320 return LDB_ERR_OPERATIONS_ERROR;
323 /* Ensure the schema does not go away before the bl->attr_name is used */
324 if (!talloc_reference(bl, schema)) {
326 ldb_module_oom(module);
327 return LDB_ERR_OPERATIONS_ERROR;
330 bl->attr_name = target_attr->lDAPDisplayName;
331 bl->forward_guid = *forward_guid;
332 bl->target_guid = *target_guid;
335 /* the caller may ask for this backlink to be processed
338 int ret = replmd_process_backlink(module, bl);
343 DLIST_ADD(replmd_private->la_backlinks, bl);
350 * Callback for most write operations in this module:
352 * notify the repl task that a object has changed. The notifies are
353 * gathered up in the replmd_private structure then written to the
354 * @REPLCHANGED object in each partition during the prepare_commit
356 static int replmd_op_callback(struct ldb_request *req, struct ldb_reply *ares)
359 struct replmd_replicated_request *ac =
360 talloc_get_type_abort(req->context, struct replmd_replicated_request);
361 struct replmd_private *replmd_private =
362 talloc_get_type_abort(ldb_module_get_private(ac->module), struct replmd_private);
363 struct nc_entry *modified_partition;
364 struct ldb_control *partition_ctrl;
365 const struct dsdb_control_current_partition *partition;
367 struct ldb_control **controls;
369 partition_ctrl = ldb_reply_get_control(ares, DSDB_CONTROL_CURRENT_PARTITION_OID);
371 /* Remove the 'partition' control from what we pass up the chain */
372 controls = controls_except_specified(ares->controls, ares, partition_ctrl);
374 if (ares->error != LDB_SUCCESS) {
375 return ldb_module_done(ac->req, controls,
376 ares->response, ares->error);
379 if (ares->type != LDB_REPLY_DONE) {
380 ldb_set_errstring(ldb_module_get_ctx(ac->module), "Invalid reply type for notify\n!");
381 return ldb_module_done(ac->req, NULL,
382 NULL, LDB_ERR_OPERATIONS_ERROR);
385 if (!partition_ctrl) {
386 ldb_set_errstring(ldb_module_get_ctx(ac->module),"No partition control on reply");
387 return ldb_module_done(ac->req, NULL,
388 NULL, LDB_ERR_OPERATIONS_ERROR);
391 partition = talloc_get_type_abort(partition_ctrl->data,
392 struct dsdb_control_current_partition);
394 if (ac->seq_num > 0) {
395 for (modified_partition = replmd_private->ncs; modified_partition;
396 modified_partition = modified_partition->next) {
397 if (ldb_dn_compare(modified_partition->dn, partition->dn) == 0) {
402 if (modified_partition == NULL) {
403 modified_partition = talloc_zero(replmd_private, struct nc_entry);
404 if (!modified_partition) {
405 ldb_oom(ldb_module_get_ctx(ac->module));
406 return ldb_module_done(ac->req, NULL,
407 NULL, LDB_ERR_OPERATIONS_ERROR);
409 modified_partition->dn = ldb_dn_copy(modified_partition, partition->dn);
410 if (!modified_partition->dn) {
411 ldb_oom(ldb_module_get_ctx(ac->module));
412 return ldb_module_done(ac->req, NULL,
413 NULL, LDB_ERR_OPERATIONS_ERROR);
415 DLIST_ADD(replmd_private->ncs, modified_partition);
418 if (ac->seq_num > modified_partition->mod_usn) {
419 modified_partition->mod_usn = ac->seq_num;
421 modified_partition->mod_usn_urgent = ac->seq_num;
426 if (ac->apply_mode) {
430 ret = replmd_replicated_apply_next(ac);
431 if (ret != LDB_SUCCESS) {
432 return ldb_module_done(ac->req, NULL, NULL, ret);
436 /* free the partition control container here, for the
437 * common path. Other cases will have it cleaned up
438 * eventually with the ares */
439 talloc_free(partition_ctrl);
440 return ldb_module_done(ac->req,
441 controls_except_specified(controls, ares, partition_ctrl),
442 ares->response, LDB_SUCCESS);
448 * update a @REPLCHANGED record in each partition if there have been
449 * any writes of replicated data in the partition
451 static int replmd_notify_store(struct ldb_module *module)
453 struct replmd_private *replmd_private =
454 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
456 while (replmd_private->ncs) {
458 struct nc_entry *modified_partition = replmd_private->ncs;
460 ret = dsdb_module_save_partition_usn(module, modified_partition->dn,
461 modified_partition->mod_usn,
462 modified_partition->mod_usn_urgent);
463 if (ret != LDB_SUCCESS) {
464 DEBUG(0,(__location__ ": Failed to save partition uSN for %s\n",
465 ldb_dn_get_linearized(modified_partition->dn)));
468 DLIST_REMOVE(replmd_private->ncs, modified_partition);
469 talloc_free(modified_partition);
477 created a replmd_replicated_request context
479 static struct replmd_replicated_request *replmd_ctx_init(struct ldb_module *module,
480 struct ldb_request *req)
482 struct ldb_context *ldb;
483 struct replmd_replicated_request *ac;
485 ldb = ldb_module_get_ctx(module);
487 ac = talloc_zero(req, struct replmd_replicated_request);
496 ac->schema = dsdb_get_schema(ldb, ac);
498 ldb_debug_set(ldb, LDB_DEBUG_FATAL,
499 "replmd_modify: no dsdb_schema loaded");
500 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
508 add a time element to a record
510 static int add_time_element(struct ldb_message *msg, const char *attr, time_t t)
512 struct ldb_message_element *el;
516 if (ldb_msg_find_element(msg, attr) != NULL) {
520 s = ldb_timestring(msg, t);
522 return LDB_ERR_OPERATIONS_ERROR;
525 ret = ldb_msg_add_string(msg, attr, s);
526 if (ret != LDB_SUCCESS) {
530 el = ldb_msg_find_element(msg, attr);
531 /* always set as replace. This works because on add ops, the flag
533 el->flags = LDB_FLAG_MOD_REPLACE;
539 add a uint64_t element to a record
541 static int add_uint64_element(struct ldb_context *ldb, struct ldb_message *msg,
542 const char *attr, uint64_t v)
544 struct ldb_message_element *el;
547 if (ldb_msg_find_element(msg, attr) != NULL) {
551 ret = samdb_msg_add_uint64(ldb, msg, msg, attr, v);
552 if (ret != LDB_SUCCESS) {
556 el = ldb_msg_find_element(msg, attr);
557 /* always set as replace. This works because on add ops, the flag
559 el->flags = LDB_FLAG_MOD_REPLACE;
564 static int replmd_replPropertyMetaData1_attid_sort(const struct replPropertyMetaData1 *m1,
565 const struct replPropertyMetaData1 *m2,
566 const uint32_t *rdn_attid)
568 if (m1->attid == m2->attid) {
573 * the rdn attribute should be at the end!
574 * so we need to return a value greater than zero
575 * which means m1 is greater than m2
577 if (m1->attid == *rdn_attid) {
582 * the rdn attribute should be at the end!
583 * so we need to return a value less than zero
584 * which means m2 is greater than m1
586 if (m2->attid == *rdn_attid) {
590 return m1->attid > m2->attid ? 1 : -1;
593 static int replmd_replPropertyMetaDataCtr1_sort(struct replPropertyMetaDataCtr1 *ctr1,
594 const struct dsdb_schema *schema,
597 const char *rdn_name;
598 const struct dsdb_attribute *rdn_sa;
600 rdn_name = ldb_dn_get_rdn_name(dn);
602 DEBUG(0,(__location__ ": No rDN for %s?\n", ldb_dn_get_linearized(dn)));
603 return LDB_ERR_OPERATIONS_ERROR;
606 rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
607 if (rdn_sa == NULL) {
608 DEBUG(0,(__location__ ": No sa found for rDN %s for %s\n", rdn_name, ldb_dn_get_linearized(dn)));
609 return LDB_ERR_OPERATIONS_ERROR;
612 DEBUG(6,("Sorting rpmd with attid exception %u rDN=%s DN=%s\n",
613 rdn_sa->attributeID_id, rdn_name, ldb_dn_get_linearized(dn)));
615 LDB_TYPESAFE_QSORT(ctr1->array, ctr1->count, &rdn_sa->attributeID_id, replmd_replPropertyMetaData1_attid_sort);
620 static int replmd_ldb_message_element_attid_sort(const struct ldb_message_element *e1,
621 const struct ldb_message_element *e2,
622 const struct dsdb_schema *schema)
624 const struct dsdb_attribute *a1;
625 const struct dsdb_attribute *a2;
628 * TODO: make this faster by caching the dsdb_attribute pointer
629 * on the ldb_messag_element
632 a1 = dsdb_attribute_by_lDAPDisplayName(schema, e1->name);
633 a2 = dsdb_attribute_by_lDAPDisplayName(schema, e2->name);
636 * TODO: remove this check, we should rely on e1 and e2 having valid attribute names
640 return strcasecmp(e1->name, e2->name);
642 if (a1->attributeID_id == a2->attributeID_id) {
645 return a1->attributeID_id > a2->attributeID_id ? 1 : -1;
648 static void replmd_ldb_message_sort(struct ldb_message *msg,
649 const struct dsdb_schema *schema)
651 LDB_TYPESAFE_QSORT(msg->elements, msg->num_elements, schema, replmd_ldb_message_element_attid_sort);
654 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
655 const struct GUID *invocation_id, uint64_t seq_num,
656 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted);
660 fix up linked attributes in replmd_add.
661 This involves setting up the right meta-data in extended DN
662 components, and creating backlinks to the object
664 static int replmd_add_fix_la(struct ldb_module *module, struct ldb_message_element *el,
665 uint64_t seq_num, const struct GUID *invocationId, time_t t,
666 struct GUID *guid, const struct dsdb_attribute *sa)
669 TALLOC_CTX *tmp_ctx = talloc_new(el->values);
670 struct ldb_context *ldb = ldb_module_get_ctx(module);
672 /* We will take a reference to the schema in replmd_add_backlink */
673 const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
676 unix_to_nt_time(&now, t);
678 for (i=0; i<el->num_values; i++) {
679 struct ldb_val *v = &el->values[i];
680 struct dsdb_dn *dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, v, sa->syntax->ldap_oid);
681 struct GUID target_guid;
685 /* note that the DN already has the extended
686 components from the extended_dn_store module */
687 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
688 if (!NT_STATUS_IS_OK(status) || GUID_all_zero(&target_guid)) {
689 ret = dsdb_module_guid_by_dn(module, dsdb_dn->dn, &target_guid);
690 if (ret != LDB_SUCCESS) {
691 talloc_free(tmp_ctx);
694 ret = dsdb_set_extended_dn_guid(dsdb_dn->dn, &target_guid, "GUID");
695 if (ret != LDB_SUCCESS) {
696 talloc_free(tmp_ctx);
701 ret = replmd_build_la_val(el->values, v, dsdb_dn, invocationId,
702 seq_num, seq_num, now, 0, false);
703 if (ret != LDB_SUCCESS) {
704 talloc_free(tmp_ctx);
708 ret = replmd_add_backlink(module, schema, guid, &target_guid, true, sa, false);
709 if (ret != LDB_SUCCESS) {
710 talloc_free(tmp_ctx);
715 talloc_free(tmp_ctx);
721 intercept add requests
723 static int replmd_add(struct ldb_module *module, struct ldb_request *req)
725 struct ldb_context *ldb;
726 struct ldb_control *control;
727 struct replmd_replicated_request *ac;
728 enum ndr_err_code ndr_err;
729 struct ldb_request *down_req;
730 struct ldb_message *msg;
731 const DATA_BLOB *guid_blob;
733 struct replPropertyMetaDataBlob nmd;
734 struct ldb_val nmd_value;
735 const struct GUID *our_invocation_id;
736 time_t t = time(NULL);
741 unsigned int functional_level;
743 bool allow_add_guid = false;
744 bool remove_current_guid = false;
745 bool is_urgent = false;
746 struct ldb_message_element *objectclass_el;
748 /* check if there's a show relax control (used by provision to say 'I know what I'm doing') */
749 control = ldb_request_get_control(req, LDB_CONTROL_RELAX_OID);
751 allow_add_guid = true;
754 /* do not manipulate our control entries */
755 if (ldb_dn_is_special(req->op.add.message->dn)) {
756 return ldb_next_request(module, req);
759 ldb = ldb_module_get_ctx(module);
761 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_add\n");
763 guid_blob = ldb_msg_find_ldb_val(req->op.add.message, "objectGUID");
764 if (guid_blob != NULL) {
765 if (!allow_add_guid) {
766 ldb_set_errstring(ldb,
767 "replmd_add: it's not allowed to add an object with objectGUID!");
768 return LDB_ERR_UNWILLING_TO_PERFORM;
770 NTSTATUS status = GUID_from_data_blob(guid_blob,&guid);
771 if (!NT_STATUS_IS_OK(status)) {
772 ldb_set_errstring(ldb,
773 "replmd_add: Unable to parse the 'objectGUID' as a GUID!");
774 return LDB_ERR_UNWILLING_TO_PERFORM;
776 /* we remove this attribute as it can be a string and
777 * will not be treated correctly and then we will re-add
778 * it later on in the good format */
779 remove_current_guid = true;
783 guid = GUID_random();
786 ac = replmd_ctx_init(module, req);
788 return ldb_module_oom(module);
791 functional_level = dsdb_functional_level(ldb);
793 /* Get a sequence number from the backend */
794 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
795 if (ret != LDB_SUCCESS) {
800 /* get our invocationId */
801 our_invocation_id = samdb_ntds_invocation_id(ldb);
802 if (!our_invocation_id) {
803 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
804 "replmd_add: unable to find invocationId\n");
806 return LDB_ERR_OPERATIONS_ERROR;
809 /* we have to copy the message as the caller might have it as a const */
810 msg = ldb_msg_copy_shallow(ac, req->op.add.message);
814 return LDB_ERR_OPERATIONS_ERROR;
817 /* generated times */
818 unix_to_nt_time(&now, t);
819 time_str = ldb_timestring(msg, t);
823 return LDB_ERR_OPERATIONS_ERROR;
825 if (remove_current_guid) {
826 ldb_msg_remove_attr(msg,"objectGUID");
