source4/rpc_server/drsuapi/getncchanges.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    implement the DSGetNCChanges call
   5
   6    Copyright (C) Anatoliy Atanasov 2009
   7    Copyright (C) Andrew Tridgell 2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "rpc_server/dcerpc_server.h"
  25 #include "dsdb/samdb/samdb.h"
  26 #include "param/param.h"
  27 #include "librpc/gen_ndr/ndr_drsblobs.h"
  28 #include "librpc/gen_ndr/ndr_drsuapi.h"
  29 #include "librpc/gen_ndr/ndr_security.h"
  30 #include "libcli/security/security.h"
  31 #include "libcli/security/session.h"
  32 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  33 #include "rpc_server/dcerpc_server_proto.h"
  34 #include "../libcli/drsuapi/drsuapi.h"
  35 #include "lib/util/binsearch.h"
  36 #include "lib/util/tsort.h"
  37 #include "auth/session.h"
  38 #include "dsdb/common/util.h"
  39
  40 /* state of a partially completed getncchanges call */
  41 struct drsuapi_getncchanges_state {
  42         struct GUID *guids;
  43         uint32_t num_records;
  44         uint32_t num_processed;
  45         struct ldb_dn *ncRoot_dn;
  46         bool is_schema_nc;
  47         uint64_t min_usn;
  48         uint64_t max_usn;
  49         struct drsuapi_DsReplicaHighWaterMark last_hwm;
  50         struct ldb_dn *last_dn;
  51         struct drsuapi_DsReplicaHighWaterMark final_hwm;
  52         struct drsuapi_DsReplicaCursor2CtrEx *final_udv;
  53         struct drsuapi_DsReplicaLinkedAttribute *la_list;
  54         uint32_t la_count;
  55         bool la_sorted;
  56         uint32_t la_idx;
  57 };
  58
  59 static int drsuapi_DsReplicaHighWaterMark_cmp(const struct drsuapi_DsReplicaHighWaterMark *h1,
  60                                               const struct drsuapi_DsReplicaHighWaterMark *h2)
  61 {
  62         if (h1->highest_usn < h2->highest_usn) {
  63                 return -1;
  64         } else if (h1->highest_usn > h2->highest_usn) {
  65                 return 1;
  66         } else if (h1->tmp_highest_usn < h2->tmp_highest_usn) {
  67                 return -1;
  68         } else if (h1->tmp_highest_usn > h2->tmp_highest_usn) {
  69                 return 1;
  70         } else if (h1->reserved_usn < h2->reserved_usn) {
  71                 return -1;
  72         } else if (h1->reserved_usn > h2->reserved_usn) {
  73                 return 1;
  74         }
  75
  76         return 0;
  77 }
  78
  79 /*
  80   build a DsReplicaObjectIdentifier from a ldb msg
  81  */
  82 static struct drsuapi_DsReplicaObjectIdentifier *get_object_identifier(TALLOC_CTX *mem_ctx,
  83                                                                        struct ldb_message *msg)
  84 {
  85         struct drsuapi_DsReplicaObjectIdentifier *identifier;
  86         struct dom_sid *sid;
  87
  88         identifier = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
  89         if (identifier == NULL) {
  90                 return NULL;
  91         }
  92
  93         identifier->dn = ldb_dn_alloc_linearized(identifier, msg->dn);
  94         identifier->guid = samdb_result_guid(msg, "objectGUID");
  95
  96         sid = samdb_result_dom_sid(identifier, msg, "objectSid");
  97         if (sid) {
  98                 identifier->sid = *sid;
  99         } else {
 100                 ZERO_STRUCT(identifier->sid);
 101         }
 102         return identifier;
 103 }
 104
 105 static int udv_compare(const struct GUID *guid1, struct GUID guid2)
 106 {
 107         return GUID_compare(guid1, &guid2);
 108 }
 109
 110 /*
 111   see if we can filter an attribute using the uptodateness_vector
 112  */
 113 static bool udv_filter(const struct drsuapi_DsReplicaCursorCtrEx *udv,
 114                        const struct GUID *originating_invocation_id,
 115                        uint64_t originating_usn)
 116 {
 117         const struct drsuapi_DsReplicaCursor *c;
 118         if (udv == NULL) return false;
 119         BINARY_ARRAY_SEARCH(udv->cursors, udv->count, source_dsa_invocation_id,
 120                             originating_invocation_id, udv_compare, c);
 121         if (c && originating_usn <= c->highest_usn) {
 122                 return true;
 123         }
 124         return false;
 125
 126 }
 127
 128 static int attid_cmp(enum drsuapi_DsAttributeId a1, enum drsuapi_DsAttributeId a2)
 129 {
 130         if (a1 == a2) return 0;
 131         return ((uint32_t)a1) > ((uint32_t)a2) ? 1 : -1;
 132 }
 133
 134 /*
 135   check if an attribute is in a partial_attribute_set
 136  */
 137 static bool check_partial_attribute_set(const struct dsdb_attribute *sa,
 138                                         struct drsuapi_DsPartialAttributeSet *pas)
 139 {
 140         enum drsuapi_DsAttributeId *result;
 141         BINARY_ARRAY_SEARCH_V(pas->attids, pas->num_attids, (enum drsuapi_DsAttributeId)sa->attributeID_id,
 142                               attid_cmp, result);
 143         return result != NULL;
 144 }
 145
 146
 147 /*
 148   drsuapi_DsGetNCChanges for one object
 149 */
 150 static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
 151                                           struct ldb_message *msg,
 152                                           struct ldb_context *sam_ctx,
 153                                           struct ldb_dn *ncRoot_dn,
 154                                           bool   is_schema_nc,
 155                                           struct dsdb_schema *schema,
 156                                           DATA_BLOB *session_key,
 157                                           uint64_t highest_usn,
 158                                           uint32_t replica_flags,
 159                                           struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
 160                                           struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
 161                                           enum drsuapi_DsExtendedOperation extended_op,
 162                                           bool force_object_return)
 163 {
 164         const struct ldb_val *md_value;
 165         uint32_t i, n;
 166         struct replPropertyMetaDataBlob md;
 167         uint32_t rid = 0;
 168         enum ndr_err_code ndr_err;
 169         uint32_t *attids;
 170         const char *rdn;
 171         const struct dsdb_attribute *rdn_sa;
 172         unsigned int instanceType;
 173         struct dsdb_syntax_ctx syntax_ctx;
 174
 175         /* make dsdb sytanx context for conversions */
 176         dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
 177         syntax_ctx.is_schema_nc = is_schema_nc;
 178
 179         instanceType = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
 180         if (instanceType & INSTANCE_TYPE_IS_NC_HEAD) {
 181                 obj->is_nc_prefix = true;
 182                 obj->parent_object_guid = NULL;
 183         } else {
 184                 obj->is_nc_prefix = false;
 185                 obj->parent_object_guid = talloc(obj, struct GUID);
 186                 if (obj->parent_object_guid == NULL) {
 187                         return WERR_DS_DRA_INTERNAL_ERROR;
 188                 }
 189                 *obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
 190                 if (GUID_all_zero(obj->parent_object_guid)) {
 191                         DEBUG(0,(__location__ ": missing parentGUID for %s\n",
 192                                  ldb_dn_get_linearized(msg->dn)));
 193                         return WERR_DS_DRA_INTERNAL_ERROR;
 194                 }
 195         }
 196         obj->next_object = NULL;
 197
 198         md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
 199         if (!md_value) {
 200                 /* nothing to send */
 201                 return WERR_OK;
 202         }
 203
 204         if (instanceType & INSTANCE_TYPE_UNINSTANT) {
 205                 /* don't send uninstantiated objects */
 206                 return WERR_OK;
 207         }
 208
 209         ndr_err = ndr_pull_struct_blob(md_value, obj, &md,
 210                                        (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
 211         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 212                 return WERR_DS_DRA_INTERNAL_ERROR;
 213         }
 214
 215         if (md.version != 1) {
 216                 return WERR_DS_DRA_INTERNAL_ERROR;
 217         }
 218
 219         rdn = ldb_dn_get_rdn_name(msg->dn);
 220         if (rdn == NULL) {
 221                 DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
 222                 return WERR_DS_DRA_INTERNAL_ERROR;
 223         }
 224
 225         rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
 226         if (rdn_sa == NULL) {
 227                 DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
 228                          rdn, ldb_dn_get_linearized(msg->dn)));
 229                 return WERR_DS_DRA_INTERNAL_ERROR;
 230         }
 231
 232         obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
 233         attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
 234
 235         obj->object.identifier = get_object_identifier(obj, msg);
 236         if (obj->object.identifier == NULL) {
 237                 return WERR_NOMEM;
 238         }
 239         dom_sid_split_rid(NULL, &obj->object.identifier->sid, NULL, &rid);
 240
 241         obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
 242         for (n=i=0; i<md.ctr.ctr1.count; i++) {
 243                 const struct dsdb_attribute *sa;
 244                 bool force_attribute = false;
 245
 246                 /* if the attribute has not changed, and it is not the
 247                    instanceType then don't include it */
 248                 if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
 249                     extended_op != DRSUAPI_EXOP_REPL_SECRET &&
 250                     md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) continue;
 251
 252                 /* don't include the rDN */
 253                 if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
 254
 255                 sa = dsdb_attribute_by_attributeID_id(schema, md.ctr.ctr1.array[i].attid);
 256                 if (!sa) {
 257                         DEBUG(0,(__location__ ": Failed to find attribute in schema for attrid %u mentioned in replPropertyMetaData of %s\n",
 258                                  (unsigned int)md.ctr.ctr1.array[i].attid,
 259                                  ldb_dn_get_linearized(msg->dn)));
 260                         return WERR_DS_DRA_INTERNAL_ERROR;
 261                 }
 262
 263                 if (sa->linkID) {
 264                         struct ldb_message_element *el;
 265                         el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 266                         if (el && el->num_values && dsdb_dn_is_upgraded_link_val(&el->values[0])) {
 267                                 /* don't send upgraded links inline */
 268                                 continue;
 269                         }
 270                 }
 271
 272                 if (extended_op == DRSUAPI_EXOP_REPL_SECRET &&
 273                     !dsdb_attr_in_rodc_fas(sa)) {
 274                         force_attribute = true;
 275                         DEBUG(4,("Forcing attribute %s in %s\n",
 276                                  sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 277                 }
 278
 279                 /* filter by uptodateness_vector */
 280                 if (md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType &&
 281                     !force_attribute &&
 282                     udv_filter(uptodateness_vector,
 283                                &md.ctr.ctr1.array[i].originating_invocation_id,
 284                                md.ctr.ctr1.array[i].originating_usn)) {
 285                         continue;
 286                 }
 287
 288                 /* filter by partial_attribute_set */
 289                 if (partial_attribute_set && !check_partial_attribute_set(sa, partial_attribute_set)) {
 290                         continue;
 291                 }
 292
 293                 obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
 294                 obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
 295                 obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
 296                 obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
 297                 attids[n] = md.ctr.ctr1.array[i].attid;
 298                 n++;
 299         }
 300
 301         /* ignore it if its an empty change. Note that renames always
 302          * change the 'name' attribute, so they won't be ignored by
 303          * this
 304
 305          * the force_object_return check is used to force an empty
 306          * object return when we timeout in the getncchanges loop.
