Context Navigation

← Previous Revision
Next Revision →
Blame
Revision Log

getncchanges.c

Visit:

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago
Samba Server: updated trunk to 3.6.0
File size: 54.0 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3
4	implement the DSGetNCChanges call
5
6	Copyright (C) Anatoliy Atanasov 2009
7	Copyright (C) Andrew Tridgell 2009
8
9	This program is free software; you can redistribute it and/or modify
10	it under the terms of the GNU General Public License as published by
11	the Free Software Foundation; either version 3 of the License, or
12	(at your option) any later version.
13
14	This program is distributed in the hope that it will be useful,
15	but WITHOUT ANY WARRANTY; without even the implied warranty of
16	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17	GNU General Public License for more details.
18
19	You should have received a copy of the GNU General Public License
20	along with this program. If not, see <http://www.gnu.org/licenses/>.
21	*/
22
23	#include "includes.h"
24	#include "rpc_server/dcerpc_server.h"
25	#include "dsdb/samdb/samdb.h"
26	#include "param/param.h"
27	#include "librpc/gen_ndr/ndr_drsblobs.h"
28	#include "librpc/gen_ndr/ndr_drsuapi.h"
29	#include "librpc/gen_ndr/ndr_security.h"
30	#include "libcli/security/security.h"
31	#include "libcli/security/session.h"
32	#include "rpc_server/drsuapi/dcesrv_drsuapi.h"
33	#include "rpc_server/dcerpc_server_proto.h"
34	#include "../libcli/drsuapi/drsuapi.h"
35	#include "lib/util/binsearch.h"
36	#include "lib/util/tsort.h"
37	#include "auth/session.h"
38	#include "dsdb/common/util.h"
39
40	/*
41	build a DsReplicaObjectIdentifier from a ldb msg
42	*/
43	static struct drsuapi_DsReplicaObjectIdentifier get_object_identifier(TALLOC_CTX mem_ctx,
44	struct ldb_message *msg)
45	{
46	struct drsuapi_DsReplicaObjectIdentifier *identifier;
47	struct dom_sid *sid;
48
49	identifier = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
50	if (identifier == NULL) {
51	return NULL;
52	}
53
54	identifier->dn = ldb_dn_alloc_linearized(identifier, msg->dn);
55	identifier->guid = samdb_result_guid(msg, "objectGUID");
56
57	sid = samdb_result_dom_sid(identifier, msg, "objectSid");
58	if (sid) {
59	identifier->sid = *sid;
60	} else {
61	ZERO_STRUCT(identifier->sid);
62	}
63	return identifier;
64	}
65
66	static int udv_compare(const struct GUID *guid1, struct GUID guid2)
67	{
68	return GUID_compare(guid1, &guid2);
69	}
70
71	/*
72	see if we can filter an attribute using the uptodateness_vector
73	*/
74	static bool udv_filter(const struct drsuapi_DsReplicaCursorCtrEx *udv,
75	const struct GUID *originating_invocation_id,
76	uint64_t originating_usn)
77	{
78	const struct drsuapi_DsReplicaCursor *c;
79	if (udv == NULL) return false;
80	BINARY_ARRAY_SEARCH(udv->cursors, udv->count, source_dsa_invocation_id,
81	originating_invocation_id, udv_compare, c);
82	if (c && originating_usn <= c->highest_usn) {
83	return true;
84	}
85	return false;
86
87	}
88
89	static int attid_cmp(enum drsuapi_DsAttributeId a1, enum drsuapi_DsAttributeId a2)
90	{
91	if (a1 == a2) return 0;
92	return ((uint32_t)a1) > ((uint32_t)a2) ? 1 : -1;
93	}
94
95	/*
96	check if an attribute is in a partial_attribute_set
97	*/
98	static bool check_partial_attribute_set(const struct dsdb_attribute *sa,
99	struct drsuapi_DsPartialAttributeSet *pas)
100	{
101	enum drsuapi_DsAttributeId *result;
102	BINARY_ARRAY_SEARCH_V(pas->attids, pas->num_attids, (enum drsuapi_DsAttributeId)sa->attributeID_id,
103	attid_cmp, result);
104	return result != NULL;
105	}
106
107
108	/*
109	drsuapi_DsGetNCChanges for one object
110	*/
111	static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
112	struct ldb_message *msg,
113	struct ldb_context *sam_ctx,
114	struct ldb_dn *ncRoot_dn,
115	bool is_schema_nc,
116	struct dsdb_schema *schema,
117	DATA_BLOB *session_key,
118	uint64_t highest_usn,
119	uint32_t replica_flags,
120	struct drsuapi_DsPartialAttributeSet *partial_attribute_set,
121	struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector,
122	enum drsuapi_DsExtendedOperation extended_op)
123	{
124	const struct ldb_val *md_value;
125	uint32_t i, n;
126	struct replPropertyMetaDataBlob md;
127	uint32_t rid = 0;
128	enum ndr_err_code ndr_err;
129	uint32_t *attids;
130	const char *rdn;
131	const struct dsdb_attribute *rdn_sa;
132	unsigned int instanceType;
133	struct dsdb_syntax_ctx syntax_ctx;
134
135	/* make dsdb sytanx context for conversions */
136	dsdb_syntax_ctx_init(&syntax_ctx, sam_ctx, schema);
137	syntax_ctx.is_schema_nc = is_schema_nc;
138
139	instanceType = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
140	if (instanceType & INSTANCE_TYPE_IS_NC_HEAD) {
141	obj->is_nc_prefix = true;
142	obj->parent_object_guid = NULL;
143	} else {
144	obj->is_nc_prefix = false;
145	obj->parent_object_guid = talloc(obj, struct GUID);
146	if (obj->parent_object_guid == NULL) {
147	return WERR_DS_DRA_INTERNAL_ERROR;
148	}
149	*obj->parent_object_guid = samdb_result_guid(msg, "parentGUID");
150	if (GUID_all_zero(obj->parent_object_guid)) {
151	DEBUG(0,(__location__ ": missing parentGUID for %s\n",
152	ldb_dn_get_linearized(msg->dn)));
153	return WERR_DS_DRA_INTERNAL_ERROR;
154	}
155	}
156	obj->next_object = NULL;
157
158	md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
159	if (!md_value) {
160	/* nothing to send */
161	return WERR_OK;
162	}
163
164	if (instanceType & INSTANCE_TYPE_UNINSTANT) {