830 * remove autogenerated attributes
832 ldb_msg_remove_attr(msg, "whenCreated");
833 ldb_msg_remove_attr(msg, "whenChanged");
834 ldb_msg_remove_attr(msg, "uSNCreated");
835 ldb_msg_remove_attr(msg, "uSNChanged");
836 ldb_msg_remove_attr(msg, "replPropertyMetaData");
839 * readd replicated attributes
841 ret = ldb_msg_add_string(msg, "whenCreated", time_str);
842 if (ret != LDB_SUCCESS) {
848 /* build the replication meta_data */
851 nmd.ctr.ctr1.count = msg->num_elements;
852 nmd.ctr.ctr1.array = talloc_array(msg,
853 struct replPropertyMetaData1,
855 if (!nmd.ctr.ctr1.array) {
858 return LDB_ERR_OPERATIONS_ERROR;
861 for (i=0; i < msg->num_elements; i++) {
862 struct ldb_message_element *e = &msg->elements[i];
863 struct replPropertyMetaData1 *m = &nmd.ctr.ctr1.array[ni];
864 const struct dsdb_attribute *sa;
866 if (e->name[0] == '@') continue;
868 sa = dsdb_attribute_by_lDAPDisplayName(ac->schema, e->name);
870 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
871 "replmd_add: attribute '%s' not defined in schema\n",
874 return LDB_ERR_NO_SUCH_ATTRIBUTE;
877 if ((sa->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (sa->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
878 /* if the attribute is not replicated (0x00000001)
879 * or constructed (0x00000004) it has no metadata
884 if (sa->linkID != 0 && functional_level > DS_DOMAIN_FUNCTION_2000) {
885 ret = replmd_add_fix_la(module, e, ac->seq_num, our_invocation_id, t, &guid, sa);
886 if (ret != LDB_SUCCESS) {
890 /* linked attributes are not stored in
891 replPropertyMetaData in FL above w2k */
895 m->attid = sa->attributeID_id;
897 m->originating_change_time = now;
898 m->originating_invocation_id = *our_invocation_id;
899 m->originating_usn = ac->seq_num;
900 m->local_usn = ac->seq_num;
904 /* fix meta data count */
905 nmd.ctr.ctr1.count = ni;
908 * sort meta data array, and move the rdn attribute entry to the end
910 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ac->schema, msg->dn);
911 if (ret != LDB_SUCCESS) {
916 /* generated NDR encoded values */
917 ndr_err = ndr_push_struct_blob(&nmd_value, msg,
919 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
920 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
923 return LDB_ERR_OPERATIONS_ERROR;
927 * add the autogenerated values
929 ret = dsdb_msg_add_guid(msg, &guid, "objectGUID");
930 if (ret != LDB_SUCCESS) {
935 ret = ldb_msg_add_string(msg, "whenChanged", time_str);
936 if (ret != LDB_SUCCESS) {
941 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ac->seq_num);
942 if (ret != LDB_SUCCESS) {
947 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ac->seq_num);
948 if (ret != LDB_SUCCESS) {
953 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
954 if (ret != LDB_SUCCESS) {
961 * sort the attributes by attid before storing the object
963 replmd_ldb_message_sort(msg, ac->schema);
965 objectclass_el = ldb_msg_find_element(msg, "objectClass");
966 is_urgent = replmd_check_urgent_objectclass(objectclass_el,
967 REPL_URGENT_ON_CREATE);
969 ac->is_urgent = is_urgent;
970 ret = ldb_build_add_req(&down_req, ldb, ac,
973 ac, replmd_op_callback,
976 LDB_REQ_SET_LOCATION(down_req);
977 if (ret != LDB_SUCCESS) {
982 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
983 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
984 if (ret != LDB_SUCCESS) {
990 /* mark the control done */
992 control->critical = 0;
995 /* go on with the call chain */
996 return ldb_next_request(module, down_req);
1001 * update the replPropertyMetaData for one element
1003 static int replmd_update_rpmd_element(struct ldb_context *ldb,
1004 struct ldb_message *msg,
1005 struct ldb_message_element *el,
1006 struct ldb_message_element *old_el,
1007 struct replPropertyMetaDataBlob *omd,
1008 const struct dsdb_schema *schema,
1010 const struct GUID *our_invocation_id,
1014 const struct dsdb_attribute *a;
1015 struct replPropertyMetaData1 *md1;
1017 a = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
1019 DEBUG(0,(__location__ ": Unable to find attribute %s in schema\n",
1021 return LDB_ERR_OPERATIONS_ERROR;
1024 if ((a->systemFlags & DS_FLAG_ATTR_NOT_REPLICATED) || (a->systemFlags & DS_FLAG_ATTR_IS_CONSTRUCTED)) {
1028 /* if the attribute's value haven't changed then return LDB_SUCCESS */
1029 if (old_el != NULL && ldb_msg_element_compare(el, old_el) == 0) {
1033 for (i=0; i<omd->ctr.ctr1.count; i++) {
1034 if (a->attributeID_id == omd->ctr.ctr1.array[i].attid) break;
1037 if (a->linkID != 0 && dsdb_functional_level(ldb) > DS_DOMAIN_FUNCTION_2000) {
1038 /* linked attributes are not stored in
1039 replPropertyMetaData in FL above w2k, but we do
1040 raise the seqnum for the object */
1041 if (*seq_num == 0 &&
1042 ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num) != LDB_SUCCESS) {
1043 return LDB_ERR_OPERATIONS_ERROR;
1048 if (i == omd->ctr.ctr1.count) {
1049 /* we need to add a new one */
1050 omd->ctr.ctr1.array = talloc_realloc(msg, omd->ctr.ctr1.array,
1051 struct replPropertyMetaData1, omd->ctr.ctr1.count+1);
1052 if (omd->ctr.ctr1.array == NULL) {
1054 return LDB_ERR_OPERATIONS_ERROR;
1056 omd->ctr.ctr1.count++;
1057 ZERO_STRUCT(omd->ctr.ctr1.array[i]);
1060 /* Get a new sequence number from the backend. We only do this
1061 * if we have a change that requires a new
1062 * replPropertyMetaData element
1064 if (*seq_num == 0) {
1065 int ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, seq_num);
1066 if (ret != LDB_SUCCESS) {
1067 return LDB_ERR_OPERATIONS_ERROR;
1071 md1 = &omd->ctr.ctr1.array[i];
1073 md1->attid = a->attributeID_id;
1074 md1->originating_change_time = now;
1075 md1->originating_invocation_id = *our_invocation_id;
1076 md1->originating_usn = *seq_num;
1077 md1->local_usn = *seq_num;
1082 static uint64_t find_max_local_usn(struct replPropertyMetaDataBlob omd)
1084 uint32_t count = omd.ctr.ctr1.count;
1087 for (i=0; i < count; i++) {
1088 struct replPropertyMetaData1 m = omd.ctr.ctr1.array[i];
1089 if (max < m.local_usn) {
1097 * update the replPropertyMetaData object each time we modify an
1098 * object. This is needed for DRS replication, as the merge on the
1099 * client is based on this object
1101 static int replmd_update_rpmd(struct ldb_module *module,
1102 const struct dsdb_schema *schema,
1103 struct ldb_request *req,
1104 struct ldb_message *msg, uint64_t *seq_num,
1108 const struct ldb_val *omd_value;
1109 enum ndr_err_code ndr_err;
1110 struct replPropertyMetaDataBlob omd;
1113 const struct GUID *our_invocation_id;
1115 const char *attrs[] = { "replPropertyMetaData", "*", NULL };
1116 const char *attrs2[] = { "uSNChanged", "objectClass", NULL };
1117 struct ldb_result *res;
1118 struct ldb_context *ldb;
1119 struct ldb_message_element *objectclass_el;
1120 enum urgent_situation situation;
1121 bool rodc, rmd_is_provided;
1123 ldb = ldb_module_get_ctx(module);
1125 our_invocation_id = samdb_ntds_invocation_id(ldb);
1126 if (!our_invocation_id) {
1127 /* this happens during an initial vampire while
1128 updating the schema */
1129 DEBUG(5,("No invocationID - skipping replPropertyMetaData update\n"));
1133 unix_to_nt_time(&now, t);
1135 if (ldb_request_get_control(req, DSDB_CONTROL_CHANGEREPLMETADATA_OID)) {
1136 rmd_is_provided = true;
1138 rmd_is_provided = false;
1141 /* if isDeleted is present and is TRUE, then we consider we are deleting,
1142 * otherwise we consider we are updating */
1143 if (ldb_msg_check_string_attribute(msg, "isDeleted", "TRUE")) {
1144 situation = REPL_URGENT_ON_DELETE;
1146 situation = REPL_URGENT_ON_UPDATE;
1149 if (rmd_is_provided) {
1150 /* In this case the change_replmetadata control was supplied */
1151 /* We check that it's the only attribute that is provided
1152 * (it's a rare case so it's better to keep the code simplier)
1153 * We also check that the highest local_usn is bigger than
1156 if( msg->num_elements != 1 ||
1157 strncmp(msg->elements[0].name,
1158 "replPropertyMetaData", 20) ) {
1159 DEBUG(0,(__location__ ": changereplmetada control called without "\
1160 "a specified replPropertyMetaData attribute or with others\n"));
1161 return LDB_ERR_OPERATIONS_ERROR;
1163 if (situation == REPL_URGENT_ON_DELETE) {
1164 DEBUG(0,(__location__ ": changereplmetada control can't be called when deleting an object\n"));
1165 return LDB_ERR_OPERATIONS_ERROR;
1167 omd_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
1169 DEBUG(0,(__location__ ": replPropertyMetaData was not specified for Object %s\n",
1170 ldb_dn_get_linearized(msg->dn)));
1171 return LDB_ERR_OPERATIONS_ERROR;
1173 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1174 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1175 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1176 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1177 ldb_dn_get_linearized(msg->dn)));
1178 return LDB_ERR_OPERATIONS_ERROR;
1180 *seq_num = find_max_local_usn(omd);
1182 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs2,
1183 DSDB_FLAG_NEXT_MODULE |
1184 DSDB_SEARCH_SHOW_RECYCLED |
1185 DSDB_SEARCH_SHOW_EXTENDED_DN |
1186 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1187 DSDB_SEARCH_REVEAL_INTERNALS);
1189 if (ret != LDB_SUCCESS || res->count != 1) {
1190 DEBUG(0,(__location__ ": Object %s failed to find uSNChanged\n",
1191 ldb_dn_get_linearized(msg->dn)));
1192 return LDB_ERR_OPERATIONS_ERROR;
1195 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1196 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1201 db_seq = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNChanged", 0);
1202 if (*seq_num <= db_seq) {
1203 DEBUG(0,(__location__ ": changereplmetada control provided but max(local_usn)"\
1204 " is less or equal to uSNChanged (max = %lld uSNChanged = %lld)\n",
1205 (long long)*seq_num, (long long)db_seq));
1206 return LDB_ERR_OPERATIONS_ERROR;
1210 /* search for the existing replPropertyMetaDataBlob. We need
1211 * to use REVEAL and ask for DNs in storage format to support
1212 * the check for values being the same in
1213 * replmd_update_rpmd_element()
1215 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, attrs,
1216 DSDB_FLAG_NEXT_MODULE |
1217 DSDB_SEARCH_SHOW_RECYCLED |
1218 DSDB_SEARCH_SHOW_EXTENDED_DN |
1219 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
1220 DSDB_SEARCH_REVEAL_INTERNALS);
1221 if (ret != LDB_SUCCESS || res->count != 1) {
1222 DEBUG(0,(__location__ ": Object %s failed to find replPropertyMetaData\n",
1223 ldb_dn_get_linearized(msg->dn)));
1224 return LDB_ERR_OPERATIONS_ERROR;
1227 objectclass_el = ldb_msg_find_element(res->msgs[0], "objectClass");
1228 if (is_urgent && replmd_check_urgent_objectclass(objectclass_el,
1233 omd_value = ldb_msg_find_ldb_val(res->msgs[0], "replPropertyMetaData");
1235 DEBUG(0,(__location__ ": Object %s does not have a replPropertyMetaData attribute\n",
1236 ldb_dn_get_linearized(msg->dn)));
1237 return LDB_ERR_OPERATIONS_ERROR;
1240 ndr_err = ndr_pull_struct_blob(omd_value, msg, &omd,
1241 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
1242 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1243 DEBUG(0,(__location__ ": Failed to parse replPropertyMetaData for %s\n",
1244 ldb_dn_get_linearized(msg->dn)));
1245 return LDB_ERR_OPERATIONS_ERROR;
1248 if (omd.version != 1) {
1249 DEBUG(0,(__location__ ": bad version %u in replPropertyMetaData for %s\n",
1250 omd.version, ldb_dn_get_linearized(msg->dn)));
1251 return LDB_ERR_OPERATIONS_ERROR;
1254 for (i=0; i<msg->num_elements; i++) {
1255 struct ldb_message_element *old_el;
1256 old_el = ldb_msg_find_element(res->msgs[0], msg->elements[i].name);
1257 ret = replmd_update_rpmd_element(ldb, msg, &msg->elements[i], old_el, &omd, schema, seq_num,
1258 our_invocation_id, now);
1259 if (ret != LDB_SUCCESS) {
1263 if (is_urgent && !*is_urgent && (situation == REPL_URGENT_ON_UPDATE)) {
1264 *is_urgent = replmd_check_urgent_attribute(&msg->elements[i]);
1270 * replmd_update_rpmd_element has done an update if the
1273 if (*seq_num != 0) {
1274 struct ldb_val *md_value;
1275 struct ldb_message_element *el;
1277 /*if we are RODC and this is a DRSR update then its ok*/
1278 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1279 ret = samdb_rodc(ldb, &rodc);
1280 if (ret != LDB_SUCCESS) {
1281 DEBUG(4, (__location__ ": unable to tell if we are an RODC\n"));
1283 ldb_asprintf_errstring(ldb, "RODC modify is forbidden\n");
1284 return LDB_ERR_REFERRAL;
1288 md_value = talloc(msg, struct ldb_val);
1289 if (md_value == NULL) {
1291 return LDB_ERR_OPERATIONS_ERROR;
1294 ret = replmd_replPropertyMetaDataCtr1_sort(&omd.ctr.ctr1, schema, msg->dn);
1295 if (ret != LDB_SUCCESS) {
1299 ndr_err = ndr_push_struct_blob(md_value, msg, &omd,
1300 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