 307          * This allows us to return an empty object, which keeps the
 308          * client happy while preventing timeouts
 309          */
 310         if (n == 0 ||
 311             (n == 1 &&
 312              attids[0] == DRSUAPI_ATTID_instanceType &&
 313              !force_object_return)) {
 314                 talloc_free(obj->meta_data_ctr);
 315                 obj->meta_data_ctr = NULL;
 316                 return WERR_OK;
 317         }
 318
 319         obj->meta_data_ctr->count = n;
 320
 321         obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
 322         obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
 323         obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
 324                                                             obj->object.attribute_ctr.num_attributes);
 325         if (obj->object.attribute_ctr.attributes == NULL) {
 326                 return WERR_NOMEM;
 327         }
 328
 329         /*
 330          * Note that the meta_data array and the attributes array must
 331          * be the same size and in the same order
 332          */
 333         for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
 334                 struct ldb_message_element *el;
 335                 WERROR werr;
 336                 const struct dsdb_attribute *sa;
 337
 338                 sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
 339                 if (!sa) {
 340                         DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
 341                         return WERR_DS_DRA_INTERNAL_ERROR;
 342                 }
 343
 344                 el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
 345                 if (el == NULL) {
 346                         /* this happens for attributes that have been removed */
 347                         DEBUG(5,("No element '%s' for attributeID %u in message\n",
 348                                  sa->lDAPDisplayName, attids[i]));
 349                         ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
 350                         obj->object.attribute_ctr.attributes[i].attid =
 351                                         dsdb_attribute_get_attid(sa, syntax_ctx.is_schema_nc);
 352                 } else {
 353                         werr = sa->syntax->ldb_to_drsuapi(&syntax_ctx, sa, el, obj,
 354                                                           &obj->object.attribute_ctr.attributes[i]);
 355                         if (!W_ERROR_IS_OK(werr)) {
 356                                 DEBUG(0,("Unable to convert %s on %s to DRS object - %s\n",
 357                                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn),
 358                                          win_errstr(werr)));
 359                                 return werr;
 360                         }
 361                         /* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
 362                          * check if attribute is secret and send a null value
 363                          */
 364                         if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
 365                                 drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
 366                                                                  &obj->meta_data_ctr->meta_data[i]);
 367                         }
 368                         /* some attributes needs to be encrypted
 369                            before being sent */
 370                         werr = drsuapi_encrypt_attribute(obj, session_key, rid,
 371                                                          &obj->object.attribute_ctr.attributes[i]);
 372                         if (!W_ERROR_IS_OK(werr)) {
 373                                 DEBUG(0,("Unable to encrypt %s on %s in DRS object - %s\n",
 374                                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn),
 375                                          win_errstr(werr)));
 376                                 return werr;
 377                         }
 378                 }
 379         }
 380
 381         return WERR_OK;
 382 }
 383
 384 /*
 385   add one linked attribute from an object to the list of linked
 386   attributes in a getncchanges request
 387  */
 388 static WERROR get_nc_changes_add_la(TALLOC_CTX *mem_ctx,
 389                                     struct ldb_context *sam_ctx,
 390                                     const struct dsdb_schema *schema,
 391                                     const struct dsdb_attribute *sa,
 392                                     struct ldb_message *msg,
 393                                     struct dsdb_dn *dsdb_dn,
 394                                     struct drsuapi_DsReplicaLinkedAttribute **la_list,
 395                                     uint32_t *la_count)
 396 {
 397         struct drsuapi_DsReplicaLinkedAttribute *la;
 398         bool active;
 399         NTSTATUS status;
 400         WERROR werr;
 401
 402         (*la_list) = talloc_realloc(mem_ctx, *la_list, struct drsuapi_DsReplicaLinkedAttribute, (*la_count)+1);
 403         W_ERROR_HAVE_NO_MEMORY(*la_list);
 404
 405         la = &(*la_list)[*la_count];
 406
 407         la->identifier = get_object_identifier(*la_list, msg);
 408         W_ERROR_HAVE_NO_MEMORY(la->identifier);
 409
 410         active = (dsdb_dn_rmd_flags(dsdb_dn->dn) & DSDB_RMD_FLAG_DELETED) == 0;
 411
 412         if (!active) {
 413                 /* We have to check that the inactive link still point to an existing object */
 414                 struct GUID guid;
 415                 struct ldb_dn *tdn;
 416                 int ret;
 417                 const char *v;
 418
 419                 v = ldb_msg_find_attr_as_string(msg, "isDeleted", "FALSE");
 420                 if (strncmp(v, "TRUE", 4) == 0) {
 421                         /*
 422                           * Note: we skip the transmition of the deleted link even if the other part used to
 423                           * know about it because when we transmit the deletion of the object, the link will
 424                           * be deleted too due to deletion of object where link points and Windows do so.
 425                           */
 426                         if (dsdb_functional_level(sam_ctx) >= DS_DOMAIN_FUNCTION_2008_R2) {
 427                                 v = ldb_msg_find_attr_as_string(msg, "isRecycled", "FALSE");
 428                                 /*
 429                                  * On Windows 2008R2 isRecycled is always present even if FL or DL are < FL 2K8R2
 430                                  * if it join an existing domain with deleted objets, it firsts impose to have a
 431                                  * schema with the is-Recycled object and for all deleted objects it adds the isRecycled
 432                                  * either during initial replication or after the getNCChanges.
 433                                  * Behavior of samba has been changed to always have this attribute if it's present in the schema.
 434                                  *
 435                                  * So if FL <2K8R2 isRecycled might be here or not but we don't care, it's meaning less.
 436                                  * If FL >=2K8R2 we are sure that this attribute will be here.
 437                                  * For this kind of forest level we do not return the link if the object is recycled
 438                                  * (isRecycled = true).
 439                                  */
 440                                 if (strncmp(v, "TRUE", 4) == 0) {
 441                                         DEBUG(2, (" object %s is recycled, not returning linked attribute !\n",
 442                                                                 ldb_dn_get_linearized(msg->dn)));
 443                                         return WERR_OK;
 444                                 }
 445                         } else {
 446                                 return WERR_OK;
 447                         }
 448                 }
 449                 status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &guid, "GUID");
 450                 if (!NT_STATUS_IS_OK(status)) {
 451                         DEBUG(0,(__location__ " Unable to extract GUID in linked attribute '%s' in '%s'\n",
 452                                 sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 453                         return ntstatus_to_werror(status);
 454                 }
 455                 ret = dsdb_find_dn_by_guid(sam_ctx, mem_ctx, &guid, 0, &tdn);
 456                 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 457                         DEBUG(2, (" Search of guid %s returned 0 objects, skipping it !\n",
 458                                                 GUID_string(mem_ctx, &guid)));
 459                         return WERR_OK;
 460                 } else if (ret != LDB_SUCCESS) {
 461                         DEBUG(0, (__location__ " Search of guid %s failed with error code %d\n",
 462                                                 GUID_string(mem_ctx, &guid),
 463                                                 ret));
 464                         return WERR_OK;
 465                 }
 466         }
 467         la->attid = sa->attributeID_id;
 468         la->flags = active?DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE:0;
 469
 470         status = dsdb_get_extended_dn_uint32(dsdb_dn->dn, &la->meta_data.version, "RMD_VERSION");
 471         if (!NT_STATUS_IS_OK(status)) {
 472                 DEBUG(0,(__location__ " No RMD_VERSION in linked attribute '%s' in '%s'\n",
 473                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 474                 return ntstatus_to_werror(status);
 475         }
 476         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->meta_data.originating_change_time, "RMD_CHANGETIME");
 477         if (!NT_STATUS_IS_OK(status)) {
 478                 DEBUG(0,(__location__ " No RMD_CHANGETIME in linked attribute '%s' in '%s'\n",
 479                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 480                 return ntstatus_to_werror(status);
 481         }
 482         status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &la->meta_data.originating_invocation_id, "RMD_INVOCID");
 483         if (!NT_STATUS_IS_OK(status)) {
 484                 DEBUG(0,(__location__ " No RMD_INVOCID in linked attribute '%s' in '%s'\n",
 485                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 486                 return ntstatus_to_werror(status);
 487         }
 488         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &la->meta_data.originating_usn, "RMD_ORIGINATING_USN");
 489         if (!NT_STATUS_IS_OK(status)) {
 490                 DEBUG(0,(__location__ " No RMD_ORIGINATING_USN in linked attribute '%s' in '%s'\n",
 491                          sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
 492                 return ntstatus_to_werror(status);
 493         }
 494
 495         status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->originating_add_time, "RMD_ADDTIME");
 496         if (!NT_STATUS_IS_OK(status)) {
 497                 /* this is possible for upgraded links */
 498                 la->originating_add_time = la->meta_data.originating_change_time;
 499         }
 500
 501         werr = dsdb_dn_la_to_blob(sam_ctx, sa, schema, *la_list, dsdb_dn, &la->value.blob);
 502         W_ERROR_NOT_OK_RETURN(werr);
 503
 504         (*la_count)++;
 505         return WERR_OK;
 506 }
 507
 508
 509 /*
 510   add linked attributes from an object to the list of linked
 511   attributes in a getncchanges request
 512  */
 513 static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
 514                                        TALLOC_CTX *mem_ctx,
 515                                        struct ldb_dn *ncRoot_dn,