165	/* don't send uninstantiated objects */
166	return WERR_OK;
167	}
168
169	ndr_err = ndr_pull_struct_blob(md_value, obj, &md,
170	(ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
171	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
172	return WERR_DS_DRA_INTERNAL_ERROR;
173	}
174
175	if (md.version != 1) {
176	return WERR_DS_DRA_INTERNAL_ERROR;
177	}
178
179	rdn = ldb_dn_get_rdn_name(msg->dn);
180	if (rdn == NULL) {
181	DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
182	return WERR_DS_DRA_INTERNAL_ERROR;
183	}
184
185	rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
186	if (rdn_sa == NULL) {
187	DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
188	rdn, ldb_dn_get_linearized(msg->dn)));
189	return WERR_DS_DRA_INTERNAL_ERROR;
190	}
191
192	obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
193	attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
194
195	obj->object.identifier = get_object_identifier(obj, msg);
196	if (obj->object.identifier == NULL) {
197	return WERR_NOMEM;
198	}
199	dom_sid_split_rid(NULL, &obj->object.identifier->sid, NULL, &rid);
200
201	obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
202	for (n=i=0; i<md.ctr.ctr1.count; i++) {
203	const struct dsdb_attribute *sa;
204	bool force_attribute = false;
205
206	/* if the attribute has not changed, and it is not the
207	instanceType then don't include it */
208	if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
209	extended_op != DRSUAPI_EXOP_REPL_SECRET &&
210	md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType) continue;
211
212	/* don't include the rDN */
213	if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
214
215	sa = dsdb_attribute_by_attributeID_id(schema, md.ctr.ctr1.array[i].attid);
216	if (!sa) {
217	DEBUG(0,(__location__ ": Failed to find attribute in schema for attrid %u mentioned in replPropertyMetaData of %s\n",
218	(unsigned int)md.ctr.ctr1.array[i].attid,
219	ldb_dn_get_linearized(msg->dn)));
220	return WERR_DS_DRA_INTERNAL_ERROR;
221	}
222
223	if (sa->linkID) {
224	struct ldb_message_element *el;
225	el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
226	if (el && el->num_values && dsdb_dn_is_upgraded_link_val(&el->values[0])) {
227	/* don't send upgraded links inline */
228	continue;
229	}
230	}
231
232	if (extended_op == DRSUAPI_EXOP_REPL_SECRET &&
233	!dsdb_attr_in_rodc_fas(sa)) {
234	force_attribute = true;
235	DEBUG(4,("Forcing attribute %s in %s\n",
236	sa->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)));
237	}
238
239	/* filter by uptodateness_vector */
240	if (md.ctr.ctr1.array[i].attid != DRSUAPI_ATTID_instanceType &&
241	!force_attribute &&
242	udv_filter(uptodateness_vector,
243	&md.ctr.ctr1.array[i].originating_invocation_id,
244	md.ctr.ctr1.array[i].originating_usn)) {
245	continue;
246	}
247
248	/* filter by partial_attribute_set */
249	if (partial_attribute_set && !check_partial_attribute_set(sa, partial_attribute_set)) {
250	continue;
251	}
252
253	obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
254	obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
255	obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
256	obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
257	attids[n] = md.ctr.ctr1.array[i].attid;
258	n++;
259	}
260
261	/* ignore it if its an empty change. Note that renames always
262	* change the 'name' attribute, so they won't be ignored by
263	* this */
264	if (n == 0 \|\|
265	(n == 1 && attids[0] == DRSUAPI_ATTID_instanceType)) {
266	talloc_free(obj->meta_data_ctr);
267	obj->meta_data_ctr = NULL;
268	return WERR_OK;
269	}
270
271	obj->meta_data_ctr->count = n;
272
273	obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
274	obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
275	obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
276	obj->object.attribute_ctr.num_attributes);
277
278	/*
279	* Note that the meta_data array and the attributes array must
280	* be the same size and in the same order
281	*/
282	for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
283	struct ldb_message_element *el;
284	WERROR werr;
285	const struct dsdb_attribute *sa;
286
287	sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
288	if (!sa) {
289	DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
290	return WERR_DS_DRA_INTERNAL_ERROR;
291	}
292
293	el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
294	if (el == NULL) {
295	/* this happens for attributes that have been removed */
296	DEBUG(5,("No element '%s' for attributeID %u in message\n",
297	sa->lDAPDisplayName, attids[i]));
298	ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
299	obj->object.attribute_ctr.attributes[i].attid =
300	dsdb_attribute_get_attid(sa, syntax_ctx.is_schema_nc);
301	} else {
302	werr = sa->syntax->ldb_to_drsuapi(&syntax_ctx, sa, el, obj,
303	&obj->object.attribute_ctr.attributes[i]);
304	if (!W_ERROR_IS_OK(werr)) {
305	DEBUG(0,("Unable to convert %s to DRS object - %s\n",
306	sa->lDAPDisplayName, win_errstr(werr)));
307	return werr;
308	}
309	/* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
310	* check if attribute is secret and send a null value
311	*/
312	if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
313	drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
314	&obj->meta_data_ctr->meta_data[i]);
315	}
316	/* some attributes needs to be encrypted
317	before being sent */
318	werr = drsuapi_encrypt_attribute(obj, session_key, rid,