1301 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1302 DEBUG(0,(__location__ ": Failed to marshall replPropertyMetaData for %s\n",
1303 ldb_dn_get_linearized(msg->dn)));
1304 return LDB_ERR_OPERATIONS_ERROR;
1307 ret = ldb_msg_add_empty(msg, "replPropertyMetaData", LDB_FLAG_MOD_REPLACE, &el);
1308 if (ret != LDB_SUCCESS) {
1309 DEBUG(0,(__location__ ": Failed to add updated replPropertyMetaData %s\n",
1310 ldb_dn_get_linearized(msg->dn)));
1315 el->values = md_value;
1322 struct dsdb_dn *dsdb_dn;
1327 static int parsed_dn_compare(struct parsed_dn *pdn1, struct parsed_dn *pdn2)
1329 return GUID_compare(pdn1->guid, pdn2->guid);
1332 static struct parsed_dn *parsed_dn_find(struct parsed_dn *pdn, int count, struct GUID *guid, struct ldb_dn *dn)
1334 struct parsed_dn *ret;
1335 if (dn && GUID_all_zero(guid)) {
1336 /* when updating a link using DRS, we sometimes get a
1337 NULL GUID. We then need to try and match by DN */
1339 for (i=0; i<count; i++) {
1340 if (ldb_dn_compare(pdn[i].dsdb_dn->dn, dn) == 0) {
1341 dsdb_get_extended_dn_guid(pdn[i].dsdb_dn->dn, guid, "GUID");
1347 BINARY_ARRAY_SEARCH(pdn, count, guid, guid, GUID_compare, ret);
1352 get a series of message element values as an array of DNs and GUIDs
1353 the result is sorted by GUID
1355 static int get_parsed_dns(struct ldb_module *module, TALLOC_CTX *mem_ctx,
1356 struct ldb_message_element *el, struct parsed_dn **pdn,
1357 const char *ldap_oid)
1360 struct ldb_context *ldb = ldb_module_get_ctx(module);
1367 (*pdn) = talloc_array(mem_ctx, struct parsed_dn, el->num_values);
1369 ldb_module_oom(module);
1370 return LDB_ERR_OPERATIONS_ERROR;
1373 for (i=0; i<el->num_values; i++) {
1374 struct ldb_val *v = &el->values[i];
1377 struct parsed_dn *p;
1381 p->dsdb_dn = dsdb_dn_parse(*pdn, ldb, v, ldap_oid);
1382 if (p->dsdb_dn == NULL) {
1383 return LDB_ERR_INVALID_DN_SYNTAX;
1386 dn = p->dsdb_dn->dn;
1388 p->guid = talloc(*pdn, struct GUID);
1389 if (p->guid == NULL) {
1390 ldb_module_oom(module);
1391 return LDB_ERR_OPERATIONS_ERROR;
1394 status = dsdb_get_extended_dn_guid(dn, p->guid, "GUID");
1395 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1396 /* we got a DN without a GUID - go find the GUID */
1397 int ret = dsdb_module_guid_by_dn(module, dn, p->guid);
1398 if (ret != LDB_SUCCESS) {
1399 ldb_asprintf_errstring(ldb, "Unable to find GUID for DN %s\n",
1400 ldb_dn_get_linearized(dn));
1403 ret = dsdb_set_extended_dn_guid(dn, p->guid, "GUID");
1404 if (ret != LDB_SUCCESS) {
1407 } else if (!NT_STATUS_IS_OK(status)) {
1408 return LDB_ERR_OPERATIONS_ERROR;
1411 /* keep a pointer to the original ldb_val */
1415 TYPESAFE_QSORT(*pdn, el->num_values, parsed_dn_compare);
1421 build a new extended DN, including all meta data fields
1423 RMD_FLAGS = DSDB_RMD_FLAG_* bits
1424 RMD_ADDTIME = originating_add_time
1425 RMD_INVOCID = originating_invocation_id
1426 RMD_CHANGETIME = originating_change_time
1427 RMD_ORIGINATING_USN = originating_usn
1428 RMD_LOCAL_USN = local_usn
1429 RMD_VERSION = version
1431 static int replmd_build_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1432 const struct GUID *invocation_id, uint64_t seq_num,
1433 uint64_t local_usn, NTTIME nttime, uint32_t version, bool deleted)
1435 struct ldb_dn *dn = dsdb_dn->dn;
1436 const char *tstring, *usn_string, *flags_string;
1437 struct ldb_val tval;
1439 struct ldb_val usnv, local_usnv;
1440 struct ldb_val vers, flagsv;
1443 const char *dnstring;
1445 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1447 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1449 return LDB_ERR_OPERATIONS_ERROR;
1451 tval = data_blob_string_const(tstring);
1453 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1455 return LDB_ERR_OPERATIONS_ERROR;
1457 usnv = data_blob_string_const(usn_string);
1459 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1461 return LDB_ERR_OPERATIONS_ERROR;
1463 local_usnv = data_blob_string_const(usn_string);
1465 vstring = talloc_asprintf(mem_ctx, "%lu", (unsigned long)version);
1467 return LDB_ERR_OPERATIONS_ERROR;
1469 vers = data_blob_string_const(vstring);
1471 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1472 if (!NT_STATUS_IS_OK(status)) {
1473 return LDB_ERR_OPERATIONS_ERROR;
1476 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1477 if (!flags_string) {
1478 return LDB_ERR_OPERATIONS_ERROR;
1480 flagsv = data_blob_string_const(flags_string);
1482 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1483 if (ret != LDB_SUCCESS) return ret;
1484 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", &tval);
1485 if (ret != LDB_SUCCESS) return ret;
1486 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1487 if (ret != LDB_SUCCESS) return ret;
1488 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1489 if (ret != LDB_SUCCESS) return ret;
1490 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1491 if (ret != LDB_SUCCESS) return ret;
1492 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1493 if (ret != LDB_SUCCESS) return ret;
1494 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1495 if (ret != LDB_SUCCESS) return ret;
1497 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1498 if (dnstring == NULL) {
1499 return LDB_ERR_OPERATIONS_ERROR;
1501 *v = data_blob_string_const(dnstring);
1506 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1507 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1508 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1509 uint32_t version, bool deleted);
1512 check if any links need upgrading from w2k format
1514 The parent_ctx is the ldb_message_element which contains the values array that dns[i].v points at, and which should be used for allocating any new value.
1516 static int replmd_check_upgrade_links(struct parsed_dn *dns, uint32_t count, struct ldb_message_element *parent_ctx, const struct GUID *invocation_id)
1519 for (i=0; i<count; i++) {
1524 status = dsdb_get_extended_dn_uint32(dns[i].dsdb_dn->dn, &version, "RMD_VERSION");
1525 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1529 /* it's an old one that needs upgrading */
1530 ret = replmd_update_la_val(parent_ctx->values, dns[i].v, dns[i].dsdb_dn, dns[i].dsdb_dn, invocation_id,
1532 if (ret != LDB_SUCCESS) {
1540 update an extended DN, including all meta data fields
1542 see replmd_build_la_val for value names
1544 static int replmd_update_la_val(TALLOC_CTX *mem_ctx, struct ldb_val *v, struct dsdb_dn *dsdb_dn,
1545 struct dsdb_dn *old_dsdb_dn, const struct GUID *invocation_id,
1546 uint64_t seq_num, uint64_t local_usn, NTTIME nttime,
1547 uint32_t version, bool deleted)
1549 struct ldb_dn *dn = dsdb_dn->dn;
1550 const char *tstring, *usn_string, *flags_string;
1551 struct ldb_val tval;
1553 struct ldb_val usnv, local_usnv;
1554 struct ldb_val vers, flagsv;
1555 const struct ldb_val *old_addtime;
1556 uint32_t old_version;
1559 const char *dnstring;
1561 uint32_t rmd_flags = deleted?DSDB_RMD_FLAG_DELETED:0;
1563 tstring = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)nttime);
1565 return LDB_ERR_OPERATIONS_ERROR;
1567 tval = data_blob_string_const(tstring);
1569 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)seq_num);
1571 return LDB_ERR_OPERATIONS_ERROR;
1573 usnv = data_blob_string_const(usn_string);
1575 usn_string = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)local_usn);
1577 return LDB_ERR_OPERATIONS_ERROR;
1579 local_usnv = data_blob_string_const(usn_string);
1581 status = GUID_to_ndr_blob(invocation_id, dn, &iid);
1582 if (!NT_STATUS_IS_OK(status)) {
1583 return LDB_ERR_OPERATIONS_ERROR;
1586 flags_string = talloc_asprintf(mem_ctx, "%u", rmd_flags);
1587 if (!flags_string) {
1588 return LDB_ERR_OPERATIONS_ERROR;
1590 flagsv = data_blob_string_const(flags_string);
1592 ret = ldb_dn_set_extended_component(dn, "RMD_FLAGS", &flagsv);
1593 if (ret != LDB_SUCCESS) return ret;
1595 /* get the ADDTIME from the original */
1596 old_addtime = ldb_dn_get_extended_component(old_dsdb_dn->dn, "RMD_ADDTIME");
1597 if (old_addtime == NULL) {
1598 old_addtime = &tval;
1600 if (dsdb_dn != old_dsdb_dn) {
1601 ret = ldb_dn_set_extended_component(dn, "RMD_ADDTIME", old_addtime);
1602 if (ret != LDB_SUCCESS) return ret;
1605 /* use our invocation id */
1606 ret = ldb_dn_set_extended_component(dn, "RMD_INVOCID", &iid);
1607 if (ret != LDB_SUCCESS) return ret;
1609 /* changetime is the current time */
1610 ret = ldb_dn_set_extended_component(dn, "RMD_CHANGETIME", &tval);
1611 if (ret != LDB_SUCCESS) return ret;
1613 /* update the USN */
1614 ret = ldb_dn_set_extended_component(dn, "RMD_ORIGINATING_USN", &usnv);
1615 if (ret != LDB_SUCCESS) return ret;
1617 ret = ldb_dn_set_extended_component(dn, "RMD_LOCAL_USN", &local_usnv);
1618 if (ret != LDB_SUCCESS) return ret;
1620 /* increase the version by 1 */
1621 status = dsdb_get_extended_dn_uint32(old_dsdb_dn->dn, &old_version, "RMD_VERSION");
1622 if (NT_STATUS_IS_OK(status) && old_version >= version) {
1623 version = old_version+1;
1625 vstring = talloc_asprintf(dn, "%lu", (unsigned long)version);
1626 vers = data_blob_string_const(vstring);
1627 ret = ldb_dn_set_extended_component(dn, "RMD_VERSION", &vers);
1628 if (ret != LDB_SUCCESS) return ret;
1630 dnstring = dsdb_dn_get_extended_linearized(mem_ctx, dsdb_dn, 1);
1631 if (dnstring == NULL) {
1632 return LDB_ERR_OPERATIONS_ERROR;
1634 *v = data_blob_string_const(dnstring);
1640 handle adding a linked attribute
1642 static int replmd_modify_la_add(struct ldb_module *module,
1643 const struct dsdb_schema *schema,
1644 struct ldb_message *msg,
1645 struct ldb_message_element *el,
1646 struct ldb_message_element *old_el,
1647 const struct dsdb_attribute *schema_attr,
1650 struct GUID *msg_guid)
1653 struct parsed_dn *dns, *old_dns;
1654 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1656 struct ldb_val *new_values = NULL;
1657 unsigned int num_new_values = 0;
1658 unsigned old_num_values = old_el?old_el->num_values:0;
1659 const struct GUID *invocation_id;
1660 struct ldb_context *ldb = ldb_module_get_ctx(module);
1663 unix_to_nt_time(&now, t);
1665 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1666 if (ret != LDB_SUCCESS) {
1667 talloc_free(tmp_ctx);
1671 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1672 if (ret != LDB_SUCCESS) {
1673 talloc_free(tmp_ctx);
1677 invocation_id = samdb_ntds_invocation_id(ldb);
1678 if (!invocation_id) {
1679 talloc_free(tmp_ctx);
1680 return LDB_ERR_OPERATIONS_ERROR;
1683 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1684 if (ret != LDB_SUCCESS) {
1685 talloc_free(tmp_ctx);
1689 /* for each new value, see if it exists already with the same GUID */
1690 for (i=0; i<el->num_values; i++) {
1691 struct parsed_dn *p = parsed_dn_find(old_dns, old_num_values, dns[i].guid, NULL);
1693 /* this is a new linked attribute value */
1694 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val, num_new_values+1);
1695 if (new_values == NULL) {
1696 ldb_module_oom(module);
1697 talloc_free(tmp_ctx);
1698 return LDB_ERR_OPERATIONS_ERROR;
1700 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1701 invocation_id, seq_num, seq_num, now, 0, false);
1702 if (ret != LDB_SUCCESS) {
1703 talloc_free(tmp_ctx);
1708 /* this is only allowed if the GUID was
1709 previously deleted. */
1710 uint32_t rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1712 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
1713 ldb_asprintf_errstring(ldb, "Attribute %s already exists for target GUID %s",
1714 el->name, GUID_string(tmp_ctx, p->guid));
1715 talloc_free(tmp_ctx);
1716 return LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS;
1718 ret = replmd_update_la_val(old_el->values, p->v, dns[i].dsdb_dn, p->dsdb_dn,
1719 invocation_id, seq_num, seq_num, now, 0, false);
1720 if (ret != LDB_SUCCESS) {
1721 talloc_free(tmp_ctx);
1726 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, true);
1727 if (ret != LDB_SUCCESS) {
1728 talloc_free(tmp_ctx);
1733 /* add the new ones on to the end of the old values, constructing a new el->values */
1734 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
1736 old_num_values+num_new_values);
1737 if (el->values == NULL) {
1738 ldb_module_oom(module);
1739 return LDB_ERR_OPERATIONS_ERROR;
1742 memcpy(&el->values[old_num_values], new_values, num_new_values*sizeof(struct ldb_val));
1743 el->num_values = old_num_values + num_new_values;
1745 talloc_steal(msg->elements, el->values);
1746 talloc_steal(el->values, new_values);
1748 talloc_free(tmp_ctx);
1750 /* we now tell the backend to replace all existing values
1751 with the one we have constructed */
1752 el->flags = LDB_FLAG_MOD_REPLACE;
1759 handle deleting all active linked attributes
1761 static int replmd_modify_la_delete(struct ldb_module *module,