 516                                        struct dsdb_schema *schema,
 517                                        uint64_t highest_usn,
 518                                        uint32_t replica_flags,
 519                                        struct ldb_message *msg,
 520                                        struct drsuapi_DsReplicaLinkedAttribute **la_list,
 521                                        uint32_t *la_count,
 522                                        struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector)
 523 {
 524         unsigned int i;
 525         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 526         uint64_t uSNChanged = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
 527
 528         for (i=0; i<msg->num_elements; i++) {
 529                 struct ldb_message_element *el = &msg->elements[i];
 530                 const struct dsdb_attribute *sa;
 531                 unsigned int j;
 532
 533                 sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
 534
 535                 if (!sa || sa->linkID == 0 || (sa->linkID & 1)) {
 536                         /* we only want forward links */
 537                         continue;
 538                 }
 539
 540                 if (el->num_values && !dsdb_dn_is_upgraded_link_val(&el->values[0])) {
 541                         /* its an old style link, it will have been
 542                          * sent in the main replication data */
 543                         continue;
 544                 }
 545
 546                 for (j=0; j<el->num_values; j++) {
 547                         struct dsdb_dn *dsdb_dn;
 548                         uint64_t local_usn;
 549                         NTSTATUS status;
 550                         WERROR werr;
 551
 552                         dsdb_dn = dsdb_dn_parse(tmp_ctx, sam_ctx, &el->values[j], sa->syntax->ldap_oid);
 553                         if (dsdb_dn == NULL) {
 554                                 DEBUG(1,(__location__ ": Failed to parse DN for %s in %s\n",
 555                                          el->name, ldb_dn_get_linearized(msg->dn)));
 556                                 talloc_free(tmp_ctx);
 557                                 return WERR_DS_DRA_INTERNAL_ERROR;
 558                         }
 559
 560                         status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &local_usn, "RMD_LOCAL_USN");
 561                         if (!NT_STATUS_IS_OK(status)) {
 562                                 /* this can happen for attributes
 563                                    given to us with old style meta
 564                                    data */
 565                                 continue;
 566                         }
 567
 568                         if (local_usn > uSNChanged) {
 569                                 DEBUG(1,(__location__ ": uSNChanged less than RMD_LOCAL_USN for %s on %s\n",
 570                                          el->name, ldb_dn_get_linearized(msg->dn)));
 571                                 talloc_free(tmp_ctx);
 572                                 return WERR_DS_DRA_INTERNAL_ERROR;
 573                         }
 574
 575                         if (local_usn < highest_usn) {
 576                                 continue;
 577                         }
 578
 579                         werr = get_nc_changes_add_la(mem_ctx, sam_ctx, schema, sa, msg,
 580                                                      dsdb_dn, la_list, la_count);
 581                         if (!W_ERROR_IS_OK(werr)) {
 582                                 talloc_free(tmp_ctx);
 583                                 return werr;
 584                         }
 585                 }
 586         }
 587
 588         talloc_free(tmp_ctx);
 589         return WERR_OK;
 590 }
 591
 592 /*
 593   fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
 594  */
 595 static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
 596                                  struct ldb_dn *ncRoot_dn,
 597                                  struct drsuapi_DsReplicaCursor2CtrEx *udv)
 598 {
 599         int ret;
 600
 601         udv->version = 2;
 602         udv->reserved1 = 0;
 603         udv->reserved2 = 0;
 604
 605         ret = dsdb_load_udv_v2(sam_ctx, ncRoot_dn, udv, &udv->cursors, &udv->count);
 606         if (ret != LDB_SUCCESS) {
 607                 DEBUG(0,(__location__ ": Failed to load UDV for %s - %s\n",
 608                          ldb_dn_get_linearized(ncRoot_dn), ldb_errstring(sam_ctx)));
 609                 return WERR_DS_DRA_INTERNAL_ERROR;
 610         }
 611
 612         return WERR_OK;
 613 }
 614
 615
 616 /* comparison function for linked attributes - see CompareLinks() in
 617  * MS-DRSR section 4.1.10.5.17 */
 618 static int linked_attribute_compare(const struct drsuapi_DsReplicaLinkedAttribute *la1,
 619                                     const struct drsuapi_DsReplicaLinkedAttribute *la2,
 620                                     struct ldb_context *sam_ctx)
 621 {
 622         int c;
 623         WERROR werr;
 624         TALLOC_CTX *tmp_ctx;
 625         const struct dsdb_schema *schema;
 626         const struct dsdb_attribute *schema_attrib;
 627         struct dsdb_dn *dn1, *dn2;
 628         struct GUID guid1, guid2;
 629         NTSTATUS status;
 630
 631         c = GUID_compare(&la1->identifier->guid,
 632                          &la2->identifier->guid);
 633         if (c != 0) return c;
 634
 635         if (la1->attid != la2->attid) {
 636                 return la1->attid < la2->attid? -1:1;
 637         }
 638
 639         if ((la1->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) !=
 640             (la2->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)) {
 641                 return (la1->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)? 1:-1;
 642         }
 643
 644         /* we need to get the target GUIDs to compare */
 645         tmp_ctx = talloc_new(sam_ctx);
 646
 647         schema = dsdb_get_schema(sam_ctx, tmp_ctx);
 648         schema_attrib = dsdb_attribute_by_attributeID_id(schema, la1->attid);
 649
 650         werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, tmp_ctx, la1->value.blob, &dn1);
 651         if (!W_ERROR_IS_OK(werr)) {
 652                 DEBUG(0,(__location__ ": Bad la1 blob in sort\n"));
 653                 talloc_free(tmp_ctx);
 654                 return 0;
 655         }
 656
 657         werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, tmp_ctx, la2->value.blob, &dn2);
 658         if (!W_ERROR_IS_OK(werr)) {
 659                 DEBUG(0,(__location__ ": Bad la2 blob in sort\n"));
 660                 talloc_free(tmp_ctx);
 661                 return 0;
 662         }
 663
 664         status = dsdb_get_extended_dn_guid(dn1->dn, &guid1, "GUID");
 665         if (!NT_STATUS_IS_OK(status)) {
 666                 DEBUG(0,(__location__ ": Bad la1 guid in sort\n"));
 667                 talloc_free(tmp_ctx);
 668                 return 0;
 669         }
 670         status = dsdb_get_extended_dn_guid(dn2->dn, &guid2, "GUID");
 671         if (!NT_STATUS_IS_OK(status)) {
 672                 DEBUG(0,(__location__ ": Bad la2 guid in sort\n"));
 673                 talloc_free(tmp_ctx);
 674                 return 0;
 675         }
 676
 677         talloc_free(tmp_ctx);
 678
 679         return GUID_compare(&guid1, &guid2);
 680 }
 681
 682 struct drsuapi_changed_objects {
 683         struct ldb_dn *dn;
 684         struct GUID guid;
 685         uint64_t usn;
 686 };
 687
 688 /*
 689   sort the objects we send by tree order
 690  */
 691 static int site_res_cmp_anc_order(struct drsuapi_changed_objects *m1,
 692                                   struct drsuapi_changed_objects *m2,
 693                                   struct drsuapi_getncchanges_state *getnc_state)
 694 {
 695         return ldb_dn_compare(m2->dn, m1->dn);
 696 }
 697
 698 /*
 699   sort the objects we send first by uSNChanged
 700  */
 701 static int site_res_cmp_usn_order(struct drsuapi_changed_objects *m1,
 702                                   struct drsuapi_changed_objects *m2,
 703                                   struct drsuapi_getncchanges_state *getnc_state)
 704 {
 705         int ret;
 706
 707         ret = ldb_dn_compare(getnc_state->ncRoot_dn, m1->dn);
 708         if (ret == 0) {
 709                 return -1;
 710         }
 711
 712         ret = ldb_dn_compare(getnc_state->ncRoot_dn, m2->dn);
 713         if (ret == 0) {
 714                 return 1;
 715         }
 716
 717         if (m1->usn == m2->usn) {
 718                 return ldb_dn_compare(m2->dn, m1->dn);
 719         }
 720
 721         if (m1->usn < m2->usn) {
 722                 return -1;
 723         }
 724
 725         return 1;
 726 }
 727
 728
 729 /*
 730   handle a DRSUAPI_EXOP_FSMO_RID_ALLOC call
 731  */
 732 static WERROR getncchanges_rid_alloc(struct drsuapi_bind_state *b_state,
 733                                      TALLOC_CTX *mem_ctx,
 734                                      struct drsuapi_DsGetNCChangesRequest10 *req10,
 735                                      struct drsuapi_DsGetNCChangesCtr6 *ctr6)
 736 {
 737         struct ldb_dn *rid_manager_dn, *req_dn;
 738         int ret;
 739         struct ldb_context *ldb = b_state->sam_ctx;
 740         struct ldb_result *ext_res;
 741         struct dsdb_fsmo_extended_op *exop;
 742         bool is_us;
 743
 744         /*
 745           steps:
 746             - verify that the DN being asked for is the RID Manager DN
 747             - verify that we are the RID Manager
 748          */
 749
 750         /* work out who is the RID Manager */
 751         ret = samdb_rid_manager_dn(ldb, mem_ctx, &rid_manager_dn);
 752         if (ret != LDB_SUCCESS) {
 753                 DEBUG(0, (__location__ ": Failed to find RID Manager object - %s\n", ldb_errstring(ldb)));
 754                 return WERR_DS_DRA_INTERNAL_ERROR;
 755         }
 756
 757         req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
 758         if (!ldb_dn_validate(req_dn) ||
 759             ldb_dn_compare(req_dn, rid_manager_dn) != 0) {
 760                 /* that isn't the RID Manager DN */
 761                 DEBUG(0,(__location__ ": RID Alloc request for wrong DN %s\n",
 762                          drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
 763                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
 764                 return WERR_OK;
 765         }
 766
 767         /* find the DN of the RID Manager */
 768         ret = samdb_reference_dn_is_our_ntdsa(ldb, rid_manager_dn, "fSMORoleOwner", &is_us);
 769         if (ret != LDB_SUCCESS) {
 770                 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
 771                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
 772                 return WERR_DS_DRA_INTERNAL_ERROR;
 773         }
 774
 775         if (!is_us) {
 776                 /* we're not the RID Manager - go away */
 777                 DEBUG(0,(__location__ ": RID Alloc request when not RID Manager\n"));
 778                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
 779                 return WERR_OK;
 780         }
 781
 782         exop = talloc(mem_ctx, struct dsdb_fsmo_extended_op);
 783         W_ERROR_HAVE_NO_MEMORY(exop);
 784
 785         exop->fsmo_info = req10->fsmo_info;
 786         exop->destination_dsa_guid = req10->destination_dsa_guid;
 787
 788         ret = ldb_transaction_start(ldb);
 789         if (ret != LDB_SUCCESS) {
 790                 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
 791                          ldb_errstring(ldb)));
 792                 return WERR_DS_DRA_INTERNAL_ERROR;
 793         }
 794
 795         /*
 796          * FIXME (kim): this is a temp hack to return just few object,
 797          * but not the whole domain NC.