319	&obj->object.attribute_ctr.attributes[i]);
320	if (!W_ERROR_IS_OK(werr)) {
321	DEBUG(0,("Unable to encrypt %s in DRS object - %s\n",
322	sa->lDAPDisplayName, win_errstr(werr)));
323	return werr;
324	}
325	}
326	}
327
328	return WERR_OK;
329	}
330
331
332	/*
333	add one linked attribute from an object to the list of linked
334	attributes in a getncchanges request
335	*/
336	static WERROR get_nc_changes_add_la(TALLOC_CTX *mem_ctx,
337	struct ldb_context *sam_ctx,
338	const struct dsdb_schema *schema,
339	const struct dsdb_attribute *sa,
340	struct ldb_message *msg,
341	struct dsdb_dn *dsdb_dn,
342	struct drsuapi_DsReplicaLinkedAttribute **la_list,
343	uint32_t *la_count)
344	{
345	struct drsuapi_DsReplicaLinkedAttribute *la;
346	bool active;
347	NTSTATUS status;
348	WERROR werr;
349
350	(la_list) = talloc_realloc(mem_ctx, la_list, struct drsuapi_DsReplicaLinkedAttribute, (*la_count)+1);
351	W_ERROR_HAVE_NO_MEMORY(*la_list);
352
353	la = &(la_list)[la_count];
354
355	la->identifier = get_object_identifier(*la_list, msg);
356	W_ERROR_HAVE_NO_MEMORY(la->identifier);
357
358	active = (dsdb_dn_rmd_flags(dsdb_dn->dn) & DSDB_RMD_FLAG_DELETED) == 0;
359
360	la->attid = sa->attributeID_id;
361	la->flags = active?DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE:0;
362
363	status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->originating_add_time, "RMD_ADDTIME");
364	if (!NT_STATUS_IS_OK(status)) {
365	return ntstatus_to_werror(status);
366	}
367	status = dsdb_get_extended_dn_uint32(dsdb_dn->dn, &la->meta_data.version, "RMD_VERSION");
368	if (!NT_STATUS_IS_OK(status)) {
369	return ntstatus_to_werror(status);
370	}
371	status = dsdb_get_extended_dn_nttime(dsdb_dn->dn, &la->meta_data.originating_change_time, "RMD_CHANGETIME");
372	if (!NT_STATUS_IS_OK(status)) {
373	return ntstatus_to_werror(status);
374	}
375	status = dsdb_get_extended_dn_guid(dsdb_dn->dn, &la->meta_data.originating_invocation_id, "RMD_INVOCID");
376	if (!NT_STATUS_IS_OK(status)) {
377	return ntstatus_to_werror(status);
378	}
379	status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &la->meta_data.originating_usn, "RMD_ORIGINATING_USN");
380	if (!NT_STATUS_IS_OK(status)) {
381	return ntstatus_to_werror(status);
382	}
383
384	werr = dsdb_dn_la_to_blob(sam_ctx, sa, schema, *la_list, dsdb_dn, &la->value.blob);
385	W_ERROR_NOT_OK_RETURN(werr);
386
387	(*la_count)++;
388	return WERR_OK;
389	}
390
391
392	/*
393	add linked attributes from an object to the list of linked
394	attributes in a getncchanges request
395	*/
396	static WERROR get_nc_changes_add_links(struct ldb_context *sam_ctx,
397	TALLOC_CTX *mem_ctx,
398	struct ldb_dn *ncRoot_dn,
399	struct dsdb_schema *schema,
400	uint64_t highest_usn,
401	uint32_t replica_flags,
402	struct ldb_message *msg,
403	struct drsuapi_DsReplicaLinkedAttribute **la_list,
404	uint32_t *la_count,
405	struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector)
406	{
407	unsigned int i;
408	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
409	uint64_t uSNChanged = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
410
411	for (i=0; i<msg->num_elements; i++) {
412	struct ldb_message_element *el = &msg->elements[i];
413	const struct dsdb_attribute *sa;
414	unsigned int j;
415
416	sa = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
417
418	if (!sa \|\| sa->linkID == 0 \|\| (sa->linkID & 1)) {
419	/* we only want forward links */
420	continue;
421	}
422
423	if (el->num_values && !dsdb_dn_is_upgraded_link_val(&el->values[0])) {
424	/* its an old style link, it will have been
425	* sent in the main replication data */
426	continue;
427	}
428
429	for (j=0; j<el->num_values; j++) {
430	struct dsdb_dn *dsdb_dn;
431	uint64_t local_usn;
432	NTSTATUS status;
433	WERROR werr;
434
435	dsdb_dn = dsdb_dn_parse(tmp_ctx, sam_ctx, &el->values[j], sa->syntax->ldap_oid);
436	if (dsdb_dn == NULL) {
437	DEBUG(1,(__location__ ": Failed to parse DN for %s in %s\n",
438	el->name, ldb_dn_get_linearized(msg->dn)));
439	talloc_free(tmp_ctx);
440	return WERR_DS_DRA_INTERNAL_ERROR;
441	}
442
443	status = dsdb_get_extended_dn_uint64(dsdb_dn->dn, &local_usn, "RMD_LOCAL_USN");
444	if (!NT_STATUS_IS_OK(status)) {
445	/* this can happen for attributes
446	given to us with old style meta
447	data */
448	continue;
449	}
450
451	if (local_usn > uSNChanged) {
452	DEBUG(1,(__location__ ": uSNChanged less than RMD_LOCAL_USN for %s on %s\n",
453	el->name, ldb_dn_get_linearized(msg->dn)));
454	talloc_free(tmp_ctx);
455	return WERR_DS_DRA_INTERNAL_ERROR;
456	}
457
458	if (local_usn < highest_usn) {
459	continue;
460	}
461
462	werr = get_nc_changes_add_la(mem_ctx, sam_ctx, schema, sa, msg,
463	dsdb_dn, la_list, la_count);
464	if (!W_ERROR_IS_OK(werr)) {
465	talloc_free(tmp_ctx);
466	return werr;
467	}
468	}
469	}
470
471	talloc_free(tmp_ctx);
472	return WERR_OK;
473	}
474
475	/*
476	fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
477	*/
478	static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
479	struct ldb_dn *ncRoot_dn,
480	struct drsuapi_DsReplicaCursor2CtrEx *udv)
481	{
482	int ret;
483
484	udv->version = 2;
485	udv->reserved1 = 0;
486	udv->reserved2 = 0;
487
488	ret = dsdb_load_udv_v2(sam_ctx, ncRoot_dn, udv, &udv->cursors, &udv->count);
489	if (ret != LDB_SUCCESS) {
490	DEBUG(0,(__location__ ": Failed to load UDV for %s - %s\n",
491	ldb_dn_get_linearized(ncRoot_dn), ldb_errstring(sam_ctx)));
492	return WERR_DS_DRA_INTERNAL_ERROR;
493	}
494
495	return WERR_OK;