1762 const struct dsdb_schema *schema,
1763 struct ldb_message *msg,
1764 struct ldb_message_element *el,
1765 struct ldb_message_element *old_el,
1766 const struct dsdb_attribute *schema_attr,
1769 struct GUID *msg_guid)
1772 struct parsed_dn *dns, *old_dns;
1773 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1775 const struct GUID *invocation_id;
1776 struct ldb_context *ldb = ldb_module_get_ctx(module);
1779 unix_to_nt_time(&now, t);
1781 /* check if there is nothing to delete */
1782 if ((!old_el || old_el->num_values == 0) &&
1783 el->num_values == 0) {
1787 if (!old_el || old_el->num_values == 0) {
1788 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1791 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1792 if (ret != LDB_SUCCESS) {
1793 talloc_free(tmp_ctx);
1797 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1798 if (ret != LDB_SUCCESS) {
1799 talloc_free(tmp_ctx);
1803 invocation_id = samdb_ntds_invocation_id(ldb);
1804 if (!invocation_id) {
1805 return LDB_ERR_OPERATIONS_ERROR;
1808 ret = replmd_check_upgrade_links(old_dns, old_el->num_values, old_el, invocation_id);
1809 if (ret != LDB_SUCCESS) {
1810 talloc_free(tmp_ctx);
1816 /* see if we are being asked to delete any links that
1817 don't exist or are already deleted */
1818 for (i=0; i<el->num_values; i++) {
1819 struct parsed_dn *p = &dns[i];
1820 struct parsed_dn *p2;
1823 p2 = parsed_dn_find(old_dns, old_el->num_values, p->guid, NULL);
1825 ldb_asprintf_errstring(ldb, "Attribute %s doesn't exist for target GUID %s",
1826 el->name, GUID_string(tmp_ctx, p->guid));
1827 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1829 rmd_flags = dsdb_dn_rmd_flags(p2->dsdb_dn->dn);
1830 if (rmd_flags & DSDB_RMD_FLAG_DELETED) {
1831 ldb_asprintf_errstring(ldb, "Attribute %s already deleted for target GUID %s",
1832 el->name, GUID_string(tmp_ctx, p->guid));
1833 return LDB_ERR_NO_SUCH_ATTRIBUTE;
1837 /* for each new value, see if it exists already with the same GUID
1838 if it is not already deleted and matches the delete list then delete it
1840 for (i=0; i<old_el->num_values; i++) {
1841 struct parsed_dn *p = &old_dns[i];
1844 if (el->num_values && parsed_dn_find(dns, el->num_values, p->guid, NULL) == NULL) {
1848 rmd_flags = dsdb_dn_rmd_flags(p->dsdb_dn->dn);
1849 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1851 ret = replmd_update_la_val(old_el->values, p->v, p->dsdb_dn, p->dsdb_dn,
1852 invocation_id, seq_num, seq_num, now, 0, true);
1853 if (ret != LDB_SUCCESS) {
1854 talloc_free(tmp_ctx);
1858 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, true);
1859 if (ret != LDB_SUCCESS) {
1860 talloc_free(tmp_ctx);
1865 el->values = talloc_steal(msg->elements, old_el->values);
1866 el->num_values = old_el->num_values;
1868 talloc_free(tmp_ctx);
1870 /* we now tell the backend to replace all existing values
1871 with the one we have constructed */
1872 el->flags = LDB_FLAG_MOD_REPLACE;
1878 handle replacing a linked attribute
1880 static int replmd_modify_la_replace(struct ldb_module *module,
1881 const struct dsdb_schema *schema,
1882 struct ldb_message *msg,
1883 struct ldb_message_element *el,
1884 struct ldb_message_element *old_el,
1885 const struct dsdb_attribute *schema_attr,
1888 struct GUID *msg_guid)
1891 struct parsed_dn *dns, *old_dns;
1892 TALLOC_CTX *tmp_ctx = talloc_new(msg);
1894 const struct GUID *invocation_id;
1895 struct ldb_context *ldb = ldb_module_get_ctx(module);
1896 struct ldb_val *new_values = NULL;
1897 unsigned int num_new_values = 0;
1898 unsigned int old_num_values = old_el?old_el->num_values:0;
1901 unix_to_nt_time(&now, t);
1903 /* check if there is nothing to replace */
1904 if ((!old_el || old_el->num_values == 0) &&
1905 el->num_values == 0) {
1909 ret = get_parsed_dns(module, tmp_ctx, el, &dns, schema_attr->syntax->ldap_oid);
1910 if (ret != LDB_SUCCESS) {
1911 talloc_free(tmp_ctx);
1915 ret = get_parsed_dns(module, tmp_ctx, old_el, &old_dns, schema_attr->syntax->ldap_oid);
1916 if (ret != LDB_SUCCESS) {
1917 talloc_free(tmp_ctx);
1921 invocation_id = samdb_ntds_invocation_id(ldb);
1922 if (!invocation_id) {
1923 return LDB_ERR_OPERATIONS_ERROR;
1926 ret = replmd_check_upgrade_links(old_dns, old_num_values, old_el, invocation_id);
1927 if (ret != LDB_SUCCESS) {
1928 talloc_free(tmp_ctx);
1932 /* mark all the old ones as deleted */
1933 for (i=0; i<old_num_values; i++) {
1934 struct parsed_dn *old_p = &old_dns[i];
1935 struct parsed_dn *p;
1936 uint32_t rmd_flags = dsdb_dn_rmd_flags(old_p->dsdb_dn->dn);
1938 if (rmd_flags & DSDB_RMD_FLAG_DELETED) continue;
1940 ret = replmd_add_backlink(module, schema, msg_guid, old_dns[i].guid, false, schema_attr, false);
1941 if (ret != LDB_SUCCESS) {
1942 talloc_free(tmp_ctx);
1946 p = parsed_dn_find(dns, el->num_values, old_p->guid, NULL);
1948 /* we don't delete it if we are re-adding it */
1952 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn, old_p->dsdb_dn,
1953 invocation_id, seq_num, seq_num, now, 0, true);
1954 if (ret != LDB_SUCCESS) {
1955 talloc_free(tmp_ctx);
1960 /* for each new value, either update its meta-data, or add it
1963 for (i=0; i<el->num_values; i++) {
1964 struct parsed_dn *p = &dns[i], *old_p;
1967 (old_p = parsed_dn_find(old_dns,
1968 old_num_values, p->guid, NULL)) != NULL) {
1969 /* update in place */
1970 ret = replmd_update_la_val(old_el->values, old_p->v, old_p->dsdb_dn,
1971 old_p->dsdb_dn, invocation_id,
1972 seq_num, seq_num, now, 0, false);
1973 if (ret != LDB_SUCCESS) {
1974 talloc_free(tmp_ctx);
1979 new_values = talloc_realloc(tmp_ctx, new_values, struct ldb_val,
1981 if (new_values == NULL) {
1982 ldb_module_oom(module);
1983 talloc_free(tmp_ctx);
1984 return LDB_ERR_OPERATIONS_ERROR;
1986 ret = replmd_build_la_val(new_values, &new_values[num_new_values], dns[i].dsdb_dn,
1987 invocation_id, seq_num, seq_num, now, 0, false);
1988 if (ret != LDB_SUCCESS) {
1989 talloc_free(tmp_ctx);
1995 ret = replmd_add_backlink(module, schema, msg_guid, dns[i].guid, true, schema_attr, false);
1996 if (ret != LDB_SUCCESS) {
1997 talloc_free(tmp_ctx);
2002 /* add the new values to the end of old_el */
2003 if (num_new_values != 0) {
2004 el->values = talloc_realloc(msg->elements, old_el?old_el->values:NULL,
2005 struct ldb_val, old_num_values+num_new_values);
2006 if (el->values == NULL) {
2007 ldb_module_oom(module);
2008 return LDB_ERR_OPERATIONS_ERROR;
2010 memcpy(&el->values[old_num_values], &new_values[0],
2011 sizeof(struct ldb_val)*num_new_values);
2012 el->num_values = old_num_values + num_new_values;
2013 talloc_steal(msg->elements, new_values);
2015 el->values = old_el->values;
2016 el->num_values = old_el->num_values;
2017 talloc_steal(msg->elements, el->values);
2020 talloc_free(tmp_ctx);
2022 /* we now tell the backend to replace all existing values
2023 with the one we have constructed */
2024 el->flags = LDB_FLAG_MOD_REPLACE;
2031 handle linked attributes in modify requests
2033 static int replmd_modify_handle_linked_attribs(struct ldb_module *module,
2034 struct ldb_message *msg,
2035 uint64_t seq_num, time_t t)
2037 struct ldb_result *res;
2040 struct ldb_context *ldb = ldb_module_get_ctx(module);
2041 struct ldb_message *old_msg;
2043 const struct dsdb_schema *schema;
2044 struct GUID old_guid;
2047 /* there the replmd_update_rpmd code has already
2048 * checked and saw that there are no linked
2053 if (dsdb_functional_level(ldb) == DS_DOMAIN_FUNCTION_2000) {
2054 /* don't do anything special for linked attributes */
2058 ret = dsdb_module_search_dn(module, msg, &res, msg->dn, NULL,
2059 DSDB_FLAG_NEXT_MODULE |
2060 DSDB_SEARCH_SHOW_RECYCLED |
2061 DSDB_SEARCH_REVEAL_INTERNALS |
2062 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2063 if (ret != LDB_SUCCESS) {
2066 schema = dsdb_get_schema(ldb, res);
2068 return LDB_ERR_OPERATIONS_ERROR;
2071 old_msg = res->msgs[0];
2073 old_guid = samdb_result_guid(old_msg, "objectGUID");
2075 for (i=0; i<msg->num_elements; i++) {
2076 struct ldb_message_element *el = &msg->elements[i];
2077 struct ldb_message_element *old_el, *new_el;
2078 const struct dsdb_attribute *schema_attr
2079 = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2081 ldb_asprintf_errstring(ldb,
2082 "attribute %s is not a valid attribute in schema", el->name);
2083 return LDB_ERR_OBJECT_CLASS_VIOLATION;
2085 if (schema_attr->linkID == 0) {
2088 if ((schema_attr->linkID & 1) == 1) {
2089 /* Odd is for the target. Illegal to modify */
2090 ldb_asprintf_errstring(ldb,
2091 "attribute %s must not be modified directly, it is a linked attribute", el->name);
2092 return LDB_ERR_UNWILLING_TO_PERFORM;
2094 old_el = ldb_msg_find_element(old_msg, el->name);
2095 switch (el->flags & LDB_FLAG_MOD_MASK) {
2096 case LDB_FLAG_MOD_REPLACE:
2097 ret = replmd_modify_la_replace(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2099 case LDB_FLAG_MOD_DELETE:
2100 ret = replmd_modify_la_delete(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2102 case LDB_FLAG_MOD_ADD:
2103 ret = replmd_modify_la_add(module, schema, msg, el, old_el, schema_attr, seq_num, t, &old_guid);
2106 ldb_asprintf_errstring(ldb,
2107 "invalid flags 0x%x for %s linked attribute",
2108 el->flags, el->name);
2109 return LDB_ERR_UNWILLING_TO_PERFORM;
2111 if (ret != LDB_SUCCESS) {
2115 ldb_msg_remove_attr(old_msg, el->name);
2117 ldb_msg_add_empty(old_msg, el->name, 0, &new_el);
2118 new_el->num_values = el->num_values;
2119 new_el->values = talloc_steal(msg->elements, el->values);
2121 /* TODO: this relises a bit too heavily on the exact
2122 behaviour of ldb_msg_find_element and
2123 ldb_msg_remove_element */
2124 old_el = ldb_msg_find_element(msg, el->name);
2126 ldb_msg_remove_element(msg, old_el);
2137 static int replmd_modify(struct ldb_module *module, struct ldb_request *req)
2139 struct ldb_context *ldb;
2140 struct replmd_replicated_request *ac;
2141 struct ldb_request *down_req;
2142 struct ldb_message *msg;
2143 time_t t = time(NULL);
2145 bool is_urgent = false;
2146 struct loadparm_context *lp_ctx;
2148 unsigned int functional_level;
2149 const DATA_BLOB *guid_blob;
2151 /* do not manipulate our control entries */
2152 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2153 return ldb_next_request(module, req);
2156 ldb = ldb_module_get_ctx(module);
2158 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_modify\n");
2160 guid_blob = ldb_msg_find_ldb_val(req->op.mod.message, "objectGUID");
2161 if ( guid_blob != NULL ) {
2162 ldb_set_errstring(ldb,
2163 "replmd_modify: it's not allowed to change the objectGUID!");
2164 return LDB_ERR_CONSTRAINT_VIOLATION;
2167 ac = replmd_ctx_init(module, req);
2169 return ldb_module_oom(module);
2172 functional_level = dsdb_functional_level(ldb);
2174 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2175 struct loadparm_context);
2177 /* we have to copy the message as the caller might have it as a const */
2178 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2182 return LDB_ERR_OPERATIONS_ERROR;
2185 ldb_msg_remove_attr(msg, "whenChanged");
2186 ldb_msg_remove_attr(msg, "uSNChanged");
2188 ret = replmd_update_rpmd(module, ac->schema, req, msg, &ac->seq_num, t, &is_urgent);
2189 if (ret == LDB_ERR_REFERRAL) {
2190 referral = talloc_asprintf(req,
2192 lpcfg_dnsdomain(lp_ctx),
2193 ldb_dn_get_linearized(msg->dn));
2194 ret = ldb_module_send_referral(req, referral);
2196 return ldb_module_done(req, NULL, NULL, ret);
2199 if (ret != LDB_SUCCESS) {
2204 ret = replmd_modify_handle_linked_attribs(module, msg, ac->seq_num, t);
2205 if (ret != LDB_SUCCESS) {
2211 * - replace the old object with the newly constructed one
2214 ac->is_urgent = is_urgent;
2216 ret = ldb_build_mod_req(&down_req, ldb, ac,
2219 ac, replmd_op_callback,
2221 LDB_REQ_SET_LOCATION(down_req);
2222 if (ret != LDB_SUCCESS) {
2227 /* If we are in functional level 2000, then
2228 * replmd_modify_handle_linked_attribs will have done
2230 if (functional_level == DS_DOMAIN_FUNCTION_2000) {
2231 ret = ldb_request_add_control(down_req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
2232 if (ret != LDB_SUCCESS) {
2238 talloc_steal(down_req, msg);
2240 /* we only change whenChanged and uSNChanged if the seq_num
2242 if (ac->seq_num != 0) {
2243 ret = add_time_element(msg, "whenChanged", t);
2244 if (ret != LDB_SUCCESS) {
2249 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2250 if (ret != LDB_SUCCESS) {
2256 /* go on with the call chain */
2257 return ldb_next_request(module, down_req);
2260 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares);
2263 handle a rename request
2265 On a rename we need to do an extra ldb_modify which sets the
2266 whenChanged and uSNChanged attributes. We do this in a callback after the success.