 798          * We should remove this hack and implement a 'scope'
 799          * building function to return just the set of object
 800          * documented for DRSUAPI_EXOP_FSMO_RID_ALLOC extended_op
 801          */
 802         ldb_sequence_number(ldb, LDB_SEQ_HIGHEST_SEQ, &req10->highwatermark.highest_usn);
 803
 804         ret = ldb_extended(ldb, DSDB_EXTENDED_ALLOCATE_RID_POOL, exop, &ext_res);
 805         if (ret != LDB_SUCCESS) {
 806                 DEBUG(0,(__location__ ": Failed extended allocation RID pool operation - %s\n",
 807                          ldb_errstring(ldb)));
 808                 ldb_transaction_cancel(ldb);
 809                 return WERR_DS_DRA_INTERNAL_ERROR;
 810         }
 811
 812         ret = ldb_transaction_commit(ldb);
 813         if (ret != LDB_SUCCESS) {
 814                 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
 815                          ldb_errstring(ldb)));
 816                 return WERR_DS_DRA_INTERNAL_ERROR;
 817         }
 818
 819         talloc_free(ext_res);
 820
 821         DEBUG(2,("Allocated RID pool for server %s\n",
 822                  GUID_string(mem_ctx, &req10->destination_dsa_guid)));
 823
 824         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
 825
 826         return WERR_OK;
 827 }
 828
 829 /*
 830   return an array of SIDs from a ldb_message given an attribute name
 831   assumes the SIDs are in extended DN format
 832  */
 833 static WERROR samdb_result_sid_array_dn(struct ldb_context *sam_ctx,
 834                                         struct ldb_message *msg,
 835                                         TALLOC_CTX *mem_ctx,
 836                                         const char *attr,
 837                                         const struct dom_sid ***sids)
 838 {
 839         struct ldb_message_element *el;
 840         unsigned int i;
 841
 842         el = ldb_msg_find_element(msg, attr);
 843         if (!el) {
 844                 *sids = NULL;
 845                 return WERR_OK;
 846         }
 847
 848         (*sids) = talloc_array(mem_ctx, const struct dom_sid *, el->num_values + 1);
 849         W_ERROR_HAVE_NO_MEMORY(*sids);
 850
 851         for (i=0; i<el->num_values; i++) {
 852                 struct ldb_dn *dn = ldb_dn_from_ldb_val(mem_ctx, sam_ctx, &el->values[i]);
 853                 NTSTATUS status;
 854                 struct dom_sid *sid;
 855
 856                 sid = talloc(*sids, struct dom_sid);
 857                 W_ERROR_HAVE_NO_MEMORY(sid);
 858                 status = dsdb_get_extended_dn_sid(dn, sid, "SID");
 859                 if (!NT_STATUS_IS_OK(status)) {
 860                         return WERR_INTERNAL_DB_CORRUPTION;
 861                 }
 862                 (*sids)[i] = sid;
 863         }
 864         (*sids)[i] = NULL;
 865
 866         return WERR_OK;
 867 }
 868
 869
 870 /*
 871   return an array of SIDs from a ldb_message given an attribute name
 872   assumes the SIDs are in NDR form
 873  */
 874 static WERROR samdb_result_sid_array_ndr(struct ldb_context *sam_ctx,
 875                                          struct ldb_message *msg,
 876                                          TALLOC_CTX *mem_ctx,
 877                                          const char *attr,
 878                                          const struct dom_sid ***sids)
 879 {
 880         struct ldb_message_element *el;
 881         unsigned int i;
 882
 883         el = ldb_msg_find_element(msg, attr);
 884         if (!el) {
 885                 *sids = NULL;
 886                 return WERR_OK;
 887         }
 888
 889         (*sids) = talloc_array(mem_ctx, const struct dom_sid *, el->num_values + 1);
 890         W_ERROR_HAVE_NO_MEMORY(*sids);
 891
 892         for (i=0; i<el->num_values; i++) {
 893                 enum ndr_err_code ndr_err;
 894                 struct dom_sid *sid;
 895
 896                 sid = talloc(*sids, struct dom_sid);
 897                 W_ERROR_HAVE_NO_MEMORY(sid);
 898
 899                 ndr_err = ndr_pull_struct_blob(&el->values[i], sid, sid,
 900                                                (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
 901                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 902                         return WERR_INTERNAL_DB_CORRUPTION;
 903                 }
 904                 (*sids)[i] = sid;
 905         }
 906         (*sids)[i] = NULL;
 907
 908         return WERR_OK;
 909 }
 910
 911 /*
 912   see if any SIDs in list1 are in list2
 913  */
 914 static bool sid_list_match(const struct dom_sid **list1, const struct dom_sid **list2)
 915 {
 916         unsigned int i, j;
 917         /* do we ever have enough SIDs here to worry about O(n^2) ? */
 918         for (i=0; list1[i]; i++) {
 919                 for (j=0; list2[j]; j++) {
 920                         if (dom_sid_equal(list1[i], list2[j])) {
 921                                 return true;
 922                         }
 923                 }
 924         }
 925         return false;
 926 }
 927
 928 /*
 929   handle a DRSUAPI_EXOP_REPL_SECRET call
 930  */
 931 static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
 932                                        TALLOC_CTX *mem_ctx,
 933                                        struct drsuapi_DsGetNCChangesRequest10 *req10,
 934                                        struct dom_sid *user_sid,
 935                                        struct drsuapi_DsGetNCChangesCtr6 *ctr6,
 936                                        bool has_get_all_changes)
 937 {
 938         struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
 939         struct ldb_dn *obj_dn, *rodc_dn, *krbtgt_link_dn;
 940         int ret;
 941         const char *rodc_attrs[] = { "msDS-KrbTgtLink", "msDS-NeverRevealGroup", "msDS-RevealOnDemandGroup", NULL };
 942         const char *obj_attrs[] = { "tokenGroups", "objectSid", "UserAccountControl", "msDS-KrbTgtLinkBL", NULL };
 943         struct ldb_result *rodc_res, *obj_res;
 944         const struct dom_sid **never_reveal_sids, **reveal_sids, **token_sids;
 945         WERROR werr;
 946
 947         DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_SECRET extended op on %s\n",
 948                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
 949
 950         /*
 951          * we need to work out if we will allow this DC to
 952          * replicate the secrets for this object
 953          *
 954          * see 4.1.10.5.14 GetRevealSecretsPolicyForUser for details
 955          * of this function
 956          */
 957
 958         if (b_state->sam_ctx_system == NULL) {
 959                 /* this operation needs system level access */
 960                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_ACCESS_DENIED;
 961                 return WERR_DS_DRA_SOURCE_DISABLED;
 962         }
 963
 964         /*
 965          * In MS-DRSR.pdf 5.99 IsGetNCChangesPermissionGranted
 966          *
 967          * The pseudo code indicate
 968          * revealsecrets = true
 969          * if IsRevealSecretRequest(msgIn) then
 970          *   if AccessCheckCAR(ncRoot, Ds-Replication-Get-Changes-All) = false
 971          *   then
 972          *     if (msgIn.ulExtendedOp = EXOP_REPL_SECRETS) then
 973          *     <... check if this account is ok to be replicated on this DC ...>
 974          *     <... and if not reveal secrets = no ...>
 975          *     else
 976          *       reveal secrets = false
 977          *     endif
 978          *   endif
 979          * endif
 980          *
 981          * Which basically means that if you have GET_ALL_CHANGES rights (~== RWDC)
 982          * then you can do EXOP_REPL_SECRETS
 983          */
 984         if (has_get_all_changes) {
 985                 goto allowed;
 986         }
 987
 988         obj_dn = drs_ObjectIdentifier_to_dn(mem_ctx, b_state->sam_ctx_system, ncRoot);
 989         if (!ldb_dn_validate(obj_dn)) goto failed;
 990
 991         rodc_dn = ldb_dn_new_fmt(mem_ctx, b_state->sam_ctx_system, "<SID=%s>",
 992                                  dom_sid_string(mem_ctx, user_sid));
 993         if (!ldb_dn_validate(rodc_dn)) goto failed;
 994
 995         /* do the two searches we need */
 996         ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &rodc_res, rodc_dn, rodc_attrs,
 997                              DSDB_SEARCH_SHOW_EXTENDED_DN);
 998         if (ret != LDB_SUCCESS || rodc_res->count != 1) goto failed;
 999
1000         ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &obj_res, obj_dn, obj_attrs, 0);
1001         if (ret != LDB_SUCCESS || obj_res->count != 1) goto failed;
1002
1003         /* if the object SID is equal to the user_sid, allow */
1004         if (dom_sid_equal(user_sid,
1005                           samdb_result_dom_sid(mem_ctx, obj_res->msgs[0], "objectSid"))) {
1006                 goto allowed;
1007         }
1008
1009         /* an RODC is allowed to get its own krbtgt account secrets */
1010         krbtgt_link_dn = samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1011                                          rodc_res->msgs[0], "msDS-KrbTgtLink", NULL);
1012         if (krbtgt_link_dn != NULL &&
1013             ldb_dn_compare(obj_dn, krbtgt_link_dn) == 0) {
1014                 goto allowed;
1015         }
1016
1017         /* but it isn't allowed to get anyone elses krbtgt secrets */
1018         if (samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
1019                             obj_res->msgs[0], "msDS-KrbTgtLinkBL", NULL)) {
1020                 goto denied;
1021         }
1022
1023         if (ldb_msg_find_attr_as_uint(obj_res->msgs[0],
1024                                       "userAccountControl", 0) &
1025             UF_INTERDOMAIN_TRUST_ACCOUNT) {
1026                 goto denied;
1027         }
1028
1029         werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1030                                          mem_ctx, "msDS-NeverRevealGroup", &never_reveal_sids);
1031         if (!W_ERROR_IS_OK(werr)) {
1032                 goto denied;
1033         }
1034
1035         werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
1036                                          mem_ctx, "msDS-RevealOnDemandGroup", &reveal_sids);
1037         if (!W_ERROR_IS_OK(werr)) {
1038                 goto denied;
1039         }
1040
1041         werr = samdb_result_sid_array_ndr(b_state->sam_ctx_system, obj_res->msgs[0],
1042                                          mem_ctx, "tokenGroups", &token_sids);
1043         if (!W_ERROR_IS_OK(werr) || token_sids==NULL) {
1044                 goto denied;
1045         }
1046
1047         if (never_reveal_sids &&
1048             sid_list_match(token_sids, never_reveal_sids)) {
1049                 goto denied;
1050         }
1051
1052         if (reveal_sids &&
1053             sid_list_match(token_sids, reveal_sids)) {
1054                 goto allowed;
1055         }
1056
1057         /* default deny */
1058 denied:
1059         DEBUG(2,(__location__ ": Denied single object with secret replication for %s by RODC %s\n",
1060                  ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
1061         ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1062         return WERR_DS_DRA_ACCESS_DENIED;
1063
1064 allowed:
1065         DEBUG(2,(__location__ ": Allowed single object with secret replication for %s by %s %s\n",
1066                  ldb_dn_get_linearized(obj_dn), has_get_all_changes?"RWDC":"RODC",
1067                  ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
1068         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1069         req10->highwatermark.highest_usn = 0;
1070         return WERR_OK;
1071
1072 failed:
1073         DEBUG(2,(__location__ ": Failed single secret replication for %s by RODC %s\n",
1074                  ldb_dn_get_linearized(obj_dn), dom_sid_string(mem_ctx, user_sid)));
1075         ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
1076         return WERR_DS_DRA_BAD_DN;
1077 }
1078
1079
1080 /*
1081   handle a DRSUAPI_EXOP_REPL_OBJ call
1082  */
1083 static WERROR getncchanges_repl_obj(struct drsuapi_bind_state *b_state,
1084                                     TALLOC_CTX *mem_ctx,
1085                                     struct drsuapi_DsGetNCChangesRequest10 *req10,