496	}
497
498
499	/* comparison function for linked attributes - see CompareLinks() in
500	* MS-DRSR section 4.1.10.5.17 */
501	static int linked_attribute_compare(const struct drsuapi_DsReplicaLinkedAttribute *la1,
502	const struct drsuapi_DsReplicaLinkedAttribute *la2,
503	struct ldb_context *sam_ctx)
504	{
505	int c;
506	WERROR werr;
507	TALLOC_CTX *tmp_ctx;
508	const struct dsdb_schema *schema;
509	const struct dsdb_attribute *schema_attrib;
510	struct dsdb_dn dn1, dn2;
511	struct GUID guid1, guid2;
512	NTSTATUS status;
513
514	c = GUID_compare(&la1->identifier->guid,
515	&la2->identifier->guid);
516	if (c != 0) return c;
517
518	if (la1->attid != la2->attid) {
519	return la1->attid < la2->attid? -1:1;
520	}
521
522	if ((la1->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) !=
523	(la2->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)) {
524	return (la1->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE)? 1:-1;
525	}
526
527	/* we need to get the target GUIDs to compare */
528	tmp_ctx = talloc_new(sam_ctx);
529
530	schema = dsdb_get_schema(sam_ctx, tmp_ctx);
531	schema_attrib = dsdb_attribute_by_attributeID_id(schema, la1->attid);
532
533	werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, tmp_ctx, la1->value.blob, &dn1);
534	if (!W_ERROR_IS_OK(werr)) {
535	DEBUG(0,(__location__ ": Bad la1 blob in sort\n"));
536	talloc_free(tmp_ctx);
537	return 0;
538	}
539
540	werr = dsdb_dn_la_from_blob(sam_ctx, schema_attrib, schema, tmp_ctx, la2->value.blob, &dn2);
541	if (!W_ERROR_IS_OK(werr)) {
542	DEBUG(0,(__location__ ": Bad la2 blob in sort\n"));
543	talloc_free(tmp_ctx);
544	return 0;
545	}
546
547	status = dsdb_get_extended_dn_guid(dn1->dn, &guid1, "GUID");
548	if (!NT_STATUS_IS_OK(status)) {
549	DEBUG(0,(__location__ ": Bad la1 guid in sort\n"));
550	talloc_free(tmp_ctx);
551	return 0;
552	}
553	status = dsdb_get_extended_dn_guid(dn2->dn, &guid2, "GUID");
554	if (!NT_STATUS_IS_OK(status)) {
555	DEBUG(0,(__location__ ": Bad la2 guid in sort\n"));
556	talloc_free(tmp_ctx);
557	return 0;
558	}
559
560	talloc_free(tmp_ctx);
561
562	return GUID_compare(&guid1, &guid2);
563	}
564
565
566	/*
567	sort the objects we send by tree order
568	*/
569	static int site_res_cmp_parent_order(struct ldb_message m1, struct ldb_message m2)
570	{
571	return ldb_dn_compare((m2)->dn, (m1)->dn);
572	}
573
574	/*
575	sort the objects we send first by uSNChanged
576	*/
577	static int site_res_cmp_usn_order(struct ldb_message m1, struct ldb_message m2)
578	{
579	unsigned usnchanged1, usnchanged2;
580	unsigned cn1, cn2;
581	cn1 = ldb_dn_get_comp_num((*m1)->dn);
582	cn2 = ldb_dn_get_comp_num((*m2)->dn);
583	if (cn1 != cn2) {
584	return cn1 > cn2 ? 1 : -1;
585	}
586	usnchanged1 = ldb_msg_find_attr_as_uint(*m1, "uSNChanged", 0);
587	usnchanged2 = ldb_msg_find_attr_as_uint(*m2, "uSNChanged", 0);
588	if (usnchanged1 == usnchanged2) {
589	return 0;
590	}
591	return usnchanged1 > usnchanged2 ? 1 : -1;
592	}
593
594
595	/*
596	handle a DRSUAPI_EXOP_FSMO_RID_ALLOC call
597	*/
598	static WERROR getncchanges_rid_alloc(struct drsuapi_bind_state *b_state,
599	TALLOC_CTX *mem_ctx,
600	struct drsuapi_DsGetNCChangesRequest10 *req10,
601	struct drsuapi_DsGetNCChangesCtr6 *ctr6)
602	{
603	struct ldb_dn rid_manager_dn, fsmo_role_dn, *req_dn;
604	int ret;
605	struct ldb_context *ldb = b_state->sam_ctx;
606	struct ldb_result *ext_res;
607	struct ldb_dn *base_dn;
608	struct dsdb_fsmo_extended_op *exop;
609
610	/*
611	steps:
612	- verify that the DN being asked for is the RID Manager DN
613	- verify that we are the RID Manager
614	*/
615
616	/* work out who is the RID Manager */
617	ret = samdb_rid_manager_dn(ldb, mem_ctx, &rid_manager_dn);
618	if (ret != LDB_SUCCESS) {
619	DEBUG(0, (__location__ ": Failed to find RID Manager object - %s\n", ldb_errstring(ldb)));
620	return WERR_DS_DRA_INTERNAL_ERROR;
621	}
622
623	req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
624	if (!ldb_dn_validate(req_dn) \|\|
625	ldb_dn_compare(req_dn, rid_manager_dn) != 0) {
626	/* that isn't the RID Manager DN */
627	DEBUG(0,(__location__ ": RID Alloc request for wrong DN %s\n",
628	drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
629	ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
630	return WERR_OK;
631	}
632
633	/* find the DN of the RID Manager */
634	ret = samdb_reference_dn(ldb, mem_ctx, rid_manager_dn, "fSMORoleOwner", &fsmo_role_dn);
635	if (ret != LDB_SUCCESS) {
636	DEBUG(0,(__location__ ": Failed to find fSMORoleOwner in RID Manager object - %s\n",
637	ldb_errstring(ldb)));
638	ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
639	return WERR_DS_DRA_INTERNAL_ERROR;
640	}
641
642	if (ldb_dn_compare(samdb_ntds_settings_dn(ldb), fsmo_role_dn) != 0) {
643	/* we're not the RID Manager - go away */
644	DEBUG(0,(__location__ ": RID Alloc request when not RID Manager\n"));
645	ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
646	return WERR_OK;
647	}
648
649	exop = talloc(mem_ctx, struct dsdb_fsmo_extended_op);
650	W_ERROR_HAVE_NO_MEMORY(exop);
651
652	exop->fsmo_info = req10->fsmo_info;
653	exop->destination_dsa_guid = req10->destination_dsa_guid;
654
655	ret = ldb_transaction_start(ldb);
656	if (ret != LDB_SUCCESS) {
657	DEBUG(0,(__location__ ": Failed transaction start - %s\n",
658	ldb_errstring(ldb)));
659	return WERR_DS_DRA_INTERNAL_ERROR;
660	}
661
662	/*
663	* FIXME (kim): this is a temp hack to return just few object,
664	* but not the whole domain NC.