2268 static int replmd_rename(struct ldb_module *module, struct ldb_request *req)
2270 struct ldb_context *ldb;
2271 struct replmd_replicated_request *ac;
2273 struct ldb_request *down_req;
2275 /* do not manipulate our control entries */
2276 if (ldb_dn_is_special(req->op.mod.message->dn)) {
2277 return ldb_next_request(module, req);
2280 ldb = ldb_module_get_ctx(module);
2282 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_rename\n");
2284 ac = replmd_ctx_init(module, req);
2286 return ldb_module_oom(module);
2289 ret = ldb_build_rename_req(&down_req, ldb, ac,
2290 ac->req->op.rename.olddn,
2291 ac->req->op.rename.newdn,
2293 ac, replmd_rename_callback,
2295 LDB_REQ_SET_LOCATION(down_req);
2296 if (ret != LDB_SUCCESS) {
2301 /* go on with the call chain */
2302 return ldb_next_request(module, down_req);
2305 /* After the rename is compleated, update the whenchanged etc */
2306 static int replmd_rename_callback(struct ldb_request *req, struct ldb_reply *ares)
2308 struct ldb_context *ldb;
2309 struct replmd_replicated_request *ac;
2310 struct ldb_request *down_req;
2311 struct ldb_message *msg;
2312 time_t t = time(NULL);
2315 ac = talloc_get_type(req->context, struct replmd_replicated_request);
2316 ldb = ldb_module_get_ctx(ac->module);
2318 if (ares->error != LDB_SUCCESS) {
2319 return ldb_module_done(ac->req, ares->controls,
2320 ares->response, ares->error);
2323 if (ares->type != LDB_REPLY_DONE) {
2324 ldb_set_errstring(ldb,
2325 "invalid ldb_reply_type in callback");
2327 return ldb_module_done(ac->req, NULL, NULL,
2328 LDB_ERR_OPERATIONS_ERROR);
2331 /* Get a sequence number from the backend */
2332 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ac->seq_num);
2333 if (ret != LDB_SUCCESS) {
2338 * - replace the old object with the newly constructed one
2341 msg = ldb_msg_new(ac);
2344 return LDB_ERR_OPERATIONS_ERROR;
2347 msg->dn = ac->req->op.rename.newdn;
2349 ret = ldb_build_mod_req(&down_req, ldb, ac,
2352 ac, replmd_op_callback,
2354 LDB_REQ_SET_LOCATION(down_req);
2355 if (ret != LDB_SUCCESS) {
2359 talloc_steal(down_req, msg);
2361 ret = add_time_element(msg, "whenChanged", t);
2362 if (ret != LDB_SUCCESS) {
2367 ret = add_uint64_element(ldb, msg, "uSNChanged", ac->seq_num);
2368 if (ret != LDB_SUCCESS) {
2373 /* go on with the call chain - do the modify after the rename */
2374 return ldb_next_request(ac->module, down_req);
2378 remove links from objects that point at this object when an object
2381 static int replmd_delete_remove_link(struct ldb_module *module,
2382 const struct dsdb_schema *schema,
2384 struct ldb_message_element *el,
2385 const struct dsdb_attribute *sa)
2388 TALLOC_CTX *tmp_ctx = talloc_new(module);
2389 struct ldb_context *ldb = ldb_module_get_ctx(module);
2391 for (i=0; i<el->num_values; i++) {
2392 struct dsdb_dn *dsdb_dn;
2396 struct ldb_message *msg;
2397 const struct dsdb_attribute *target_attr;
2398 struct ldb_message_element *el2;
2399 struct ldb_val dn_val;
2401 if (dsdb_dn_is_deleted_val(&el->values[i])) {
2405 dsdb_dn = dsdb_dn_parse(tmp_ctx, ldb, &el->values[i], sa->syntax->ldap_oid);
2407 talloc_free(tmp_ctx);
2408 return LDB_ERR_OPERATIONS_ERROR;
2411 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid2, "GUID");
2412 if (!NT_STATUS_IS_OK(status)) {
2413 talloc_free(tmp_ctx);
2414 return LDB_ERR_OPERATIONS_ERROR;
2417 /* remove the link */
2418 msg = ldb_msg_new(tmp_ctx);
2420 ldb_module_oom(module);
2421 talloc_free(tmp_ctx);
2422 return LDB_ERR_OPERATIONS_ERROR;
2426 msg->dn = dsdb_dn->dn;
2428 target_attr = dsdb_attribute_by_linkID(schema, sa->linkID ^ 1);
2429 if (target_attr == NULL) {
2433 ret = ldb_msg_add_empty(msg, target_attr->lDAPDisplayName, LDB_FLAG_MOD_DELETE, &el2);
2434 if (ret != LDB_SUCCESS) {
2435 ldb_module_oom(module);
2436 talloc_free(tmp_ctx);
2437 return LDB_ERR_OPERATIONS_ERROR;
2439 dn_val = data_blob_string_const(ldb_dn_get_linearized(dn));
2440 el2->values = &dn_val;
2441 el2->num_values = 1;
2443 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2444 if (ret != LDB_SUCCESS) {
2445 talloc_free(tmp_ctx);
2449 talloc_free(tmp_ctx);
2455 handle update of replication meta data for deletion of objects
2457 This also handles the mapping of delete to a rename operation
2458 to allow deletes to be replicated.
2460 static int replmd_delete(struct ldb_module *module, struct ldb_request *req)
2462 int ret = LDB_ERR_OTHER;
2463 bool retb, disallow_move_on_delete;
2464 struct ldb_dn *old_dn, *new_dn;
2465 const char *rdn_name;
2466 const struct ldb_val *rdn_value, *new_rdn_value;
2468 struct ldb_context *ldb = ldb_module_get_ctx(module);
2469 const struct dsdb_schema *schema;
2470 struct ldb_message *msg, *old_msg;
2471 struct ldb_message_element *el;
2472 TALLOC_CTX *tmp_ctx;
2473 struct ldb_result *res, *parent_res;
2474 const char *preserved_attrs[] = {
2475 /* yes, this really is a hard coded list. See MS-ADTS
2476 section 3.1.1.5.5.1.1 */
2477 "nTSecurityDescriptor", "attributeID", "attributeSyntax", "dNReferenceUpdate", "dNSHostName",
2478 "flatName", "governsID", "groupType", "instanceType", "lDAPDisplayName", "legacyExchangeDN",
2479 "isDeleted", "isRecycled", "lastKnownParent", "msDS-LastKnownRDN", "mS-DS-CreatorSID",
2480 "mSMQOwnerID", "nCName", "objectClass", "distinguishedName", "objectGUID", "objectSid",
2481 "oMSyntax", "proxiedObjectName", "name", "replPropertyMetaData", "sAMAccountName",
2482 "securityIdentifier", "sIDHistory", "subClassOf", "systemFlags", "trustPartner", "trustDirection",
2483 "trustType", "trustAttributes", "userAccountControl", "uSNChanged", "uSNCreated", "whenCreated",
2484 "whenChanged", NULL};
2485 unsigned int i, el_count = 0;
2486 enum deletion_state { OBJECT_NOT_DELETED=1, OBJECT_DELETED=2, OBJECT_RECYCLED=3,
2487 OBJECT_TOMBSTONE=4, OBJECT_REMOVED=5 };
2488 enum deletion_state deletion_state, next_deletion_state;
2491 if (ldb_dn_is_special(req->op.del.dn)) {
2492 return ldb_next_request(module, req);
2495 tmp_ctx = talloc_new(ldb);
2498 return LDB_ERR_OPERATIONS_ERROR;
2501 schema = dsdb_get_schema(ldb, tmp_ctx);
2503 return LDB_ERR_OPERATIONS_ERROR;
2506 old_dn = ldb_dn_copy(tmp_ctx, req->op.del.dn);
2508 /* we need the complete msg off disk, so we can work out which
2509 attributes need to be removed */
2510 ret = dsdb_module_search_dn(module, tmp_ctx, &res, old_dn, NULL,
2511 DSDB_FLAG_NEXT_MODULE |
2512 DSDB_SEARCH_SHOW_RECYCLED |
2513 DSDB_SEARCH_REVEAL_INTERNALS |
2514 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
2515 if (ret != LDB_SUCCESS) {
2516 talloc_free(tmp_ctx);
2519 old_msg = res->msgs[0];
2522 ret = dsdb_recyclebin_enabled(module, &enabled);
2523 if (ret != LDB_SUCCESS) {
2524 talloc_free(tmp_ctx);
2528 if (ldb_msg_check_string_attribute(old_msg, "isDeleted", "TRUE")) {
2530 deletion_state = OBJECT_TOMBSTONE;
2531 next_deletion_state = OBJECT_REMOVED;
2532 } else if (ldb_msg_check_string_attribute(old_msg, "isRecycled", "TRUE")) {
2533 deletion_state = OBJECT_RECYCLED;
2534 next_deletion_state = OBJECT_REMOVED;
2536 deletion_state = OBJECT_DELETED;
2537 next_deletion_state = OBJECT_RECYCLED;
2540 deletion_state = OBJECT_NOT_DELETED;
2542 next_deletion_state = OBJECT_DELETED;
2544 next_deletion_state = OBJECT_TOMBSTONE;
2548 if (next_deletion_state == OBJECT_REMOVED) {
2549 struct auth_session_info *session_info =
2550 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
2551 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
2552 ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
2553 ldb_dn_get_linearized(old_msg->dn));
2554 return LDB_ERR_UNWILLING_TO_PERFORM;
2557 /* it is already deleted - really remove it this time */
2558 talloc_free(tmp_ctx);
2559 return ldb_next_request(module, req);
2562 rdn_name = ldb_dn_get_rdn_name(old_dn);
2563 rdn_value = ldb_dn_get_rdn_val(old_dn);
2564 if ((rdn_name == NULL) || (rdn_value == NULL)) {
2565 talloc_free(tmp_ctx);
2566 return ldb_operr(ldb);
2569 msg = ldb_msg_new(tmp_ctx);
2571 ldb_module_oom(module);
2572 talloc_free(tmp_ctx);
2573 return LDB_ERR_OPERATIONS_ERROR;
2578 if (deletion_state == OBJECT_NOT_DELETED){
2579 /* consider the SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE flag */
2580 disallow_move_on_delete =
2581 (ldb_msg_find_attr_as_int(old_msg, "systemFlags", 0)
2582 & SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
2584 /* work out where we will be renaming this object to */
2585 if (!disallow_move_on_delete) {
2586 ret = dsdb_get_deleted_objects_dn(ldb, tmp_ctx, old_dn,
2588 if (ret != LDB_SUCCESS) {
2589 /* this is probably an attempted delete on a partition
2590 * that doesn't allow delete operations, such as the
2591 * schema partition */
2592 ldb_asprintf_errstring(ldb, "No Deleted Objects container for DN %s",
2593 ldb_dn_get_linearized(old_dn));
2594 talloc_free(tmp_ctx);
2595 return LDB_ERR_UNWILLING_TO_PERFORM;
2598 new_dn = ldb_dn_get_parent(tmp_ctx, old_dn);
2599 if (new_dn == NULL) {
2600 ldb_module_oom(module);
2601 talloc_free(tmp_ctx);
2602 return LDB_ERR_OPERATIONS_ERROR;
2606 /* get the objects GUID from the search we just did */
2607 guid = samdb_result_guid(old_msg, "objectGUID");
2609 /* Add a formatted child */
2610 retb = ldb_dn_add_child_fmt(new_dn, "%s=%s\\0ADEL:%s",
2612 ldb_dn_escape_value(tmp_ctx, *rdn_value),
2613 GUID_string(tmp_ctx, &guid));
2615 DEBUG(0,(__location__ ": Unable to add a formatted child to dn: %s",
2616 ldb_dn_get_linearized(new_dn)));
2617 talloc_free(tmp_ctx);
2618 return LDB_ERR_OPERATIONS_ERROR;
2621 ret = ldb_msg_add_string(msg, "isDeleted", "TRUE");
2622 if (ret != LDB_SUCCESS) {
2623 DEBUG(0,(__location__ ": Failed to add isDeleted string to the msg\n"));
2624 ldb_module_oom(module);
2625 talloc_free(tmp_ctx);
2628 msg->elements[el_count++].flags = LDB_FLAG_MOD_REPLACE;
2632 now we need to modify the object in the following ways:
2634 - add isDeleted=TRUE
2635 - update rDN and name, with new rDN
2636 - remove linked attributes
2637 - remove objectCategory and sAMAccountType
2638 - remove attribs not on the preserved list
2639 - preserved if in above list, or is rDN
2640 - remove all linked attribs from this object
2641 - remove all links from other objects to this object
2642 - add lastKnownParent
2643 - update replPropertyMetaData?
2645 see MS-ADTS "Tombstone Requirements" section 3.1.1.5.5.1.1
2648 /* we need the storage form of the parent GUID */
2649 ret = dsdb_module_search_dn(module, tmp_ctx, &parent_res,
2650 ldb_dn_get_parent(tmp_ctx, old_dn), NULL,
2651 DSDB_FLAG_NEXT_MODULE |
2652 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
2653 DSDB_SEARCH_REVEAL_INTERNALS|
2654 DSDB_SEARCH_SHOW_RECYCLED);
2655 if (ret != LDB_SUCCESS) {
2656 talloc_free(tmp_ctx);
2660 if (deletion_state == OBJECT_NOT_DELETED){
2661 ret = ldb_msg_add_steal_string(msg, "lastKnownParent",
2662 ldb_dn_get_extended_linearized(tmp_ctx, parent_res->msgs[0]->dn, 1));
2663 if (ret != LDB_SUCCESS) {
2664 DEBUG(0,(__location__ ": Failed to add lastKnownParent string to the msg\n"));
2665 ldb_module_oom(module);
2666 talloc_free(tmp_ctx);
2669 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2672 switch (next_deletion_state){
2674 case OBJECT_DELETED:
2676 ret = ldb_msg_add_value(msg, "msDS-LastKnownRDN", rdn_value, NULL);
2677 if (ret != LDB_SUCCESS) {
2678 DEBUG(0,(__location__ ": Failed to add msDS-LastKnownRDN string to the msg\n"));
2679 ldb_module_oom(module);
2680 talloc_free(tmp_ctx);
2683 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2685 ret = ldb_msg_add_empty(msg, "objectCategory", LDB_FLAG_MOD_DELETE, NULL);
2686 if (ret != LDB_SUCCESS) {
2687 talloc_free(tmp_ctx);
2688 ldb_module_oom(module);
2692 ret = ldb_msg_add_empty(msg, "sAMAccountType", LDB_FLAG_MOD_DELETE, NULL);
2693 if (ret != LDB_SUCCESS) {
2694 talloc_free(tmp_ctx);
2695 ldb_module_oom(module);
2701 case OBJECT_RECYCLED:
2702 case OBJECT_TOMBSTONE:
2704 /* we also mark it as recycled, meaning this object can't be
2705 recovered (we are stripping its attributes) */
2706 if (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008_R2) {
2707 ret = ldb_msg_add_string(msg, "isRecycled", "TRUE");
2708 if (ret != LDB_SUCCESS) {
2709 DEBUG(0,(__location__ ": Failed to add isRecycled string to the msg\n"));
2710 ldb_module_oom(module);
2711 talloc_free(tmp_ctx);
2714 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
2717 /* work out which of the old attributes we will be removing */
2718 for (i=0; i<old_msg->num_elements; i++) {
2719 const struct dsdb_attribute *sa;
2720 el = &old_msg->elements[i];
2721 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
2723 talloc_free(tmp_ctx);
2724 return LDB_ERR_OPERATIONS_ERROR;
2726 if (ldb_attr_cmp(el->name, rdn_name) == 0) {
2727 /* don't remove the rDN */
2730 if (sa->linkID && sa->linkID & 1) {
2731 ret = replmd_delete_remove_link(module, schema, old_dn, el, sa);
2732 if (ret != LDB_SUCCESS) {
2733 talloc_free(tmp_ctx);
2734 return LDB_ERR_OPERATIONS_ERROR;
2738 if (!sa->linkID && ldb_attr_in_list(preserved_attrs, el->name)) {
2741 ret = ldb_msg_add_empty(msg, el->name, LDB_FLAG_MOD_DELETE, &el);
2742 if (ret != LDB_SUCCESS) {
2743 talloc_free(tmp_ctx);
2744 ldb_module_oom(module);
2754 if (deletion_state == OBJECT_NOT_DELETED) {
2755 const struct dsdb_attribute *sa;
2757 /* work out what the new rdn value is, for updating the
2758 rDN and name fields */
2759 new_rdn_value = ldb_dn_get_rdn_val(new_dn);
2760 if (new_rdn_value == NULL) {
2761 talloc_free(tmp_ctx);
2762 return ldb_operr(ldb);
2765 sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn_name);
2767 talloc_free(tmp_ctx);
2768 return LDB_ERR_OPERATIONS_ERROR;