1086                                     struct dom_sid *user_sid,
1087                                     struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1088 {
1089         struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
1090
1091         DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_OBJ extended op on %s\n",
1092                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1093
1094         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1095         return WERR_OK;
1096 }
1097
1098
1099 /*
1100   handle DRSUAPI_EXOP_FSMO_REQ_ROLE,
1101   DRSUAPI_EXOP_FSMO_RID_REQ_ROLE,
1102   and DRSUAPI_EXOP_FSMO_REQ_PDC calls
1103  */
1104 static WERROR getncchanges_change_master(struct drsuapi_bind_state *b_state,
1105                                          TALLOC_CTX *mem_ctx,
1106                                          struct drsuapi_DsGetNCChangesRequest10 *req10,
1107                                          struct drsuapi_DsGetNCChangesCtr6 *ctr6)
1108 {
1109         struct ldb_dn *req_dn, *ntds_dn;
1110         int ret;
1111         unsigned int i;
1112         struct ldb_context *ldb = b_state->sam_ctx;
1113         struct ldb_message *msg;
1114         bool is_us;
1115
1116         /*
1117           steps:
1118             - verify that the client dn exists
1119             - verify that we are the current master
1120          */
1121
1122         req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
1123         if (!ldb_dn_validate(req_dn)) {
1124                 /* that is not a valid dn */
1125                 DEBUG(0,(__location__ ": FSMO role transfer request for invalid DN %s\n",
1126                          drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
1127                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
1128                 return WERR_OK;
1129         }
1130
1131         /* find the DN of the current role owner */
1132         ret = samdb_reference_dn_is_our_ntdsa(ldb, req_dn, "fSMORoleOwner", &is_us);
1133         if (ret != LDB_SUCCESS) {
1134                 DEBUG(0,("Failed to find fSMORoleOwner in RID Manager object\n"));
1135                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1136                 return WERR_DS_DRA_INTERNAL_ERROR;
1137         }
1138
1139         if (!is_us) {
1140                 /* we're not the RID Manager or role owner - go away */
1141                 DEBUG(0,(__location__ ": FSMO role or RID manager transfer owner request when not role owner\n"));
1142                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
1143                 return WERR_OK;
1144         }
1145
1146         /* change the current master */
1147         msg = ldb_msg_new(ldb);
1148         W_ERROR_HAVE_NO_MEMORY(msg);
1149         msg->dn = drs_ObjectIdentifier_to_dn(msg, ldb, req10->naming_context);
1150         W_ERROR_HAVE_NO_MEMORY(msg->dn);
1151
1152         /* TODO: make sure ntds_dn is a valid nTDSDSA object */
1153         ret = dsdb_find_dn_by_guid(ldb, msg, &req10->destination_dsa_guid, 0, &ntds_dn);
1154         if (ret != LDB_SUCCESS) {
1155                 DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
1156                           GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
1157                 talloc_free(msg);
1158                 ctr6->extended_ret = DRSUAPI_EXOP_ERR_UNKNOWN_CALLER;
1159                 return WERR_OK;
1160         }
1161
1162         ret = ldb_msg_add_string(msg, "fSMORoleOwner", ldb_dn_get_linearized(ntds_dn));
1163         if (ret != 0) {
1164                 talloc_free(msg);
1165                 return WERR_DS_DRA_INTERNAL_ERROR;
1166         }
1167
1168         for (i=0;i<msg->num_elements;i++) {
1169                 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1170         }
1171
1172         ret = ldb_transaction_start(ldb);
1173         if (ret != LDB_SUCCESS) {
1174                 DEBUG(0,(__location__ ": Failed transaction start - %s\n",
1175                          ldb_errstring(ldb)));
1176                 return WERR_DS_DRA_INTERNAL_ERROR;
1177         }
1178
1179         ret = ldb_modify(ldb, msg);
1180         if (ret != LDB_SUCCESS) {
1181                 DEBUG(0,(__location__ ": Failed to change current owner - %s\n",
1182                          ldb_errstring(ldb)));
1183                 ldb_transaction_cancel(ldb);
1184                 return WERR_DS_DRA_INTERNAL_ERROR;
1185         }
1186
1187         ret = ldb_transaction_commit(ldb);
1188         if (ret != LDB_SUCCESS) {
1189                 DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
1190                          ldb_errstring(ldb)));
1191                 return WERR_DS_DRA_INTERNAL_ERROR;
1192         }
1193
1194         ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1195
1196         return WERR_OK;
1197 }
1198
1199 /*
1200   see if this getncchanges request includes a request to reveal secret information
1201  */
1202 static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state *b_state,
1203                                                        struct drsuapi_DsGetNCChangesRequest10 *req10,
1204                                                        bool *is_secret_request)
1205 {
1206         enum drsuapi_DsExtendedOperation exop;
1207         uint32_t i;
1208         struct dsdb_schema *schema;
1209
1210         *is_secret_request = true;
1211
1212         exop = req10->extended_op;
1213
1214         switch (exop) {
1215         case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1216         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1217         case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1218         case DRSUAPI_EXOP_FSMO_REQ_PDC:
1219         case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1220                 /* FSMO exops can reveal secrets */
1221                 *is_secret_request = true;
1222                 return WERR_OK;
1223         case DRSUAPI_EXOP_REPL_SECRET:
1224         case DRSUAPI_EXOP_REPL_OBJ:
1225         case DRSUAPI_EXOP_NONE:
1226                 break;
1227         }
1228
1229         if (req10->replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
1230                 *is_secret_request = false;
1231                 return WERR_OK;
1232         }
1233
1234         if (exop == DRSUAPI_EXOP_REPL_SECRET ||
1235             req10->partial_attribute_set == NULL) {
1236                 /* they want secrets */
1237                 *is_secret_request = true;
1238                 return WERR_OK;
1239         }
1240
1241         schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1242
1243         /* check the attributes they asked for */
1244         for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1245                 const struct dsdb_attribute *sa;
1246                 sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set->attids[i]);
1247                 if (sa == NULL) {
1248                         return WERR_DS_DRA_SCHEMA_MISMATCH;
1249                 }
1250                 if (!dsdb_attr_in_rodc_fas(sa)) {
1251                         *is_secret_request = true;
1252                         return WERR_OK;
1253                 }
1254         }
1255
1256         if (req10->partial_attribute_set_ex) {
1257                 /* check the extended attributes they asked for */
1258                 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1259                         const struct dsdb_attribute *sa;
1260                         sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set_ex->attids[i]);
1261                         if (sa == NULL) {
1262                                 return WERR_DS_DRA_SCHEMA_MISMATCH;
1263                         }
1264                         if (!dsdb_attr_in_rodc_fas(sa)) {
1265                                 *is_secret_request = true;
1266                                 return WERR_OK;
1267                         }
1268                 }
1269         }
1270
1271         *is_secret_request = false;
1272         return WERR_OK;
1273 }
1274
1275 /*
1276   see if this getncchanges request is only for attributes in the GC
1277   partial attribute set
1278  */
1279 static WERROR dcesrv_drsuapi_is_gc_pas_request(struct drsuapi_bind_state *b_state,
1280                                                struct drsuapi_DsGetNCChangesRequest10 *req10,
1281                                                bool *is_gc_pas_request)
1282 {
1283         enum drsuapi_DsExtendedOperation exop;
1284         uint32_t i;
1285         struct dsdb_schema *schema;
1286
1287         exop = req10->extended_op;
1288
1289         switch (exop) {
1290         case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1291         case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1292         case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1293         case DRSUAPI_EXOP_FSMO_REQ_PDC:
1294         case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1295         case DRSUAPI_EXOP_REPL_SECRET:
1296                 *is_gc_pas_request = false;
1297                 return WERR_OK;
1298         case DRSUAPI_EXOP_REPL_OBJ:
1299         case DRSUAPI_EXOP_NONE:
1300                 break;
1301         }
1302
1303         if (req10->partial_attribute_set == NULL) {
1304                 /* they want it all */
1305                 *is_gc_pas_request = false;
1306                 return WERR_OK;
1307         }
1308
1309         schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1310
1311         /* check the attributes they asked for */
1312         for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1313                 const struct dsdb_attribute *sa;
1314                 sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set->attids[i]);
1315                 if (sa == NULL) {
1316                         return WERR_DS_DRA_SCHEMA_MISMATCH;
1317                 }
1318                 if (!sa->isMemberOfPartialAttributeSet) {
1319                         *is_gc_pas_request = false;
1320                         return WERR_OK;
1321                 }
1322         }
1323
1324         if (req10->partial_attribute_set_ex) {
1325                 /* check the extended attributes they asked for */
1326                 for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1327                         const struct dsdb_attribute *sa;
1328                         sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set_ex->attids[i]);
1329                         if (sa == NULL) {
1330                                 return WERR_DS_DRA_SCHEMA_MISMATCH;
1331                         }
1332                         if (!sa->isMemberOfPartialAttributeSet) {
1333                                 *is_gc_pas_request = false;
1334                                 return WERR_OK;
1335                         }
1336                 }
1337         }
1338
1339         *is_gc_pas_request = true;
1340         return WERR_OK;
1341 }
1342
1343
1344 /*
1345   map from req8 to req10
1346  */
1347 static struct drsuapi_DsGetNCChangesRequest10 *
1348 getncchanges_map_req8(TALLOC_CTX *mem_ctx,
1349                       struct drsuapi_DsGetNCChangesRequest8 *req8)
1350 {
1351         struct drsuapi_DsGetNCChangesRequest10 *req10 = talloc_zero(mem_ctx,
1352                                                                     struct drsuapi_DsGetNCChangesRequest10);
1353         if (req10 == NULL) {
1354                 return NULL;
1355         }
1356
1357         req10->destination_dsa_guid = req8->destination_dsa_guid;
1358         req10->source_dsa_invocation_id = req8->source_dsa_invocation_id;
1359         req10->naming_context = req8->naming_context;
1360         req10->highwatermark = req8->highwatermark;
1361         req10->uptodateness_vector = req8->uptodateness_vector;
1362         req10->replica_flags = req8->replica_flags;
1363         req10->max_object_count = req8->max_object_count;
1364         req10->max_ndr_size = req8->max_ndr_size;
1365         req10->extended_op = req8->extended_op;
1366         req10->fsmo_info = req8->fsmo_info;
1367         req10->partial_attribute_set = req8->partial_attribute_set;
1368         req10->partial_attribute_set_ex = req8->partial_attribute_set_ex;
1369         req10->mapping_ctr = req8->mapping_ctr;
1370
1371         return req10;
1372 }
1373
1374
1375 /**
1376  * Collects object for normal replication cycle.