665	* We should remove this hack and implement a 'scope'
666	* building function to return just the set of object
667	* documented for DRSUAPI_EXOP_FSMO_RID_ALLOC extended_op
668	*/
669	ldb_sequence_number(ldb, LDB_SEQ_HIGHEST_SEQ, &req10->highwatermark.highest_usn);
670
671	ret = ldb_extended(ldb, DSDB_EXTENDED_ALLOCATE_RID_POOL, exop, &ext_res);
672	if (ret != LDB_SUCCESS) {
673	DEBUG(0,(__location__ ": Failed extended allocation RID pool operation - %s\n",
674	ldb_errstring(ldb)));
675	ldb_transaction_cancel(ldb);
676	return WERR_DS_DRA_INTERNAL_ERROR;
677	}
678
679	ret = ldb_transaction_commit(ldb);
680	if (ret != LDB_SUCCESS) {
681	DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
682	ldb_errstring(ldb)));
683	return WERR_DS_DRA_INTERNAL_ERROR;
684	}
685
686	talloc_free(ext_res);
687
688	base_dn = ldb_get_default_basedn(ldb);
689
690	DEBUG(2,("Allocated RID pool for server %s\n",
691	GUID_string(mem_ctx, &req10->destination_dsa_guid)));
692
693	ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
694
695	return WERR_OK;
696	}
697
698	/*
699	return an array of SIDs from a ldb_message given an attribute name
700	assumes the SIDs are in extended DN format
701	*/
702	static WERROR samdb_result_sid_array_dn(struct ldb_context *sam_ctx,
703	struct ldb_message *msg,
704	TALLOC_CTX *mem_ctx,
705	const char *attr,
706	const struct dom_sid ***sids)
707	{
708	struct ldb_message_element *el;
709	unsigned int i;
710
711	el = ldb_msg_find_element(msg, attr);
712	if (!el) {
713	*sids = NULL;
714	return WERR_OK;
715	}
716
717	(sids) = talloc_array(mem_ctx, const struct dom_sid , el->num_values + 1);
718	W_ERROR_HAVE_NO_MEMORY(*sids);
719
720	for (i=0; i<el->num_values; i++) {
721	struct ldb_dn *dn = ldb_dn_from_ldb_val(mem_ctx, sam_ctx, &el->values[i]);
722	NTSTATUS status;
723	struct dom_sid *sid;
724
725	sid = talloc(*sids, struct dom_sid);
726	W_ERROR_HAVE_NO_MEMORY(sid);
727	status = dsdb_get_extended_dn_sid(dn, sid, "SID");
728	if (!NT_STATUS_IS_OK(status)) {
729	return WERR_INTERNAL_DB_CORRUPTION;
730	}
731	(*sids)[i] = sid;
732	}
733	(*sids)[i] = NULL;
734
735	return WERR_OK;
736	}
737
738
739	/*
740	return an array of SIDs from a ldb_message given an attribute name
741	assumes the SIDs are in NDR form
742	*/
743	static WERROR samdb_result_sid_array_ndr(struct ldb_context *sam_ctx,
744	struct ldb_message *msg,
745	TALLOC_CTX *mem_ctx,
746	const char *attr,
747	const struct dom_sid ***sids)
748	{
749	struct ldb_message_element *el;
750	unsigned int i;
751
752	el = ldb_msg_find_element(msg, attr);
753	if (!el) {
754	*sids = NULL;
755	return WERR_OK;
756	}
757
758	(sids) = talloc_array(mem_ctx, const struct dom_sid , el->num_values + 1);
759	W_ERROR_HAVE_NO_MEMORY(*sids);
760
761	for (i=0; i<el->num_values; i++) {
762	enum ndr_err_code ndr_err;
763	struct dom_sid *sid;
764
765	sid = talloc(*sids, struct dom_sid);
766	W_ERROR_HAVE_NO_MEMORY(sid);
767
768	ndr_err = ndr_pull_struct_blob(&el->values[i], sid, sid,
769	(ndr_pull_flags_fn_t)ndr_pull_dom_sid);
770	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
771	return WERR_INTERNAL_DB_CORRUPTION;
772	}
773	(*sids)[i] = sid;
774	}
775	(*sids)[i] = NULL;
776
777	return WERR_OK;
778	}
779
780	/*
781	see if any SIDs in list1 are in list2
782	*/
783	static bool sid_list_match(const struct dom_sid list1, const struct dom_sid list2)
784	{
785	unsigned int i, j;
786	/* do we ever have enough SIDs here to worry about O(n^2) ? */
787	for (i=0; list1[i]; i++) {
788	for (j=0; list2[j]; j++) {
789	if (dom_sid_equal(list1[i], list2[j])) {
790	return true;
791	}
792	}
793	}
794	return false;
795	}
796
797	/*
798	handle a DRSUAPI_EXOP_REPL_SECRET call
799	*/
800	static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
801	TALLOC_CTX *mem_ctx,
802	struct drsuapi_DsGetNCChangesRequest10 *req10,
803	struct dom_sid *user_sid,
804	struct drsuapi_DsGetNCChangesCtr6 *ctr6)
805	{
806	struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
807	struct ldb_dn obj_dn, rodc_dn, *krbtgt_link_dn;
808	int ret;
809	const char *rodc_attrs[] = { "msDS-KrbTgtLink", "msDS-NeverRevealGroup", "msDS-RevealOnDemandGroup", NULL };
810	const char *obj_attrs[] = { "tokenGroups", "objectSid", "UserAccountControl", "msDS-KrbTgtLinkBL", NULL };
811	struct ldb_result rodc_res, obj_res;
812	const struct dom_sid never_reveal_sids, reveal_sids, **token_sids;
813	WERROR werr;
814
815	DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_SECRET extended op on %s\n",
816	drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
817
818	/*
819	* we need to work out if we will allow this RODC to
820	* replicate the secrets for this object
821	*
822	* see 4.1.10.5.14 GetRevealSecretsPolicyForUser for details
823	* of this function
824	*/
825
826	if (b_state->sam_ctx_system == NULL) {
827	/* this operation needs system level access */
828	ctr6->extended_ret = DRSUAPI_EXOP_ERR_ACCESS_DENIED;
829	return WERR_DS_DRA_SOURCE_DISABLED;
830	}
831
832	obj_dn = drs_ObjectIdentifier_to_dn(mem_ctx, b_state->sam_ctx_system, ncRoot);
833	if (!ldb_dn_validate(obj_dn)) goto failed;
834
835	rodc_dn = ldb_dn_new_fmt(mem_ctx, b_state->sam_ctx_system, "<SID=%s>",
836	dom_sid_string(mem_ctx, user_sid));
837	if (!ldb_dn_validate(rodc_dn)) goto failed;
838
839	/* do the two searches we need */
840	ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &rodc_res, rodc_dn, rodc_attrs,
841	DSDB_SEARCH_SHOW_EXTENDED_DN);