2771 ret = ldb_msg_add_value(msg, sa->lDAPDisplayName, new_rdn_value,
2773 if (ret != LDB_SUCCESS) {
2774 talloc_free(tmp_ctx);
2777 el->flags = LDB_FLAG_MOD_REPLACE;
2779 el = ldb_msg_find_element(old_msg, "name");
2781 ret = ldb_msg_add_value(msg, "name", new_rdn_value, &el);
2782 if (ret != LDB_SUCCESS) {
2783 talloc_free(tmp_ctx);
2786 el->flags = LDB_FLAG_MOD_REPLACE;
2790 ret = dsdb_module_modify(module, msg, DSDB_FLAG_OWN_MODULE);
2791 if (ret != LDB_SUCCESS) {
2792 ldb_asprintf_errstring(ldb, "replmd_delete: Failed to modify object %s in delete - %s",
2793 ldb_dn_get_linearized(old_dn), ldb_errstring(ldb));
2794 talloc_free(tmp_ctx);
2798 if (deletion_state == OBJECT_NOT_DELETED) {
2799 /* now rename onto the new DN */
2800 ret = dsdb_module_rename(module, old_dn, new_dn, DSDB_FLAG_NEXT_MODULE);
2801 if (ret != LDB_SUCCESS){
2802 DEBUG(0,(__location__ ": Failed to rename object from '%s' to '%s' - %s\n",
2803 ldb_dn_get_linearized(old_dn),
2804 ldb_dn_get_linearized(new_dn),
2805 ldb_errstring(ldb)));
2806 talloc_free(tmp_ctx);
2811 talloc_free(tmp_ctx);
2813 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
2818 static int replmd_replicated_request_error(struct replmd_replicated_request *ar, int ret)
2823 static int replmd_replicated_request_werror(struct replmd_replicated_request *ar, WERROR status)
2825 int ret = LDB_ERR_OTHER;
2826 /* TODO: do some error mapping */
2830 static int replmd_replicated_apply_add(struct replmd_replicated_request *ar)
2832 struct ldb_context *ldb;
2833 struct ldb_request *change_req;
2834 enum ndr_err_code ndr_err;
2835 struct ldb_message *msg;
2836 struct replPropertyMetaDataBlob *md;
2837 struct ldb_val md_value;
2842 * TODO: check if the parent object exist
2846 * TODO: handle the conflict case where an object with the
2850 ldb = ldb_module_get_ctx(ar->module);
2851 msg = ar->objs->objects[ar->index_current].msg;
2852 md = ar->objs->objects[ar->index_current].meta_data;
2854 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
2855 if (ret != LDB_SUCCESS) {
2856 return replmd_replicated_request_error(ar, ret);
2859 ret = ldb_msg_add_value(msg, "objectGUID", &ar->objs->objects[ar->index_current].guid_value, NULL);
2860 if (ret != LDB_SUCCESS) {
2861 return replmd_replicated_request_error(ar, ret);
2864 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
2865 if (ret != LDB_SUCCESS) {
2866 return replmd_replicated_request_error(ar, ret);
2869 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNCreated", ar->seq_num);
2870 if (ret != LDB_SUCCESS) {
2871 return replmd_replicated_request_error(ar, ret);
2874 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
2875 if (ret != LDB_SUCCESS) {
2876 return replmd_replicated_request_error(ar, ret);
2879 /* remove any message elements that have zero values */
2880 for (i=0; i<msg->num_elements; i++) {
2881 struct ldb_message_element *el = &msg->elements[i];
2883 if (el->num_values == 0) {
2884 DEBUG(4,(__location__ ": Removing attribute %s with num_values==0\n",
2886 memmove(el, el+1, sizeof(*el)*(msg->num_elements - (i+1)));
2887 msg->num_elements--;
2894 * the meta data array is already sorted by the caller
2896 for (i=0; i < md->ctr.ctr1.count; i++) {
2897 md->ctr.ctr1.array[i].local_usn = ar->seq_num;
2899 ndr_err = ndr_push_struct_blob(&md_value, msg, md,
2900 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
2901 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2902 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
2903 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
2905 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &md_value, NULL);
2906 if (ret != LDB_SUCCESS) {
2907 return replmd_replicated_request_error(ar, ret);
2910 replmd_ldb_message_sort(msg, ar->schema);
2913 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_ADD, msg);
2914 DEBUG(4, ("DRS replication add message:\n%s\n", s));
2918 ret = ldb_build_add_req(&change_req,
2926 LDB_REQ_SET_LOCATION(change_req);
2927 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
2929 return ldb_next_request(ar->module, change_req);
2933 return true if an update is newer than an existing entry
2934 see section 5.11 of MS-ADTS
2936 static bool replmd_update_is_newer(const struct GUID *current_invocation_id,
2937 const struct GUID *update_invocation_id,
2938 uint32_t current_version,
2939 uint32_t update_version,
2940 uint32_t current_usn,
2941 uint32_t update_usn,
2942 NTTIME current_change_time,
2943 NTTIME update_change_time)
2945 if (GUID_compare(update_invocation_id, current_invocation_id) == 0) {
2946 if (update_usn != current_usn) {
2947 return update_usn >= current_usn;
2950 if (update_version != current_version) {
2951 return update_version >= current_version;
2953 if (update_change_time != current_change_time) {
2954 return update_change_time >= current_change_time;
2956 return GUID_compare(update_invocation_id, current_invocation_id) >= 0;
2959 static bool replmd_replPropertyMetaData1_is_newer(struct replPropertyMetaData1 *cur_m,
2960 struct replPropertyMetaData1 *new_m)
2962 return replmd_update_is_newer(&cur_m->originating_invocation_id,
2963 &new_m->originating_invocation_id,
2966 cur_m->originating_usn,
2967 new_m->originating_usn,
2968 cur_m->originating_change_time,
2969 new_m->originating_change_time);
2972 static struct replPropertyMetaData1 *
2973 replmd_replPropertyMetaData1_find_attid(struct replPropertyMetaDataBlob *md_blob,
2974 enum drsuapi_DsAttributeId attid)
2977 struct replPropertyMetaDataCtr1 *rpmd_ctr = &md_blob->ctr.ctr1;
2979 for (i = 0; i < rpmd_ctr->count; i++) {
2980 if (rpmd_ctr->array[i].attid == attid) {
2981 return &rpmd_ctr->array[i];
2989 handle renames that come in over DRS replication
2991 static int replmd_replicated_handle_rename(struct replmd_replicated_request *ar,
2992 struct ldb_message *msg,
2993 struct replPropertyMetaDataBlob *rmd,
2994 struct replPropertyMetaDataBlob *omd)
2996 struct replPropertyMetaData1 *md_remote;
2997 struct replPropertyMetaData1 *md_local;
2999 if (ldb_dn_compare(msg->dn, ar->search_msg->dn) == 0) {
3004 /* now we need to check for double renames. We could have a
3005 * local rename pending which our replication partner hasn't
3006 * received yet. We choose which one wins by looking at the
3007 * attribute stamps on the two objects, the newer one wins
3009 md_remote = replmd_replPropertyMetaData1_find_attid(rmd, DRSUAPI_ATTID_name);
3010 md_local = replmd_replPropertyMetaData1_find_attid(omd, DRSUAPI_ATTID_name);
3011 /* if there is no name attribute then we have to assume the
3012 object we've received is in fact newer */
3013 if (!md_remote || !md_local ||
3014 replmd_replPropertyMetaData1_is_newer(md_local, md_remote)) {
3015 DEBUG(4,("replmd_replicated_request rename %s => %s\n",
3016 ldb_dn_get_linearized(ar->search_msg->dn),
3017 ldb_dn_get_linearized(msg->dn)));
3018 /* pass rename to the next module
3019 * so it doesn't appear as an originating update */
3020 return dsdb_module_rename(ar->module,
3021 ar->search_msg->dn, msg->dn,
3022 DSDB_FLAG_NEXT_MODULE | DSDB_MODIFY_RELAX);
3025 /* we're going to keep our old object */
3026 DEBUG(4,(__location__ ": Keeping object %s and rejecting older rename to %s\n",
3027 ldb_dn_get_linearized(ar->search_msg->dn),
3028 ldb_dn_get_linearized(msg->dn)));
3033 static int replmd_replicated_apply_merge(struct replmd_replicated_request *ar)
3035 struct ldb_context *ldb;
3036 struct ldb_request *change_req;
3037 enum ndr_err_code ndr_err;
3038 struct ldb_message *msg;
3039 struct replPropertyMetaDataBlob *rmd;
3040 struct replPropertyMetaDataBlob omd;
3041 const struct ldb_val *omd_value;
3042 struct replPropertyMetaDataBlob nmd;
3043 struct ldb_val nmd_value;
3046 unsigned int removed_attrs = 0;
3049 ldb = ldb_module_get_ctx(ar->module);
3050 msg = ar->objs->objects[ar->index_current].msg;
3051 rmd = ar->objs->objects[ar->index_current].meta_data;
3055 /* find existing meta data */
3056 omd_value = ldb_msg_find_ldb_val(ar->search_msg, "replPropertyMetaData");
3058 ndr_err = ndr_pull_struct_blob(omd_value, ar, &omd,
3059 (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
3060 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3061 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3062 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3065 if (omd.version != 1) {
3066 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3070 /* handle renames that come in over DRS */
3071 ret = replmd_replicated_handle_rename(ar, msg, rmd, &omd);
3072 if (ret != LDB_SUCCESS) {
3073 ldb_debug(ldb, LDB_DEBUG_FATAL,
3074 "replmd_replicated_request rename %s => %s failed - %s\n",
3075 ldb_dn_get_linearized(ar->search_msg->dn),
3076 ldb_dn_get_linearized(msg->dn),
3077 ldb_errstring(ldb));
3078 return replmd_replicated_request_werror(ar, WERR_DS_DRA_DB_ERROR);
3083 nmd.ctr.ctr1.count = omd.ctr.ctr1.count + rmd->ctr.ctr1.count;
3084 nmd.ctr.ctr1.array = talloc_array(ar,
3085 struct replPropertyMetaData1,
3086 nmd.ctr.ctr1.count);
3087 if (!nmd.ctr.ctr1.array) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3089 /* first copy the old meta data */
3090 for (i=0; i < omd.ctr.ctr1.count; i++) {
3091 nmd.ctr.ctr1.array[ni] = omd.ctr.ctr1.array[i];
3095 /* now merge in the new meta data */
3096 for (i=0; i < rmd->ctr.ctr1.count; i++) {
3099 for (j=0; j < ni; j++) {
3102 if (rmd->ctr.ctr1.array[i].attid != nmd.ctr.ctr1.array[j].attid) {
3106 cmp = replmd_replPropertyMetaData1_is_newer(&nmd.ctr.ctr1.array[j],
3107 &rmd->ctr.ctr1.array[i]);
3109 /* replace the entry */
3110 nmd.ctr.ctr1.array[j] = rmd->ctr.ctr1.array[i];
3115 if (rmd->ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) {
3116 DEBUG(3,("Discarding older DRS attribute update to %s on %s from %s\n",
3117 msg->elements[i-removed_attrs].name,
3118 ldb_dn_get_linearized(msg->dn),
3119 GUID_string(ar, &rmd->ctr.ctr1.array[i].originating_invocation_id)));
3122 /* we don't want to apply this change so remove the attribute */
3123 ldb_msg_remove_element(msg, &msg->elements[i-removed_attrs]);
3130 if (found) continue;
3132 nmd.ctr.ctr1.array[ni] = rmd->ctr.ctr1.array[i];
3137 * finally correct the size of the meta_data array
3139 nmd.ctr.ctr1.count = ni;
3142 * the rdn attribute (the alias for the name attribute),
3143 * 'cn' for most objects is the last entry in the meta data array
3146 * sort the new meta data array
3148 ret = replmd_replPropertyMetaDataCtr1_sort(&nmd.ctr.ctr1, ar->schema, msg->dn);
3149 if (ret != LDB_SUCCESS) {
3154 * check if some replicated attributes left, otherwise skip the ldb_modify() call
3156 if (msg->num_elements == 0) {
3157 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: skip replace\n",
3160 ar->index_current++;
3161 return replmd_replicated_apply_next(ar);
3164 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_replicated_apply_merge[%u]: replace %u attributes\n",
3165 ar->index_current, msg->num_elements);
3167 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &ar->seq_num);
3168 if (ret != LDB_SUCCESS) {
3169 return replmd_replicated_request_error(ar, ret);
3172 for (i=0; i<ni; i++) {
3173 nmd.ctr.ctr1.array[i].local_usn = ar->seq_num;
3176 /* create the meta data value */
3177 ndr_err = ndr_push_struct_blob(&nmd_value, msg, &nmd,
3178 (ndr_push_flags_fn_t)ndr_push_replPropertyMetaDataBlob);
3179 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3180 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3181 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3185 * when we know that we'll modify the record, add the whenChanged, uSNChanged
3186 * and replPopertyMetaData attributes
3188 ret = ldb_msg_add_string(msg, "whenChanged", ar->objs->objects[ar->index_current].when_changed);
3189 if (ret != LDB_SUCCESS) {
3190 return replmd_replicated_request_error(ar, ret);
3192 ret = samdb_msg_add_uint64(ldb, msg, msg, "uSNChanged", ar->seq_num);
3193 if (ret != LDB_SUCCESS) {
3194 return replmd_replicated_request_error(ar, ret);
3196 ret = ldb_msg_add_value(msg, "replPropertyMetaData", &nmd_value, NULL);
3197 if (ret != LDB_SUCCESS) {
3198 return replmd_replicated_request_error(ar, ret);
3201 replmd_ldb_message_sort(msg, ar->schema);
3203 /* we want to replace the old values */
3204 for (i=0; i < msg->num_elements; i++) {
3205 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
3209 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3210 DEBUG(4, ("DRS replication modify message:\n%s\n", s));
3214 ret = ldb_build_mod_req(&change_req,
3222 LDB_REQ_SET_LOCATION(change_req);
3223 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3225 return ldb_next_request(ar->module, change_req);
3228 static int replmd_replicated_apply_search_callback(struct ldb_request *req,
3229 struct ldb_reply *ares)
3231 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3232 struct replmd_replicated_request);
3236 return ldb_module_done(ar->req, NULL, NULL,
3237 LDB_ERR_OPERATIONS_ERROR);
3239 if (ares->error != LDB_SUCCESS &&
3240 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3241 return ldb_module_done(ar->req, ares->controls,
3242 ares->response, ares->error);
3245 switch (ares->type) {
3246 case LDB_REPLY_ENTRY:
3247 ar->search_msg = talloc_steal(ar, ares->message);
3250 case LDB_REPLY_REFERRAL:
3251 /* we ignore referrals */
3254 case LDB_REPLY_DONE:
3255 if (ar->search_msg != NULL) {
3256 ret = replmd_replicated_apply_merge(ar);
3258 ret = replmd_replicated_apply_add(ar);
3260 if (ret != LDB_SUCCESS) {
3261 return ldb_module_done(ar->req, NULL, NULL, ret);
3269 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar);