1377  */
1378 static WERROR getncchanges_collect_objects(struct drsuapi_bind_state *b_state,
1379                                            TALLOC_CTX *mem_ctx,
1380                                            struct drsuapi_DsGetNCChangesRequest10 *req10,
1381                                            struct ldb_dn *search_dn,
1382                                            const char *extra_filter,
1383                                            struct ldb_result **search_res)
1384 {
1385         int ret;
1386         char* search_filter;
1387         enum ldb_scope scope = LDB_SCOPE_SUBTREE;
1388         //const char *extra_filter;
1389         struct drsuapi_getncchanges_state *getnc_state = b_state->getncchanges_state;
1390         const char *attrs[] = { "uSNChanged",
1391                                 "objectGUID" ,
1392                                 NULL };
1393
1394         if (req10->extended_op == DRSUAPI_EXOP_REPL_OBJ ||
1395             req10->extended_op == DRSUAPI_EXOP_REPL_SECRET) {
1396                 scope = LDB_SCOPE_BASE;
1397         }
1398
1399         //extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
1400
1401         //getnc_state->min_usn = req10->highwatermark.highest_usn;
1402
1403         /* Construct response. */
1404         search_filter = talloc_asprintf(mem_ctx,
1405                                         "(uSNChanged>=%llu)",
1406                                         (unsigned long long)(getnc_state->min_usn+1));
1407
1408         if (extra_filter) {
1409                 search_filter = talloc_asprintf(mem_ctx, "(&%s(%s))", search_filter, extra_filter);
1410         }
1411
1412         if (req10->replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
1413                 search_filter = talloc_asprintf(mem_ctx,
1414                                                 "(&%s(isCriticalSystemObject=TRUE))",
1415                                                 search_filter);
1416         }
1417
1418         if (req10->replica_flags & DRSUAPI_DRS_ASYNC_REP) {
1419                 scope = LDB_SCOPE_BASE;
1420         }
1421
1422         if (!search_dn) {
1423                 search_dn = getnc_state->ncRoot_dn;
1424         }
1425
1426         DEBUG(2,(__location__ ": getncchanges on %s using filter %s\n",
1427                  ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
1428         ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, search_res,
1429                                               search_dn, scope, attrs,
1430                                               search_filter);
1431         if (ret != LDB_SUCCESS) {
1432                 return WERR_DS_DRA_INTERNAL_ERROR;
1433         }
1434
1435         return WERR_OK;
1436 }
1437
1438 /**
1439  * Collects object for normal replication cycle.
1440  */
1441 static WERROR getncchanges_collect_objects_exop(struct drsuapi_bind_state *b_state,
1442                                                 TALLOC_CTX *mem_ctx,
1443                                                 struct drsuapi_DsGetNCChangesRequest10 *req10,
1444                                                 struct drsuapi_DsGetNCChangesCtr6 *ctr6,
1445                                                 struct ldb_dn *search_dn,
1446                                                 const char *extra_filter,
1447                                                 struct ldb_result **search_res)
1448 {
1449         /* we have nothing to do in case of ex-op failure */
1450         if (ctr6->extended_ret != DRSUAPI_EXOP_ERR_SUCCESS) {
1451                 return WERR_OK;
1452         }
1453
1454         /* TODO: implement extended op specific collection
1455          * of objects. Right now we just normal procedure
1456          * for collecting objects */
1457         return getncchanges_collect_objects(b_state, mem_ctx, req10, search_dn, extra_filter, search_res);
1458 }
1459
1460 /*
1461   drsuapi_DsGetNCChanges
1462
1463   see MS-DRSR 4.1.10.5.2 for basic logic of this function
1464 */
1465 WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
1466                                      struct drsuapi_DsGetNCChanges *r)
1467 {
1468         struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
1469         int ret;
1470         uint32_t i;
1471         struct dsdb_schema *schema;
1472         struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
1473         struct drsuapi_DsReplicaObjectListItemEx **currentObject;
1474         NTSTATUS status;
1475         DATA_BLOB session_key;
1476         WERROR werr;
1477         struct dcesrv_handle *h;
1478         struct drsuapi_bind_state *b_state;
1479         struct drsuapi_getncchanges_state *getnc_state;
1480         struct drsuapi_DsGetNCChangesRequest10 *req10;
1481         uint32_t options;
1482         uint32_t max_objects;
1483         uint32_t max_links;
1484         uint32_t link_count = 0;
1485         uint32_t link_total = 0;
1486         uint32_t link_given = 0;
1487         struct ldb_dn *search_dn = NULL;
1488         bool am_rodc, null_scope=false;
1489         enum security_user_level security_level;
1490         struct ldb_context *sam_ctx;
1491         struct dom_sid *user_sid;
1492         bool is_secret_request;
1493         bool is_gc_pas_request;
1494         struct drsuapi_changed_objects *changes;
1495         time_t max_wait;
1496         time_t start = time(NULL);
1497         bool max_wait_reached = false;
1498         bool has_get_all_changes = false;
1499         struct GUID invocation_id;
1500
1501         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
1502         b_state = h->data;
1503
1504         sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
1505
1506         invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
1507
1508         *r->out.level_out = 6;
1509         /* TODO: linked attributes*/
1510         r->out.ctr->ctr6.linked_attributes_count = 0;
1511         r->out.ctr->ctr6.linked_attributes = NULL;
1512
1513         r->out.ctr->ctr6.object_count = 0;
1514         r->out.ctr->ctr6.nc_object_count = 0;
1515         r->out.ctr->ctr6.more_data = false;
1516         r->out.ctr->ctr6.uptodateness_vector = NULL;
1517
1518         /* a RODC doesn't allow for any replication */
1519         ret = samdb_rodc(sam_ctx, &am_rodc);
1520         if (ret == LDB_SUCCESS && am_rodc) {
1521                 DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
1522                 return WERR_DS_DRA_SOURCE_DISABLED;
1523         }
1524
1525         /* Check request revision.
1526          */
1527         switch (r->in.level) {
1528         case 8:
1529                 req10 = getncchanges_map_req8(mem_ctx, &r->in.req->req8);
1530                 if (req10 == NULL) {
1531                         return WERR_NOMEM;
1532                 }
1533                 break;
1534         case 10:
1535                 req10 = &r->in.req->req10;
1536                 break;
1537         default:
1538                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
1539                          r->in.level));
1540                 return WERR_REVISION_MISMATCH;
1541         }
1542
1543
1544         /* Perform access checks. */
1545         /* TODO: we need to support a sync on a specific non-root
1546          * DN. We'll need to find the real partition root here */
1547         ncRoot = req10->naming_context;
1548         if (ncRoot == NULL) {
1549                 DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
1550                 return WERR_DS_DRA_INVALID_PARAMETER;
1551         }
1552
1553         if (samdb_ntds_options(sam_ctx, &options) != LDB_SUCCESS) {
1554                 return WERR_DS_DRA_INTERNAL_ERROR;
1555         }
1556
1557         if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
1558             !(req10->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
1559                 return WERR_DS_DRA_SOURCE_DISABLED;
1560         }
1561
1562         user_sid = &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
1563
1564         /* all clients must have GUID_DRS_GET_CHANGES */
1565         werr = drs_security_access_check_nc_root(b_state->sam_ctx,
1566                                                  mem_ctx,
1567                                                  dce_call->conn->auth_state.session_info->security_token,
1568                                                  req10->naming_context,
1569                                                  GUID_DRS_GET_CHANGES);
1570         if (!W_ERROR_IS_OK(werr)) {
1571                 return werr;
1572         }
1573
1574         /* allowed if the GC PAS and client has
1575            GUID_DRS_GET_FILTERED_ATTRIBUTES */
1576         werr = dcesrv_drsuapi_is_gc_pas_request(b_state, req10, &is_gc_pas_request);
1577         if (!W_ERROR_IS_OK(werr)) {
1578                 return werr;
1579         }
1580         if (is_gc_pas_request) {
1581                 werr = drs_security_access_check_nc_root(b_state->sam_ctx,
1582                                                          mem_ctx,
1583                                                          dce_call->conn->auth_state.session_info->security_token,
1584                                                          req10->naming_context,
1585                                                          GUID_DRS_GET_FILTERED_ATTRIBUTES);
1586                 if (W_ERROR_IS_OK(werr)) {
1587                         goto allowed;
1588                 }
1589         }
1590
1591         werr = dcesrv_drsuapi_is_reveal_secrets_request(b_state, req10, &is_secret_request);
1592         if (!W_ERROR_IS_OK(werr)) {
1593                 return werr;
1594         }
1595         if (is_secret_request && req10->extended_op != DRSUAPI_EXOP_REPL_SECRET) {
1596                 werr = drs_security_access_check_nc_root(b_state->sam_ctx,
1597                                                          mem_ctx,
1598                                                          dce_call->conn->auth_state.session_info->security_token,
1599                                                          req10->naming_context,
1600                                                          GUID_DRS_GET_ALL_CHANGES);
1601                 if (!W_ERROR_IS_OK(werr)) {
1602                         return werr;
1603                 } else {
1604                         has_get_all_changes = true;
1605                 }
1606         }
1607
1608 allowed:
1609         /* for non-administrator replications, check that they have
1610            given the correct source_dsa_invocation_id */
1611         security_level = security_session_user_level(dce_call->conn->auth_state.session_info,
1612                                                      samdb_domain_sid(sam_ctx));
1613         if (security_level == SECURITY_RO_DOMAIN_CONTROLLER) {
1614                 if (req10->replica_flags & DRSUAPI_DRS_WRIT_REP) {
1615                         /* we rely on this flag being unset for RODC requests */
1616                         req10->replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
1617                 }
1618         }
1619
1620         if (req10->replica_flags & DRSUAPI_DRS_FULL_SYNC_PACKET) {
1621                 /* Ignore the _in_ uptpdateness vector*/
1622                 req10->uptodateness_vector = NULL;
1623         }
1624
1625         if (GUID_all_zero(&req10->source_dsa_invocation_id)) {
1626                 req10->source_dsa_invocation_id = invocation_id;
1627         }
1628
1629         if (!GUID_equal(&req10->source_dsa_invocation_id, &invocation_id)) {
1630                 /*
1631                  * The given highwatermark is only valid relative to the
1632                  * specified source_dsa_invocation_id.