842	if (ret != LDB_SUCCESS \|\| rodc_res->count != 1) goto failed;
843
844	ret = dsdb_search_dn(b_state->sam_ctx_system, mem_ctx, &obj_res, obj_dn, obj_attrs, 0);
845	if (ret != LDB_SUCCESS \|\| obj_res->count != 1) goto failed;
846
847	/* if the object SID is equal to the user_sid, allow */
848	if (dom_sid_equal(user_sid,
849	samdb_result_dom_sid(mem_ctx, obj_res->msgs[0], "objectSid"))) {
850	goto allowed;
851	}
852
853	/* an RODC is allowed to get its own krbtgt account secrets */
854	krbtgt_link_dn = samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
855	rodc_res->msgs[0], "msDS-KrbTgtLink", NULL);
856	if (krbtgt_link_dn != NULL &&
857	ldb_dn_compare(obj_dn, krbtgt_link_dn) == 0) {
858	goto allowed;
859	}
860
861	/* but it isn't allowed to get anyone elses krbtgt secrets */
862	if (samdb_result_dn(b_state->sam_ctx_system, mem_ctx,
863	obj_res->msgs[0], "msDS-KrbTgtLinkBL", NULL)) {
864	goto denied;
865	}
866
867	if (ldb_msg_find_attr_as_uint(obj_res->msgs[0],
868	"userAccountControl", 0) &
869	UF_INTERDOMAIN_TRUST_ACCOUNT) {
870	goto denied;
871	}
872
873	werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
874	mem_ctx, "msDS-NeverRevealGroup", &never_reveal_sids);
875	if (!W_ERROR_IS_OK(werr)) {
876	goto denied;
877	}
878
879	werr = samdb_result_sid_array_dn(b_state->sam_ctx_system, rodc_res->msgs[0],
880	mem_ctx, "msDS-RevealOnDemandGroup", &reveal_sids);
881	if (!W_ERROR_IS_OK(werr)) {
882	goto denied;
883	}
884
885	werr = samdb_result_sid_array_ndr(b_state->sam_ctx_system, obj_res->msgs[0],
886	mem_ctx, "tokenGroups", &token_sids);
887	if (!W_ERROR_IS_OK(werr) \|\| token_sids==NULL) {
888	goto denied;
889	}
890
891	if (never_reveal_sids &&
892	sid_list_match(token_sids, never_reveal_sids)) {
893	goto denied;
894	}
895
896	if (reveal_sids &&
897	sid_list_match(token_sids, reveal_sids)) {
898	goto allowed;
899	}
900
901	/* default deny */
902	denied:
903	DEBUG(2,(__location__ ": Denied RODC secret replication for %s by RODC %s\n",
904	ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
905	ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
906	return WERR_DS_DRA_ACCESS_DENIED;
907
908	allowed:
909	DEBUG(2,(__location__ ": Allowed RODC secret replication for %s by RODC %s\n",
910	ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
911	ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
912	req10->highwatermark.highest_usn = 0;
913	return WERR_OK;
914
915	failed:
916	DEBUG(2,(__location__ ": Failed RODC secret replication for %s by RODC %s\n",
917	ldb_dn_get_linearized(obj_dn), dom_sid_string(mem_ctx, user_sid)));
918	ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
919	return WERR_DS_DRA_BAD_DN;
920	}
921
922
923	/*
924	handle a DRSUAPI_EXOP_REPL_OBJ call
925	*/
926	static WERROR getncchanges_repl_obj(struct drsuapi_bind_state *b_state,
927	TALLOC_CTX *mem_ctx,
928	struct drsuapi_DsGetNCChangesRequest10 *req10,
929	struct dom_sid *user_sid,
930	struct drsuapi_DsGetNCChangesCtr6 *ctr6)
931	{
932	struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
933
934	DEBUG(3,(__location__ ": DRSUAPI_EXOP_REPL_OBJ extended op on %s\n",
935	drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
936
937	ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
938	req10->highwatermark.highest_usn = 0;
939	return WERR_OK;
940	}
941
942
943	/*
944	handle DRSUAPI_EXOP_FSMO_REQ_ROLE,
945	DRSUAPI_EXOP_FSMO_RID_REQ_ROLE,
946	and DRSUAPI_EXOP_FSMO_REQ_PDC calls
947	*/
948	static WERROR getncchanges_change_master(struct drsuapi_bind_state *b_state,
949	TALLOC_CTX *mem_ctx,
950	struct drsuapi_DsGetNCChangesRequest10 *req10,
951	struct drsuapi_DsGetNCChangesCtr6 *ctr6)
952	{
953	struct ldb_dn fsmo_role_dn, req_dn, *ntds_dn;
954	int ret;
955	unsigned int i;
956	struct ldb_context *ldb = b_state->sam_ctx;
957	struct ldb_message *msg;
958
959	/*
960	steps:
961	- verify that the client dn exists
962	- verify that we are the current master
963	*/
964
965	req_dn = drs_ObjectIdentifier_to_dn(mem_ctx, ldb, req10->naming_context);
966	if (!ldb_dn_validate(req_dn)) {
967	/* that is not a valid dn */
968	DEBUG(0,(__location__ ": FSMO role transfer request for invalid DN %s\n",
969	drs_ObjectIdentifier_to_string(mem_ctx, req10->naming_context)));
970	ctr6->extended_ret = DRSUAPI_EXOP_ERR_MISMATCH;
971	return WERR_OK;
972	}
973
974	/* retrieve the current role owner */
975	ret = samdb_reference_dn(ldb, mem_ctx, req_dn, "fSMORoleOwner", &fsmo_role_dn);
976	if (ret != LDB_SUCCESS) {
977	DEBUG(0,(__location__ ": Failed to find fSMORoleOwner in context - %s\n",
978	ldb_errstring(ldb)));
979	ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
980	return WERR_DS_DRA_INTERNAL_ERROR;
981	}
982
983	if (ldb_dn_compare(samdb_ntds_settings_dn(ldb), fsmo_role_dn) != 0) {
984	/* we're not the current owner - go away */
985	DEBUG(0,(__location__ ": FSMO transfer request when not owner\n"));
986	ctr6->extended_ret = DRSUAPI_EXOP_ERR_FSMO_NOT_OWNER;
987	return WERR_OK;
988	}
989
990	/* change the current master */
991	msg = ldb_msg_new(ldb);
992	W_ERROR_HAVE_NO_MEMORY(msg);
993	msg->dn = drs_ObjectIdentifier_to_dn(msg, ldb, req10->naming_context);
994	W_ERROR_HAVE_NO_MEMORY(msg->dn);
995
996	ret = dsdb_find_dn_by_guid(ldb, msg, &req10->destination_dsa_guid, &ntds_dn);
997	if (ret != LDB_SUCCESS) {
998	DEBUG(0, (__location__ ": Unable to find NTDS object for guid %s - %s\n",