3271 static int replmd_replicated_apply_next(struct replmd_replicated_request *ar)
3273 struct ldb_context *ldb;
3277 struct ldb_request *search_req;
3278 struct ldb_search_options_control *options;
3280 if (ar->index_current >= ar->objs->num_objects) {
3281 /* done with it, go to next stage */
3282 return replmd_replicated_uptodate_vector(ar);
3285 ldb = ldb_module_get_ctx(ar->module);
3286 ar->search_msg = NULL;
3288 tmp_str = ldb_binary_encode(ar, ar->objs->objects[ar->index_current].guid_value);
3289 if (!tmp_str) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3291 filter = talloc_asprintf(ar, "(objectGUID=%s)", tmp_str);
3292 if (!filter) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3293 talloc_free(tmp_str);
3295 ret = ldb_build_search_req(&search_req,
3304 replmd_replicated_apply_search_callback,
3306 LDB_REQ_SET_LOCATION(search_req);
3308 ret = ldb_request_add_control(search_req, LDB_CONTROL_SHOW_RECYCLED_OID,
3310 if (ret != LDB_SUCCESS) {
3314 /* we need to cope with cross-partition links, so search for
3315 the GUID over all partitions */
3316 options = talloc(search_req, struct ldb_search_options_control);
3317 if (options == NULL) {
3318 DEBUG(0, (__location__ ": out of memory\n"));
3319 return LDB_ERR_OPERATIONS_ERROR;
3321 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
3323 ret = ldb_request_add_control(search_req,
3324 LDB_CONTROL_SEARCH_OPTIONS_OID,
3326 if (ret != LDB_SUCCESS) {
3330 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3332 return ldb_next_request(ar->module, search_req);
3335 static int replmd_replicated_uptodate_modify_callback(struct ldb_request *req,
3336 struct ldb_reply *ares)
3338 struct ldb_context *ldb;
3339 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3340 struct replmd_replicated_request);
3341 ldb = ldb_module_get_ctx(ar->module);
3344 return ldb_module_done(ar->req, NULL, NULL,
3345 LDB_ERR_OPERATIONS_ERROR);
3347 if (ares->error != LDB_SUCCESS) {
3348 return ldb_module_done(ar->req, ares->controls,
3349 ares->response, ares->error);
3352 if (ares->type != LDB_REPLY_DONE) {
3353 ldb_set_errstring(ldb, "Invalid reply type\n!");
3354 return ldb_module_done(ar->req, NULL, NULL,
3355 LDB_ERR_OPERATIONS_ERROR);
3360 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3363 static int replmd_replicated_uptodate_modify(struct replmd_replicated_request *ar)
3365 struct ldb_context *ldb;
3366 struct ldb_request *change_req;
3367 enum ndr_err_code ndr_err;
3368 struct ldb_message *msg;
3369 struct replUpToDateVectorBlob ouv;
3370 const struct ldb_val *ouv_value;
3371 const struct drsuapi_DsReplicaCursor2CtrEx *ruv;
3372 struct replUpToDateVectorBlob nuv;
3373 struct ldb_val nuv_value;
3374 struct ldb_message_element *nuv_el = NULL;
3375 const struct GUID *our_invocation_id;
3376 struct ldb_message_element *orf_el = NULL;
3377 struct repsFromToBlob nrf;
3378 struct ldb_val *nrf_value = NULL;
3379 struct ldb_message_element *nrf_el = NULL;
3383 time_t t = time(NULL);
3386 uint32_t instanceType;
3388 ldb = ldb_module_get_ctx(ar->module);
3389 ruv = ar->objs->uptodateness_vector;
3395 unix_to_nt_time(&now, t);
3397 instanceType = ldb_msg_find_attr_as_uint(ar->search_msg, "instanceType", 0);
3398 if (! (instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
3399 DEBUG(4,(__location__ ": Skipping UDV and repsFrom update as not NC root: %s\n",
3400 ldb_dn_get_linearized(ar->search_msg->dn)));
3401 return ldb_module_done(ar->req, NULL, NULL, LDB_SUCCESS);
3405 * first create the new replUpToDateVector
3407 ouv_value = ldb_msg_find_ldb_val(ar->search_msg, "replUpToDateVector");
3409 ndr_err = ndr_pull_struct_blob(ouv_value, ar, &ouv,
3410 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
3411 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3412 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3413 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3416 if (ouv.version != 2) {
3417 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3422 * the new uptodateness vector will at least
3423 * contain 1 entry, one for the source_dsa
3425 * plus optional values from our old vector and the one from the source_dsa
3427 nuv.ctr.ctr2.count = 1 + ouv.ctr.ctr2.count;
3428 if (ruv) nuv.ctr.ctr2.count += ruv->count;
3429 nuv.ctr.ctr2.cursors = talloc_array(ar,
3430 struct drsuapi_DsReplicaCursor2,
3431 nuv.ctr.ctr2.count);
3432 if (!nuv.ctr.ctr2.cursors) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3434 /* first copy the old vector */
3435 for (i=0; i < ouv.ctr.ctr2.count; i++) {
3436 nuv.ctr.ctr2.cursors[ni] = ouv.ctr.ctr2.cursors[i];
3440 /* get our invocation_id if we have one already attached to the ldb */
3441 our_invocation_id = samdb_ntds_invocation_id(ldb);
3443 /* merge in the source_dsa vector is available */
3444 for (i=0; (ruv && i < ruv->count); i++) {
3447 if (our_invocation_id &&
3448 GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3449 our_invocation_id)) {
3453 for (j=0; j < ni; j++) {
3454 if (!GUID_equal(&ruv->cursors[i].source_dsa_invocation_id,
3455 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3462 * we update only the highest_usn and not the latest_sync_success time,
3463 * because the last success stands for direct replication
3465 if (ruv->cursors[i].highest_usn > nuv.ctr.ctr2.cursors[j].highest_usn) {
3466 nuv.ctr.ctr2.cursors[j].highest_usn = ruv->cursors[i].highest_usn;
3471 if (found) continue;
3473 /* if it's not there yet, add it */
3474 nuv.ctr.ctr2.cursors[ni] = ruv->cursors[i];
3479 * merge in the current highwatermark for the source_dsa
3482 for (j=0; j < ni; j++) {
3483 if (!GUID_equal(&ar->objs->source_dsa->source_dsa_invocation_id,
3484 &nuv.ctr.ctr2.cursors[j].source_dsa_invocation_id)) {
3491 * here we update the highest_usn and last_sync_success time
3492 * because we're directly replicating from the source_dsa
3494 * and use the tmp_highest_usn because this is what we have just applied
3497 nuv.ctr.ctr2.cursors[j].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3498 nuv.ctr.ctr2.cursors[j].last_sync_success = now;
3503 * here we update the highest_usn and last_sync_success time
3504 * because we're directly replicating from the source_dsa
3506 * and use the tmp_highest_usn because this is what we have just applied
3509 nuv.ctr.ctr2.cursors[ni].source_dsa_invocation_id= ar->objs->source_dsa->source_dsa_invocation_id;
3510 nuv.ctr.ctr2.cursors[ni].highest_usn = ar->objs->source_dsa->highwatermark.tmp_highest_usn;
3511 nuv.ctr.ctr2.cursors[ni].last_sync_success = now;
3516 * finally correct the size of the cursors array
3518 nuv.ctr.ctr2.count = ni;
3523 TYPESAFE_QSORT(nuv.ctr.ctr2.cursors, nuv.ctr.ctr2.count, drsuapi_DsReplicaCursor2_compare);
3526 * create the change ldb_message
3528 msg = ldb_msg_new(ar);
3529 if (!msg) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3530 msg->dn = ar->search_msg->dn;
3532 ndr_err = ndr_push_struct_blob(&nuv_value, msg, &nuv,
3533 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
3534 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3535 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3536 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3538 ret = ldb_msg_add_value(msg, "replUpToDateVector", &nuv_value, &nuv_el);
3539 if (ret != LDB_SUCCESS) {
3540 return replmd_replicated_request_error(ar, ret);
3542 nuv_el->flags = LDB_FLAG_MOD_REPLACE;
3545 * now create the new repsFrom value from the given repsFromTo1 structure
3549 nrf.ctr.ctr1 = *ar->objs->source_dsa;
3550 nrf.ctr.ctr1.highwatermark.highest_usn = nrf.ctr.ctr1.highwatermark.tmp_highest_usn;
3553 * first see if we already have a repsFrom value for the current source dsa
3554 * if so we'll later replace this value
3556 orf_el = ldb_msg_find_element(ar->search_msg, "repsFrom");
3558 for (i=0; i < orf_el->num_values; i++) {
3559 struct repsFromToBlob *trf;
3561 trf = talloc(ar, struct repsFromToBlob);
3562 if (!trf) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3564 ndr_err = ndr_pull_struct_blob(&orf_el->values[i], trf, trf,
3565 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
3566 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3567 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3568 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3571 if (trf->version != 1) {
3572 return replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3576 * we compare the source dsa objectGUID not the invocation_id
3577 * because we want only one repsFrom value per source dsa
3578 * and when the invocation_id of the source dsa has changed we don't need
3579 * the old repsFrom with the old invocation_id
3581 if (!GUID_equal(&trf->ctr.ctr1.source_dsa_obj_guid,
3582 &ar->objs->source_dsa->source_dsa_obj_guid)) {
3588 nrf_value = &orf_el->values[i];
3593 * copy over all old values to the new ldb_message
3595 ret = ldb_msg_add_empty(msg, "repsFrom", 0, &nrf_el);
3596 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3601 * if we haven't found an old repsFrom value for the current source dsa
3602 * we'll add a new value
3605 struct ldb_val zero_value;
3606 ZERO_STRUCT(zero_value);
3607 ret = ldb_msg_add_value(msg, "repsFrom", &zero_value, &nrf_el);
3608 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3610 nrf_value = &nrf_el->values[nrf_el->num_values - 1];
3613 /* we now fill the value which is already attached to ldb_message */
3614 ndr_err = ndr_push_struct_blob(nrf_value, msg,
3616 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
3617 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3618 NTSTATUS nt_status = ndr_map_error2ntstatus(ndr_err);
3619 return replmd_replicated_request_werror(ar, ntstatus_to_werror(nt_status));
3623 * the ldb_message_element for the attribute, has all the old values and the new one
3624 * so we'll replace the whole attribute with all values
3626 nrf_el->flags = LDB_FLAG_MOD_REPLACE;
3629 char *s = ldb_ldif_message_string(ldb, ar, LDB_CHANGETYPE_MODIFY, msg);
3630 DEBUG(4, ("DRS replication uptodate modify message:\n%s\n", s));
3634 /* prepare the ldb_modify() request */
3635 ret = ldb_build_mod_req(&change_req,
3641 replmd_replicated_uptodate_modify_callback,
3643 LDB_REQ_SET_LOCATION(change_req);
3644 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3646 return ldb_next_request(ar->module, change_req);
3649 static int replmd_replicated_uptodate_search_callback(struct ldb_request *req,
3650 struct ldb_reply *ares)
3652 struct replmd_replicated_request *ar = talloc_get_type(req->context,
3653 struct replmd_replicated_request);
3657 return ldb_module_done(ar->req, NULL, NULL,
3658 LDB_ERR_OPERATIONS_ERROR);
3660 if (ares->error != LDB_SUCCESS &&
3661 ares->error != LDB_ERR_NO_SUCH_OBJECT) {
3662 return ldb_module_done(ar->req, ares->controls,
3663 ares->response, ares->error);
3666 switch (ares->type) {
3667 case LDB_REPLY_ENTRY:
3668 ar->search_msg = talloc_steal(ar, ares->message);
3671 case LDB_REPLY_REFERRAL:
3672 /* we ignore referrals */
3675 case LDB_REPLY_DONE:
3676 if (ar->search_msg == NULL) {
3677 ret = replmd_replicated_request_werror(ar, WERR_DS_DRA_INTERNAL_ERROR);
3679 ret = replmd_replicated_uptodate_modify(ar);
3681 if (ret != LDB_SUCCESS) {
3682 return ldb_module_done(ar->req, NULL, NULL, ret);
3691 static int replmd_replicated_uptodate_vector(struct replmd_replicated_request *ar)
3693 struct ldb_context *ldb;
3695 static const char *attrs[] = {
3696 "replUpToDateVector",
3701 struct ldb_request *search_req;
3703 ldb = ldb_module_get_ctx(ar->module);
3704 ar->search_msg = NULL;
3706 ret = ldb_build_search_req(&search_req,
3709 ar->objs->partition_dn,
3715 replmd_replicated_uptodate_search_callback,
3717 LDB_REQ_SET_LOCATION(search_req);
3718 if (ret != LDB_SUCCESS) return replmd_replicated_request_error(ar, ret);
3720 return ldb_next_request(ar->module, search_req);
3725 static int replmd_extended_replicated_objects(struct ldb_module *module, struct ldb_request *req)
3727 struct ldb_context *ldb;
3728 struct dsdb_extended_replicated_objects *objs;
3729 struct replmd_replicated_request *ar;
3730 struct ldb_control **ctrls;
3733 struct replmd_private *replmd_private =
3734 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
3736 ldb = ldb_module_get_ctx(module);
3738 ldb_debug(ldb, LDB_DEBUG_TRACE, "replmd_extended_replicated_objects\n");
3740 objs = talloc_get_type(req->op.extended.data, struct dsdb_extended_replicated_objects);
3742 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: invalid extended data\n");
3743 return LDB_ERR_PROTOCOL_ERROR;
3746 if (objs->version != DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION) {
3747 ldb_debug(ldb, LDB_DEBUG_FATAL, "replmd_extended_replicated_objects: extended data invalid version [%u != %u]\n",
3748 objs->version, DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION);
3749 return LDB_ERR_PROTOCOL_ERROR;
3752 ar = replmd_ctx_init(module, req);
3754 return LDB_ERR_OPERATIONS_ERROR;
3756 /* Set the flags to have the replmd_op_callback run over the full set of objects */
3757 ar->apply_mode = true;
3759 ar->schema = dsdb_get_schema(ldb, ar);
3761 ldb_debug_set(ldb, LDB_DEBUG_FATAL, "replmd_ctx_init: no loaded schema found\n");
3763 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
3764 return LDB_ERR_CONSTRAINT_VIOLATION;
3767 ctrls = req->controls;
3769 if (req->controls) {
3770 req->controls = talloc_memdup(ar, req->controls,
3771 talloc_get_size(req->controls));
3772 if (!req->controls) return replmd_replicated_request_werror(ar, WERR_NOMEM);
3775 /* This allows layers further down to know if a change came in over replication */