1633                  */
1634                 ZERO_STRUCT(req10->highwatermark);
1635         }
1636
1637         getnc_state = b_state->getncchanges_state;
1638
1639         /* see if a previous replication has been abandoned */
1640         if (getnc_state) {
1641                 struct ldb_dn *new_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
1642                 if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
1643                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s (last_dn %s)\n",
1644                                  ldb_dn_get_linearized(new_dn),
1645                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn),
1646                                  ldb_dn_get_linearized(getnc_state->last_dn)));
1647                         talloc_free(getnc_state);
1648                         getnc_state = NULL;
1649                 }
1650         }
1651
1652         if (getnc_state) {
1653                 ret = drsuapi_DsReplicaHighWaterMark_cmp(&getnc_state->last_hwm,
1654                                                          &req10->highwatermark);
1655                 if (ret != 0) {
1656                         DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication "
1657                                  "on DN %s %s highwatermark (last_dn %s)\n",
1658                                  ldb_dn_get_linearized(getnc_state->ncRoot_dn),
1659                                  (ret > 0) ? "older" : "newer",
1660                                  ldb_dn_get_linearized(getnc_state->last_dn)));
1661                         talloc_free(getnc_state);
1662                         getnc_state = NULL;
1663                 }
1664         }
1665
1666         if (getnc_state == NULL) {
1667                 getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
1668                 if (getnc_state == NULL) {
1669                         return WERR_NOMEM;
1670                 }
1671                 b_state->getncchanges_state = getnc_state;
1672                 getnc_state->ncRoot_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
1673
1674                 /* find out if we are to replicate Schema NC */
1675                 ret = ldb_dn_compare(getnc_state->ncRoot_dn,
1676                                      ldb_get_schema_basedn(b_state->sam_ctx));
1677                 getnc_state->is_schema_nc = (0 == ret);
1678
1679                 if (req10->extended_op != DRSUAPI_EXOP_NONE) {
1680                         r->out.ctr->ctr6.extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1681                 }
1682
1683                 /*
1684                  * This is the first replication cycle and it is
1685                  * a good place to handle extended operations
1686                  *
1687                  * FIXME: we don't fully support extended operations yet
1688                  */
1689                 switch (req10->extended_op) {
1690                 case DRSUAPI_EXOP_NONE:
1691                         break;
1692                 case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1693                         werr = getncchanges_rid_alloc(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1694                         W_ERROR_NOT_OK_RETURN(werr);
1695                         search_dn = ldb_get_default_basedn(sam_ctx);
1696                         break;
1697                 case DRSUAPI_EXOP_REPL_SECRET:
1698                         werr = getncchanges_repl_secret(b_state, mem_ctx, req10,
1699                                                         user_sid,
1700                                                         &r->out.ctr->ctr6,
1701                                                         has_get_all_changes);
1702                         r->out.result = werr;
1703                         W_ERROR_NOT_OK_RETURN(werr);
1704                         break;
1705                 case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1706                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1707                         W_ERROR_NOT_OK_RETURN(werr);
1708                         break;
1709                 case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1710                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1711                         W_ERROR_NOT_OK_RETURN(werr);
1712                         break;
1713                 case DRSUAPI_EXOP_FSMO_REQ_PDC:
1714                         werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1715                         W_ERROR_NOT_OK_RETURN(werr);
1716                         break;
1717                 case DRSUAPI_EXOP_REPL_OBJ:
1718                         werr = getncchanges_repl_obj(b_state, mem_ctx, req10, user_sid, &r->out.ctr->ctr6);
1719                         r->out.result = werr;
1720                         W_ERROR_NOT_OK_RETURN(werr);
1721                         break;
1722
1723                 case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1724
1725                         DEBUG(0,(__location__ ": Request for DsGetNCChanges unsupported extended op 0x%x\n",
1726                                  (unsigned)req10->extended_op));
1727                         return WERR_DS_DRA_NOT_SUPPORTED;
1728                 }
1729         }
1730
1731         if (!ldb_dn_validate(getnc_state->ncRoot_dn) ||
1732             ldb_dn_is_null(getnc_state->ncRoot_dn)) {
1733                 DEBUG(0,(__location__ ": Bad DN '%s'\n",
1734                          drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1735                 return WERR_DS_DRA_INVALID_PARAMETER;
1736         }
1737
1738         /* we need the session key for encrypting password attributes */
1739         status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
1740         if (!NT_STATUS_IS_OK(status)) {
1741                 DEBUG(0,(__location__ ": Failed to get session key\n"));
1742                 return WERR_DS_DRA_INTERNAL_ERROR;
1743         }
1744
1745         /*
1746            TODO: MS-DRSR section 4.1.10.1.1
1747            Work out if this is the start of a new cycle */
1748
1749         if (getnc_state->guids == NULL) {
1750                 const char *extra_filter;
1751                 struct ldb_result *search_res = NULL;
1752
1753                 extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
1754
1755                 getnc_state->min_usn = req10->highwatermark.highest_usn;
1756                 getnc_state->max_usn = getnc_state->min_usn;
1757
1758                 getnc_state->final_udv = talloc_zero(getnc_state,
1759                                         struct drsuapi_DsReplicaCursor2CtrEx);
1760                 if (getnc_state->final_udv == NULL) {
1761                         return WERR_NOMEM;
1762                 }
1763                 werr = get_nc_changes_udv(sam_ctx, getnc_state->ncRoot_dn,
1764                                           getnc_state->final_udv);
1765                 if (!W_ERROR_IS_OK(werr)) {
1766                         return werr;
1767                 }
1768
1769                 if (req10->extended_op == DRSUAPI_EXOP_NONE) {
1770                         werr = getncchanges_collect_objects(b_state, mem_ctx, req10,
1771                                                             search_dn, extra_filter,
1772                                                             &search_res);
1773                 } else {
1774                         werr = getncchanges_collect_objects_exop(b_state, mem_ctx, req10,
1775                                                                  &r->out.ctr->ctr6,
1776                                                                  search_dn, extra_filter,
1777                                                                  &search_res);
1778                 }
1779                 W_ERROR_NOT_OK_RETURN(werr);
1780
1781                 /* extract out the GUIDs list */
1782                 getnc_state->num_records = search_res ? search_res->count : 0;
1783                 getnc_state->guids = talloc_array(getnc_state, struct GUID, getnc_state->num_records);
1784                 W_ERROR_HAVE_NO_MEMORY(getnc_state->guids);
1785
1786                 changes = talloc_array(getnc_state,
1787                                        struct drsuapi_changed_objects,
1788                                        getnc_state->num_records);
1789                 W_ERROR_HAVE_NO_MEMORY(changes);
1790
1791                 for (i=0; i<getnc_state->num_records; i++) {
1792                         changes[i].dn = search_res->msgs[i]->dn;
1793                         changes[i].guid = samdb_result_guid(search_res->msgs[i], "objectGUID");
1794                         changes[i].usn = ldb_msg_find_attr_as_uint64(search_res->msgs[i], "uSNChanged", 0);
1795
1796                         if (changes[i].usn > getnc_state->max_usn) {
1797                                 getnc_state->max_usn = changes[i].usn;
1798                         }
1799                 }
1800
1801                 if (req10->replica_flags & DRSUAPI_DRS_GET_ANC) {
1802                         LDB_TYPESAFE_QSORT(changes,
1803                                            getnc_state->num_records,
1804                                            getnc_state,
1805                                            site_res_cmp_anc_order);
1806                 } else {
1807                         LDB_TYPESAFE_QSORT(changes,
1808                                            getnc_state->num_records,
1809                                            getnc_state,
1810                                            site_res_cmp_usn_order);
1811                 }
1812
1813                 for (i=0; i < getnc_state->num_records; i++) {
1814                         getnc_state->guids[i] = changes[i].guid;
1815                         if (GUID_all_zero(&getnc_state->guids[i])) {
1816                                 DEBUG(2,("getncchanges: bad objectGUID from %s\n",
1817                                          ldb_dn_get_linearized(search_res->msgs[i]->dn)));
1818                                 return WERR_DS_DRA_INTERNAL_ERROR;
1819                         }
1820                 }
1821
1822                 getnc_state->final_hwm.tmp_highest_usn = getnc_state->max_usn;
1823                 getnc_state->final_hwm.reserved_usn = 0;
1824                 getnc_state->final_hwm.highest_usn = getnc_state->max_usn;
1825
1826                 talloc_free(search_res);
1827                 talloc_free(changes);
1828         }
1829
1830         if (req10->uptodateness_vector) {
1831                 /* make sure its sorted */
1832                 TYPESAFE_QSORT(req10->uptodateness_vector->cursors,
1833                                req10->uptodateness_vector->count,
1834                                drsuapi_DsReplicaCursor_compare);
1835         }
1836
1837         /* Prefix mapping */
1838         schema = dsdb_get_schema(sam_ctx, mem_ctx);
1839         if (!schema) {
1840                 DEBUG(0,("No schema in sam_ctx\n"));
1841                 return WERR_DS_DRA_INTERNAL_ERROR;
1842         }
1843
1844         r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
1845         *r->out.ctr->ctr6.naming_context = *ncRoot;
1846
1847         if (dsdb_find_guid_by_dn(sam_ctx, getnc_state->ncRoot_dn,
1848                                  &r->out.ctr->ctr6.naming_context->guid) != LDB_SUCCESS) {
1849                 DEBUG(0,(__location__ ": Failed to find GUID of ncRoot_dn %s\n",
1850                          ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
1851                 return WERR_DS_DRA_INTERNAL_ERROR;
1852         }
1853
1854         /* find the SID if there is one */
1855         dsdb_find_sid_by_dn(sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
1856
1857         dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
1858         r->out.ctr->ctr6.mapping_ctr = *ctr;
1859
1860         r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
1861         r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
1862
1863         r->out.ctr->ctr6.old_highwatermark = req10->highwatermark;
1864         r->out.ctr->ctr6.new_highwatermark = req10->highwatermark;
1865
1866         r->out.ctr->ctr6.first_object = NULL;
1867         currentObject = &r->out.ctr->ctr6.first_object;
1868
1869         /* use this to force single objects at a time, which is useful
1870          * for working out what object is giving problems
1871          */
1872         max_objects = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max object sync", 1000);
1873         if (req10->max_object_count < max_objects) {
1874                 max_objects = req10->max_object_count;
1875         }
1876         /*
1877          * TODO: work out how the maximum should be calculated
1878          */
1879         max_links = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max link sync", 1500);
1880
1881         /*
1882          * Maximum time that we can spend in a getncchanges
1883          * in order to avoid timeout of the other part.
1884          * 10 seconds by default.