999	GUID_string(mem_ctx, &req10->destination_dsa_guid), ldb_errstring(ldb)));
1000	talloc_free(msg);
1001	return WERR_DS_DRA_INTERNAL_ERROR;
1002	}
1003
1004	ret = ldb_msg_add_string(msg, "fSMORoleOwner", ldb_dn_get_linearized(ntds_dn));
1005	if (ret != 0) {
1006	talloc_free(msg);
1007	return WERR_DS_DRA_INTERNAL_ERROR;
1008	}
1009
1010	for (i=0;i<msg->num_elements;i++) {
1011	msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1012	}
1013
1014	ret = ldb_transaction_start(ldb);
1015	if (ret != LDB_SUCCESS) {
1016	DEBUG(0,(__location__ ": Failed transaction start - %s\n",
1017	ldb_errstring(ldb)));
1018	return WERR_DS_DRA_INTERNAL_ERROR;
1019	}
1020
1021	ret = ldb_modify(ldb, msg);
1022	if (ret != LDB_SUCCESS) {
1023	DEBUG(0,(__location__ ": Failed to change current owner - %s\n",
1024	ldb_errstring(ldb)));
1025	ldb_transaction_cancel(ldb);
1026	return WERR_DS_DRA_INTERNAL_ERROR;
1027	}
1028
1029	ret = ldb_transaction_commit(ldb);
1030	if (ret != LDB_SUCCESS) {
1031	DEBUG(0,(__location__ ": Failed transaction commit - %s\n",
1032	ldb_errstring(ldb)));
1033	return WERR_DS_DRA_INTERNAL_ERROR;
1034	}
1035
1036	ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1037
1038	return WERR_OK;
1039	}
1040
1041	/* state of a partially completed getncchanges call */
1042	struct drsuapi_getncchanges_state {
1043	struct GUID *guids;
1044	uint32_t num_records;
1045	uint32_t num_processed;
1046	struct ldb_dn *ncRoot_dn;
1047	bool is_schema_nc;
1048	uint64_t min_usn;
1049	uint64_t highest_usn;
1050	struct ldb_dn *last_dn;
1051	struct drsuapi_DsReplicaLinkedAttribute *la_list;
1052	uint32_t la_count;
1053	bool la_sorted;
1054	uint32_t la_idx;
1055	struct drsuapi_DsReplicaCursorCtrEx *uptodateness_vector;
1056	};
1057
1058	/*
1059	see if this getncchanges request includes a request to reveal secret information
1060	*/
1061	static WERROR dcesrv_drsuapi_is_reveal_secrets_request(struct drsuapi_bind_state *b_state,
1062	struct drsuapi_DsGetNCChangesRequest10 *req10,
1063	bool *is_secret_request)
1064	{
1065	enum drsuapi_DsExtendedOperation exop;
1066	uint32_t i;
1067	struct dsdb_schema *schema;
1068
1069	*is_secret_request = true;
1070
1071	exop = req10->extended_op;
1072
1073	switch (exop) {
1074	case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1075	case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1076	case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1077	case DRSUAPI_EXOP_FSMO_REQ_PDC:
1078	case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1079	/* FSMO exops can reveal secrets */
1080	*is_secret_request = true;
1081	return WERR_OK;
1082	case DRSUAPI_EXOP_REPL_SECRET:
1083	case DRSUAPI_EXOP_REPL_OBJ:
1084	case DRSUAPI_EXOP_NONE:
1085	break;
1086	}
1087
1088	if (req10->replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
1089	*is_secret_request = false;
1090	return WERR_OK;
1091	}
1092
1093	if (exop == DRSUAPI_EXOP_REPL_SECRET \|\|
1094	req10->partial_attribute_set == NULL) {
1095	/* they want secrets */
1096	*is_secret_request = true;
1097	return WERR_OK;
1098	}
1099
1100	schema = dsdb_get_schema(b_state->sam_ctx, NULL);
1101
1102	/* check the attributes they asked for */
1103	for (i=0; i<req10->partial_attribute_set->num_attids; i++) {
1104	const struct dsdb_attribute *sa;
1105	sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set->attids[i]);
1106	if (sa == NULL) {
1107	return WERR_DS_DRA_SCHEMA_MISMATCH;
1108	}
1109	if (!dsdb_attr_in_rodc_fas(sa)) {
1110	*is_secret_request = true;
1111	return WERR_OK;
1112	}
1113	}
1114
1115	/* check the attributes they asked for */
1116	for (i=0; i<req10->partial_attribute_set_ex->num_attids; i++) {
1117	const struct dsdb_attribute *sa;
1118	sa = dsdb_attribute_by_attributeID_id(schema, req10->partial_attribute_set_ex->attids[i]);
1119	if (sa == NULL) {
1120	return WERR_DS_DRA_SCHEMA_MISMATCH;
1121	}
1122	if (!dsdb_attr_in_rodc_fas(sa)) {
1123	*is_secret_request = true;
1124	return WERR_OK;
1125	}
1126	}
1127
1128	*is_secret_request = false;
1129	return WERR_OK;
1130	}
1131
1132
1133	/*
1134	map from req8 to req10
1135	*/
1136	static struct drsuapi_DsGetNCChangesRequest10 *
1137	getncchanges_map_req8(TALLOC_CTX *mem_ctx,
1138	struct drsuapi_DsGetNCChangesRequest8 *req8)
1139	{
1140	struct drsuapi_DsGetNCChangesRequest10 *req10 = talloc_zero(mem_ctx,
1141	struct drsuapi_DsGetNCChangesRequest10);
1142	if (req10 == NULL) {
1143	return NULL;
1144	}
1145
1146	req10->destination_dsa_guid = req8->destination_dsa_guid;
1147	req10->source_dsa_invocation_id = req8->source_dsa_invocation_id;
1148	req10->naming_context = req8->naming_context;
1149	req10->highwatermark = req8->highwatermark;
1150	req10->uptodateness_vector = req8->uptodateness_vector;
1151	req10->replica_flags = req8->replica_flags;
1152	req10->max_object_count = req8->max_object_count;
1153	req10->max_ndr_size = req8->max_ndr_size;
1154	req10->extended_op = req8->extended_op;
1155	req10->fsmo_info = req8->fsmo_info;
1156	req10->partial_attribute_set = req8->partial_attribute_set;
1157	req10->partial_attribute_set_ex = req8->partial_attribute_set_ex;
1158	req10->mapping_ctr = req8->mapping_ctr;
1159
1160	return req10;
1161	}
1162
1163
1164	/*
1165	drsuapi_DsGetNCChanges
1166
1167	see MS-DRSR 4.1.10.5.2 for basic logic of this function
1168	*/
1169	WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state dce_call, TALLOC_CTX mem_ctx,
1170	struct drsuapi_DsGetNCChanges *r)