3776 ret = ldb_request_add_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID, false, NULL);
3777 if (ret != LDB_SUCCESS) {
3781 /* If this change contained linked attributes in the body
3782 * (rather than in the links section) we need to update
3783 * backlinks in linked_attributes */
3784 ret = ldb_request_add_control(req, DSDB_CONTROL_APPLY_LINKS, false, NULL);
3785 if (ret != LDB_SUCCESS) {
3789 ar->controls = req->controls;
3790 req->controls = ctrls;
3792 DEBUG(4,("linked_attributes_count=%u\n", objs->linked_attributes_count));
3794 /* save away the linked attributes for the end of the
3796 for (i=0; i<ar->objs->linked_attributes_count; i++) {
3797 struct la_entry *la_entry;
3799 if (replmd_private->la_ctx == NULL) {
3800 replmd_private->la_ctx = talloc_new(replmd_private);
3802 la_entry = talloc(replmd_private->la_ctx, struct la_entry);
3803 if (la_entry == NULL) {
3805 return LDB_ERR_OPERATIONS_ERROR;
3807 la_entry->la = talloc(la_entry, struct drsuapi_DsReplicaLinkedAttribute);
3808 if (la_entry->la == NULL) {
3809 talloc_free(la_entry);
3811 return LDB_ERR_OPERATIONS_ERROR;
3813 *la_entry->la = ar->objs->linked_attributes[i];
3815 /* we need to steal the non-scalars so they stay
3816 around until the end of the transaction */
3817 talloc_steal(la_entry->la, la_entry->la->identifier);
3818 talloc_steal(la_entry->la, la_entry->la->value.blob);
3820 DLIST_ADD(replmd_private->la_list, la_entry);
3823 return replmd_replicated_apply_next(ar);
3827 process one linked attribute structure
3829 static int replmd_process_linked_attribute(struct ldb_module *module,
3830 struct la_entry *la_entry)
3832 struct drsuapi_DsReplicaLinkedAttribute *la = la_entry->la;
3833 struct ldb_context *ldb = ldb_module_get_ctx(module);
3834 struct ldb_message *msg;
3835 TALLOC_CTX *tmp_ctx = talloc_new(la_entry);
3836 const struct dsdb_schema *schema = dsdb_get_schema(ldb, tmp_ctx);
3838 const struct dsdb_attribute *attr;
3839 struct dsdb_dn *dsdb_dn;
3840 uint64_t seq_num = 0;
3841 struct ldb_message_element *old_el;
3843 time_t t = time(NULL);
3844 struct ldb_result *res;
3845 const char *attrs[2];
3846 struct parsed_dn *pdn_list, *pdn;
3847 struct GUID guid = GUID_zero();
3849 bool active = (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?true:false;
3850 const struct GUID *our_invocation_id;
3853 linked_attributes[0]:
3854 &objs->linked_attributes[i]: struct drsuapi_DsReplicaLinkedAttribute
3856 identifier: struct drsuapi_DsReplicaObjectIdentifier
3857 __ndr_size : 0x0000003a (58)
3858 __ndr_size_sid : 0x00000000 (0)
3859 guid : 8e95b6a9-13dd-4158-89db-3220a5be5cc7
3861 __ndr_size_dn : 0x00000000 (0)
3863 attid : DRSUAPI_ATTID_member (0x1F)
3864 value: struct drsuapi_DsAttributeValue
3865 __ndr_size : 0x0000007e (126)
3867 blob : DATA_BLOB length=126
3868 flags : 0x00000001 (1)
3869 1: DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE
3870 originating_add_time : Wed Sep 2 22:20:01 2009 EST
3871 meta_data: struct drsuapi_DsReplicaMetaData
3872 version : 0x00000015 (21)
3873 originating_change_time : Wed Sep 2 23:39:07 2009 EST
3874 originating_invocation_id: 794640f3-18cf-40ee-a211-a93992b67a64
3875 originating_usn : 0x000000000001e19c (123292)
3877 (for cases where the link is to a normal DN)
3878 &target: struct drsuapi_DsReplicaObjectIdentifier3
3879 __ndr_size : 0x0000007e (126)
3880 __ndr_size_sid : 0x0000001c (28)
3881 guid : 7639e594-db75-4086-b0d4-67890ae46031
3882 sid : S-1-5-21-2848215498-2472035911-1947525656-19924
3883 __ndr_size_dn : 0x00000022 (34)
3884 dn : 'CN=UOne,OU=TestOU,DC=vsofs8,DC=com'
3887 /* find the attribute being modified */
3888 attr = dsdb_attribute_by_attributeID_id(schema, la->attid);
3890 DEBUG(0, (__location__ ": Unable to find attributeID 0x%x\n", la->attid));
3891 talloc_free(tmp_ctx);
3892 return LDB_ERR_OPERATIONS_ERROR;
3895 attrs[0] = attr->lDAPDisplayName;
3898 /* get the existing message from the db for the object with
3899 this GUID, returning attribute being modified. We will then
3900 use this msg as the basis for a modify call */
3901 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
3902 DSDB_FLAG_NEXT_MODULE |
3903 DSDB_SEARCH_SEARCH_ALL_PARTITIONS |
3904 DSDB_SEARCH_SHOW_RECYCLED |
3905 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT |
3906 DSDB_SEARCH_REVEAL_INTERNALS,
3907 "objectGUID=%s", GUID_string(tmp_ctx, &la->identifier->guid));
3908 if (ret != LDB_SUCCESS) {
3909 talloc_free(tmp_ctx);
3912 if (res->count != 1) {
3913 ldb_asprintf_errstring(ldb, "DRS linked attribute for GUID %s - DN not found",
3914 GUID_string(tmp_ctx, &la->identifier->guid));
3915 talloc_free(tmp_ctx);
3916 return LDB_ERR_NO_SUCH_OBJECT;
3920 if (msg->num_elements == 0) {
3921 ret = ldb_msg_add_empty(msg, attr->lDAPDisplayName, LDB_FLAG_MOD_REPLACE, &old_el);
3922 if (ret != LDB_SUCCESS) {
3923 ldb_module_oom(module);
3924 talloc_free(tmp_ctx);
3925 return LDB_ERR_OPERATIONS_ERROR;
3928 old_el = &msg->elements[0];
3929 old_el->flags = LDB_FLAG_MOD_REPLACE;
3932 /* parse the existing links */
3933 ret = get_parsed_dns(module, tmp_ctx, old_el, &pdn_list, attr->syntax->ldap_oid);
3934 if (ret != LDB_SUCCESS) {
3935 talloc_free(tmp_ctx);
3939 /* get our invocationId */
3940 our_invocation_id = samdb_ntds_invocation_id(ldb);
3941 if (!our_invocation_id) {
3942 ldb_debug_set(ldb, LDB_DEBUG_ERROR, __location__ ": unable to find invocationId\n");
3943 talloc_free(tmp_ctx);
3944 return LDB_ERR_OPERATIONS_ERROR;
3947 ret = replmd_check_upgrade_links(pdn_list, old_el->num_values, old_el, our_invocation_id);
3948 if (ret != LDB_SUCCESS) {
3949 talloc_free(tmp_ctx);
3953 status = dsdb_dn_la_from_blob(ldb, attr, schema, tmp_ctx, la->value.blob, &dsdb_dn);
3954 if (!W_ERROR_IS_OK(status)) {
3955 ldb_asprintf_errstring(ldb, "Failed to parsed linked attribute blob for %s on %s - %s\n",
3956 old_el->name, ldb_dn_get_linearized(msg->dn), win_errstr(status));
3957 return LDB_ERR_OPERATIONS_ERROR;
3960 ntstatus = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
3961 if (!NT_STATUS_IS_OK(ntstatus) && active) {
3962 ldb_asprintf_errstring(ldb, "Failed to find GUID in linked attribute blob for %s on %s from %s",
3964 ldb_dn_get_linearized(dsdb_dn->dn),
3965 ldb_dn_get_linearized(msg->dn));
3966 return LDB_ERR_OPERATIONS_ERROR;
3969 /* re-resolve the DN by GUID, as the DRS server may give us an
3971 ret = dsdb_module_dn_by_guid(module, dsdb_dn, &guid, &dsdb_dn->dn);
3972 if (ret != LDB_SUCCESS) {
3973 DEBUG(2,(__location__ ": WARNING: Failed to re-resolve GUID %s - using %s",
3974 GUID_string(tmp_ctx, &guid),
3975 ldb_dn_get_linearized(dsdb_dn->dn)));
3978 /* see if this link already exists */
3979 pdn = parsed_dn_find(pdn_list, old_el->num_values, &guid, dsdb_dn->dn);
3981 /* see if this update is newer than what we have already */
3982 struct GUID invocation_id = GUID_zero();
3983 uint32_t version = 0;
3984 uint32_t originating_usn = 0;
3985 NTTIME change_time = 0;
3986 uint32_t rmd_flags = dsdb_dn_rmd_flags(pdn->dsdb_dn->dn);
3988 dsdb_get_extended_dn_guid(pdn->dsdb_dn->dn, &invocation_id, "RMD_INVOCID");
3989 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &version, "RMD_VERSION");
3990 dsdb_get_extended_dn_uint32(pdn->dsdb_dn->dn, &originating_usn, "RMD_ORIGINATING_USN");
3991 dsdb_get_extended_dn_nttime(pdn->dsdb_dn->dn, &change_time, "RMD_CHANGETIME");
3993 if (!replmd_update_is_newer(&invocation_id,
3994 &la->meta_data.originating_invocation_id,
3996 la->meta_data.version,
3998 la->meta_data.originating_usn,
4000 la->meta_data.originating_change_time)) {
4001 DEBUG(3,("Discarding older DRS linked attribute update to %s on %s from %s\n",
4002 old_el->name, ldb_dn_get_linearized(msg->dn),
4003 GUID_string(tmp_ctx, &la->meta_data.originating_invocation_id)));
4004 talloc_free(tmp_ctx);
4008 /* get a seq_num for this change */
4009 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4010 if (ret != LDB_SUCCESS) {
4011 talloc_free(tmp_ctx);
4015 if (!(rmd_flags & DSDB_RMD_FLAG_DELETED)) {
4016 /* remove the existing backlink */
4017 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, false, attr, false);
4018 if (ret != LDB_SUCCESS) {
4019 talloc_free(tmp_ctx);
4024 ret = replmd_update_la_val(tmp_ctx, pdn->v, dsdb_dn, pdn->dsdb_dn,
4025 &la->meta_data.originating_invocation_id,
4026 la->meta_data.originating_usn, seq_num,
4027 la->meta_data.originating_change_time,
4028 la->meta_data.version,
4030 if (ret != LDB_SUCCESS) {
4031 talloc_free(tmp_ctx);
4036 /* add the new backlink */
4037 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid, true, attr, false);
4038 if (ret != LDB_SUCCESS) {
4039 talloc_free(tmp_ctx);
4044 /* get a seq_num for this change */
4045 ret = ldb_sequence_number(ldb, LDB_SEQ_NEXT, &seq_num);
4046 if (ret != LDB_SUCCESS) {
4047 talloc_free(tmp_ctx);
4051 old_el->values = talloc_realloc(msg->elements, old_el->values,
4052 struct ldb_val, old_el->num_values+1);
4053 if (!old_el->values) {
4054 ldb_module_oom(module);
4055 return LDB_ERR_OPERATIONS_ERROR;
4057 old_el->num_values++;
4059 ret = replmd_build_la_val(tmp_ctx, &old_el->values[old_el->num_values-1], dsdb_dn,
4060 &la->meta_data.originating_invocation_id,
4061 la->meta_data.originating_usn, seq_num,
4062 la->meta_data.originating_change_time,
4063 la->meta_data.version,
4064 (la->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)?false:true);
4065 if (ret != LDB_SUCCESS) {
4066 talloc_free(tmp_ctx);
4071 ret = replmd_add_backlink(module, schema, &la->identifier->guid, &guid,
4073 if (ret != LDB_SUCCESS) {
4074 talloc_free(tmp_ctx);
4080 /* we only change whenChanged and uSNChanged if the seq_num
4082 if (add_time_element(msg, "whenChanged", t) != LDB_SUCCESS) {
4083 talloc_free(tmp_ctx);
4084 return ldb_operr(ldb);
4087 if (add_uint64_element(ldb, msg, "uSNChanged",
4088 seq_num) != LDB_SUCCESS) {
4089 talloc_free(tmp_ctx);
4090 return ldb_operr(ldb);
4093 old_el = ldb_msg_find_element(msg, attr->lDAPDisplayName);
4094 if (old_el == NULL) {
4095 talloc_free(tmp_ctx);
4096 return ldb_operr(ldb);
4099 ret = dsdb_check_single_valued_link(attr, old_el);
4100 if (ret != LDB_SUCCESS) {
4101 talloc_free(tmp_ctx);
4105 old_el->flags |= LDB_FLAG_INTERNAL_DISABLE_SINGLE_VALUE_CHECK;
4107 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
4108 if (ret != LDB_SUCCESS) {
4109 ldb_debug(ldb, LDB_DEBUG_WARNING, "Failed to apply linked attribute change '%s'\n%s\n",
4111 ldb_ldif_message_string(ldb, tmp_ctx, LDB_CHANGETYPE_MODIFY, msg));
4112 talloc_free(tmp_ctx);
4116 talloc_free(tmp_ctx);
4121 static int replmd_extended(struct ldb_module *module, struct ldb_request *req)
4123 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) == 0) {
4124 return replmd_extended_replicated_objects(module, req);
4127 return ldb_next_request(module, req);
4132 we hook into the transaction operations to allow us to
4133 perform the linked attribute updates at the end of the whole
4134 transaction. This allows a forward linked attribute to be created
4135 before the object is created. During a vampire, w2k8 sends us linked
4136 attributes before the objects they are part of.
4138 static int replmd_start_transaction(struct ldb_module *module)
4140 /* create our private structure for this transaction */
4141 struct replmd_private *replmd_private = talloc_get_type(ldb_module_get_private(module),
4142 struct replmd_private);
4143 replmd_txn_cleanup(replmd_private);
4145 /* free any leftover mod_usn records from cancelled
4147 while (replmd_private->ncs) {
4148 struct nc_entry *e = replmd_private->ncs;
4149 DLIST_REMOVE(replmd_private->ncs, e);
4153 return ldb_next_start_trans(module);
4157 on prepare commit we loop over our queued la_context structures and
4160 static int replmd_prepare_commit(struct ldb_module *module)
4162 struct replmd_private *replmd_private =
4163 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4164 struct la_entry *la, *prev;
4165 struct la_backlink *bl;
4168 /* walk the list backwards, to do the first entry first, as we
4169 * added the entries with DLIST_ADD() which puts them at the
4170 * start of the list */
4171 for (la = DLIST_TAIL(replmd_private->la_list); la; la=prev) {
4172 prev = DLIST_PREV(la);
4173 DLIST_REMOVE(replmd_private->la_list, la);
4174 ret = replmd_process_linked_attribute(module, la);
4175 if (ret != LDB_SUCCESS) {
4176 replmd_txn_cleanup(replmd_private);
4181 /* process our backlink list, creating and deleting backlinks
4183 for (bl=replmd_private->la_backlinks; bl; bl=bl->next) {
4184 ret = replmd_process_backlink(module, bl);
4185 if (ret != LDB_SUCCESS) {
4186 replmd_txn_cleanup(replmd_private);
4191 replmd_txn_cleanup(replmd_private);
4193 /* possibly change @REPLCHANGED */
4194 ret = replmd_notify_store(module);
4195 if (ret != LDB_SUCCESS) {
4199 return ldb_next_prepare_commit(module);
4202 static int replmd_del_transaction(struct ldb_module *module)
4204 struct replmd_private *replmd_private =
4205 talloc_get_type(ldb_module_get_private(module), struct replmd_private);
4206 replmd_txn_cleanup(replmd_private);
4208 return ldb_next_del_trans(module);
4212 static const struct ldb_module_ops ldb_repl_meta_data_module_ops = {
4213 .name = "repl_meta_data",
4214 .init_context = replmd_init,
4216 .modify = replmd_modify,
4217 .rename = replmd_rename,
4218 .del = replmd_delete,
4219 .extended = replmd_extended,
4220 .start_transaction = replmd_start_transaction,
4221 .prepare_commit = replmd_prepare_commit,
4222 .del_transaction = replmd_del_transaction,
4225 int ldb_repl_meta_data_module_init(const char *version)
4227 LDB_MODULE_CHECK_VERSION(version);
4228 return ldb_register_module(&ldb_repl_meta_data_module_ops);