1885          */
1886         max_wait = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max work time", 10);
1887         for (i=getnc_state->num_processed;
1888              i<getnc_state->num_records &&
1889                      !null_scope &&
1890                      (r->out.ctr->ctr6.object_count < max_objects)
1891                      && !max_wait_reached;
1892             i++) {
1893                 int uSN;
1894                 struct drsuapi_DsReplicaObjectListItemEx *obj;
1895                 struct ldb_message *msg;
1896                 static const char * const msg_attrs[] = {
1897                                             "*",
1898                                             "nTSecurityDescriptor",
1899                                             "parentGUID",
1900                                             "replPropertyMetaData",
1901                                             DSDB_SECRET_ATTRIBUTES,
1902                                             NULL };
1903                 struct ldb_result *msg_res;
1904                 struct ldb_dn *msg_dn;
1905
1906                 obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
1907                 W_ERROR_HAVE_NO_MEMORY(obj);
1908
1909                 msg_dn = ldb_dn_new_fmt(obj, sam_ctx, "<GUID=%s>", GUID_string(obj, &getnc_state->guids[i]));
1910                 W_ERROR_HAVE_NO_MEMORY(msg_dn);
1911
1912
1913                 /* by re-searching here we avoid having a lot of full
1914                  * records in memory between calls to getncchanges
1915                  */
1916                 ret = drsuapi_search_with_extended_dn(sam_ctx, obj, &msg_res,
1917                                                       msg_dn,
1918                                                       LDB_SCOPE_BASE, msg_attrs, NULL);
1919                 if (ret != LDB_SUCCESS) {
1920                         if (ret != LDB_ERR_NO_SUCH_OBJECT) {
1921                                 DEBUG(1,("getncchanges: failed to fetch DN %s - %s\n",
1922                                          ldb_dn_get_extended_linearized(obj, msg_dn, 1), ldb_errstring(sam_ctx)));
1923                         }
1924                         talloc_free(obj);
1925                         continue;
1926                 }
1927
1928                 msg = msg_res->msgs[0];
1929
1930                 max_wait_reached = (time(NULL) - start > max_wait);
1931
1932                 werr = get_nc_changes_build_object(obj, msg,
1933                                                    sam_ctx, getnc_state->ncRoot_dn,
1934                                                    getnc_state->is_schema_nc,
1935                                                    schema, &session_key, getnc_state->min_usn,
1936                                                    req10->replica_flags,
1937                                                    req10->partial_attribute_set,
1938                                                    req10->uptodateness_vector,
1939                                                    req10->extended_op,
1940                                                    max_wait_reached);
1941                 if (!W_ERROR_IS_OK(werr)) {
1942                         return werr;
1943                 }
1944
1945                 werr = get_nc_changes_add_links(sam_ctx, getnc_state,
1946                                                 getnc_state->ncRoot_dn,
1947                                                 schema, getnc_state->min_usn,
1948                                                 req10->replica_flags,
1949                                                 msg,
1950                                                 &getnc_state->la_list,
1951                                                 &getnc_state->la_count,
1952                                                 req10->uptodateness_vector);
1953                 if (!W_ERROR_IS_OK(werr)) {
1954                         return werr;
1955                 }
1956
1957                 uSN = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
1958                 if (uSN > getnc_state->max_usn) {
1959                         /*
1960                          * Only report the max_usn we had at the start
1961                          * of the replication cycle.
1962                          *
1963                          * If this object has changed lately we better
1964                          * let the destination dsa refetch the change.
1965                          * This is better than the risk of loosing some
1966                          * objects or linked attributes.
1967                          */
1968                         uSN = 0;
1969                 }
1970                 if (uSN > r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn) {
1971                         r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn = uSN;
1972                         r->out.ctr->ctr6.new_highwatermark.reserved_usn = 0;
1973                 }
1974
1975                 if (obj->meta_data_ctr == NULL) {
1976                         DEBUG(8,(__location__ ": getncchanges skipping send of object %s\n",
1977                                  ldb_dn_get_linearized(msg->dn)));
1978                         /* no attributes to send */
1979                         talloc_free(obj);
1980                         continue;
1981                 }
1982
1983                 r->out.ctr->ctr6.object_count++;
1984
1985                 *currentObject = obj;
1986                 currentObject = &obj->next_object;
1987
1988                 DEBUG(8,(__location__ ": replicating object %s\n", ldb_dn_get_linearized(msg->dn)));
1989
1990                 talloc_free(getnc_state->last_dn);
1991                 getnc_state->last_dn = talloc_move(getnc_state, &msg->dn);
1992
1993                 talloc_free(msg_res);
1994                 talloc_free(msg_dn);
1995         }
1996
1997         getnc_state->num_processed = i;
1998
1999         r->out.ctr->ctr6.nc_object_count = getnc_state->num_records;
2000
2001         /* the client can us to call UpdateRefs on its behalf to
2002            re-establish monitoring of the NC */
2003         if ((req10->replica_flags & (DRSUAPI_DRS_ADD_REF | DRSUAPI_DRS_REF_GCSPN)) &&
2004             !GUID_all_zero(&req10->destination_dsa_guid)) {
2005                 struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
2006                 DEBUG(3,("UpdateRefs on getncchanges for %s\n",
2007                          GUID_string(mem_ctx, &req10->destination_dsa_guid)));
2008                 ureq.naming_context = ncRoot;
2009                 ureq.dest_dsa_dns_name = samdb_ntds_msdcs_dns_name(b_state->sam_ctx, mem_ctx,
2010                                                                    &req10->destination_dsa_guid);
2011                 if (!ureq.dest_dsa_dns_name) {
2012                         return WERR_NOMEM;
2013                 }
2014                 ureq.dest_dsa_guid = req10->destination_dsa_guid;
2015                 ureq.options = DRSUAPI_DRS_ADD_REF |
2016                         DRSUAPI_DRS_ASYNC_OP |
2017                         DRSUAPI_DRS_GETCHG_CHECK;
2018
2019                 /* we also need to pass through the
2020                    DRSUAPI_DRS_REF_GCSPN bit so that repsTo gets flagged
2021                    to send notifies using the GC SPN */
2022                 ureq.options |= (req10->replica_flags & DRSUAPI_DRS_REF_GCSPN);
2023
2024                 werr = drsuapi_UpdateRefs(b_state, mem_ctx, &ureq);
2025                 if (!W_ERROR_IS_OK(werr)) {
2026                         DEBUG(0,(__location__ ": Failed UpdateRefs on %s for %s in DsGetNCChanges - %s\n",
2027                                  drs_ObjectIdentifier_to_string(mem_ctx, ncRoot), ureq.dest_dsa_dns_name,
2028                                  win_errstr(werr)));
2029                 }
2030         }
2031
2032         /*
2033          * TODO:
2034          * This is just a guess, how to calculate the
2035          * number of linked attributes to send, we need to
2036          * find out how to do this right.
2037          */
2038         if (r->out.ctr->ctr6.object_count >= max_links) {
2039                 max_links = 0;
2040         } else {
2041                 max_links -= r->out.ctr->ctr6.object_count;
2042         }
2043
2044         link_total = getnc_state->la_count;
2045
2046         if (i < getnc_state->num_records) {
2047                 r->out.ctr->ctr6.more_data = true;
2048         } else {
2049                 /* sort the whole array the first time */
2050                 if (!getnc_state->la_sorted) {
2051                         LDB_TYPESAFE_QSORT(getnc_state->la_list, getnc_state->la_count,
2052                                            sam_ctx, linked_attribute_compare);
2053                         getnc_state->la_sorted = true;
2054                 }
2055
2056                 link_count = getnc_state->la_count - getnc_state->la_idx;
2057                 link_count = MIN(max_links, link_count);
2058
2059                 r->out.ctr->ctr6.linked_attributes_count = link_count;
2060                 r->out.ctr->ctr6.linked_attributes = getnc_state->la_list + getnc_state->la_idx;
2061
2062                 getnc_state->la_idx += link_count;
2063                 link_given = getnc_state->la_idx;
2064
2065                 if (getnc_state->la_idx < getnc_state->la_count) {
2066                         r->out.ctr->ctr6.more_data = true;
2067                 }
2068         }
2069
2070         if (!r->out.ctr->ctr6.more_data) {
2071                 talloc_steal(mem_ctx, getnc_state->la_list);
2072
2073                 r->out.ctr->ctr6.new_highwatermark = getnc_state->final_hwm;
2074                 r->out.ctr->ctr6.uptodateness_vector = talloc_move(mem_ctx,
2075                                                         &getnc_state->final_udv);
2076
2077                 talloc_free(getnc_state);
2078                 b_state->getncchanges_state = NULL;
2079         } else {
2080                 ret = drsuapi_DsReplicaHighWaterMark_cmp(&r->out.ctr->ctr6.old_highwatermark,
2081                                                          &r->out.ctr->ctr6.new_highwatermark);
2082                 if (ret == 0) {
2083                         /*
2084                          * We need to make sure that we never return the
2085                          * same highwatermark within the same replication
2086                          * cycle more than once. Otherwise we cannot detect
2087                          * when the client uses an unexptected highwatermark.
2088                          *
2089                          * This is a HACK which is needed because our
2090                          * object ordering is wrong and set tmp_highest_usn
2091                          * to a value that is higher than what we already
2092                          * sent to the client (destination dsa).
2093                          */
2094                         r->out.ctr->ctr6.new_highwatermark.reserved_usn += 1;
2095                 }
2096
2097                 getnc_state->last_hwm = r->out.ctr->ctr6.new_highwatermark;
2098         }
2099
2100         if (req10->extended_op != DRSUAPI_EXOP_NONE) {
2101                 r->out.ctr->ctr6.uptodateness_vector = NULL;
2102                 r->out.ctr->ctr6.nc_object_count = 0;
2103                 ZERO_STRUCT(r->out.ctr->ctr6.new_highwatermark);
2104         }
2105
2106         DEBUG(r->out.ctr->ctr6.more_data?4:2,
2107               ("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %u/%u) %u links (done %u/%u (as %s))\n",
2108                (unsigned long long)(req10->highwatermark.highest_usn+1),
2109                req10->replica_flags, drs_ObjectIdentifier_to_string(mem_ctx, ncRoot),
2110                r->out.ctr->ctr6.object_count,
2111                i, r->out.ctr->ctr6.more_data?getnc_state->num_records:i,
2112                r->out.ctr->ctr6.linked_attributes_count,
2113                link_given, link_total,
2114                dom_sid_string(mem_ctx, user_sid)));
2115
2116 #if 0
2117         if (!r->out.ctr->ctr6.more_data && req10->extended_op != DRSUAPI_EXOP_NONE) {
2118                 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsGetNCChanges, NDR_BOTH, r);
2119         }
2120 #endif
2121
2122         return WERR_OK;
2123 }