1171	{
1172	struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
1173	int ret;
1174	uint32_t i;
1175	struct dsdb_schema *schema;
1176	struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
1177	struct drsuapi_DsReplicaObjectListItemEx **currentObject;
1178	NTSTATUS status;
1179	DATA_BLOB session_key;
1180	const char *attrs[] = { "uSNChanged",
1181	"objectGUID" ,
1182	NULL };
1183	WERROR werr;
1184	struct dcesrv_handle *h;
1185	struct drsuapi_bind_state *b_state;
1186	struct drsuapi_getncchanges_state *getnc_state;
1187	struct drsuapi_DsGetNCChangesRequest10 *req10;
1188	uint32_t options;
1189	uint32_t max_objects;
1190	uint32_t max_links;
1191	uint32_t link_count = 0;
1192	uint32_t link_total = 0;
1193	uint32_t link_given = 0;
1194	struct ldb_dn *search_dn = NULL;
1195	bool am_rodc, null_scope=false;
1196	enum security_user_level security_level;
1197	struct ldb_context *sam_ctx;
1198	struct dom_sid *user_sid;
1199	bool is_secret_request;
1200
1201	DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
1202	b_state = h->data;
1203
1204	sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
1205
1206	*r->out.level_out = 6;
1207	/* TODO: linked attributes*/
1208	r->out.ctr->ctr6.linked_attributes_count = 0;
1209	r->out.ctr->ctr6.linked_attributes = NULL;
1210
1211	r->out.ctr->ctr6.object_count = 0;
1212	r->out.ctr->ctr6.nc_object_count = 0;
1213	r->out.ctr->ctr6.more_data = false;
1214	r->out.ctr->ctr6.uptodateness_vector = NULL;
1215
1216	/* a RODC doesn't allow for any replication */
1217	ret = samdb_rodc(sam_ctx, &am_rodc);
1218	if (ret == LDB_SUCCESS && am_rodc) {
1219	DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
1220	return WERR_DS_DRA_SOURCE_DISABLED;
1221	}
1222
1223	/* Check request revision.
1224	*/
1225	switch (r->in.level) {
1226	case 8:
1227	req10 = getncchanges_map_req8(mem_ctx, &r->in.req->req8);
1228	if (req10 == NULL) {
1229	return WERR_NOMEM;
1230	}
1231	break;
1232	case 10:
1233	req10 = &r->in.req->req10;
1234	break;
1235	default:
1236	DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
1237	r->in.level));
1238	return WERR_REVISION_MISMATCH;
1239	}
1240
1241
1242	/* Perform access checks. */
1243	/* TODO: we need to support a sync on a specific non-root
1244	* DN. We'll need to find the real partition root here */
1245	ncRoot = req10->naming_context;
1246	if (ncRoot == NULL) {
1247	DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
1248	return WERR_DS_DRA_INVALID_PARAMETER;
1249	}
1250
1251	if (samdb_ntds_options(sam_ctx, &options) != LDB_SUCCESS) {
1252	return WERR_DS_DRA_INTERNAL_ERROR;
1253	}
1254
1255	if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
1256	!(req10->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
1257	return WERR_DS_DRA_SOURCE_DISABLED;
1258	}
1259
1260	user_sid = &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
1261
1262	werr = drs_security_access_check_nc_root(b_state->sam_ctx,
1263	mem_ctx,
1264	dce_call->conn->auth_state.session_info->security_token,
1265	req10->naming_context,
1266	GUID_DRS_GET_CHANGES);
1267	if (!W_ERROR_IS_OK(werr)) {
1268	return werr;
1269	}
1270
1271	werr = dcesrv_drsuapi_is_reveal_secrets_request(b_state, req10, &is_secret_request);
1272	if (!W_ERROR_IS_OK(werr)) {
1273	return werr;
1274	}
1275	if (is_secret_request && req10->extended_op != DRSUAPI_EXOP_REPL_SECRET) {
1276	werr = drs_security_access_check_nc_root(b_state->sam_ctx,
1277	mem_ctx,
1278	dce_call->conn->auth_state.session_info->security_token,
1279	req10->naming_context,
1280	GUID_DRS_GET_ALL_CHANGES);
1281	if (!W_ERROR_IS_OK(werr)) {
1282	return werr;
1283	}
1284	}
1285
1286	/* for non-administrator replications, check that they have
1287	given the correct source_dsa_invocation_id */
1288	security_level = security_session_user_level(dce_call->conn->auth_state.session_info,
1289	samdb_domain_sid(sam_ctx));
1290	if (security_level == SECURITY_RO_DOMAIN_CONTROLLER) {
1291	if (req10->replica_flags & DRSUAPI_DRS_WRIT_REP) {
1292	/* we rely on this flag being unset for RODC requests */
1293	req10->replica_flags &= ~DRSUAPI_DRS_WRIT_REP;
1294	}
1295	}
1296
1297	if (req10->replica_flags & DRSUAPI_DRS_FULL_SYNC_PACKET) {
1298	/* Ignore the _in_ uptpdateness vector*/
1299	req10->uptodateness_vector = NULL;
1300	}
1301
1302	getnc_state = b_state->getncchanges_state;
1303
1304	/* see if a previous replication has been abandoned */
1305	if (getnc_state) {
1306	struct ldb_dn *new_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
1307	if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
1308	DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s (last_dn %s)\n",
1309	ldb_dn_get_linearized(new_dn),
1310	ldb_dn_get_linearized(getnc_state->ncRoot_dn),
1311	ldb_dn_get_linearized(getnc_state->last_dn)));
1312	talloc_free(getnc_state);
1313	getnc_state = NULL;
1314	}
1315	}
1316
1317	if (getnc_state == NULL) {
1318	getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
1319	if (getnc_state == NULL) {
1320	return WERR_NOMEM;
1321	}
1322	b_state->getncchanges_state = getnc_state;
1323	getnc_state->ncRoot_dn = drs_ObjectIdentifier_to_dn(getnc_state, sam_ctx, ncRoot);
1324
1325	/* find out if we are to replicate Schema NC */
1326	ret = ldb_dn_compare(getnc_state->ncRoot_dn,
1327	ldb_get_schema_basedn(b_state->sam_ctx));
1328	getnc_state->is_schema_nc = (0 == ret);
1329
1330	/*
1331	* This is the first replication cycle and it is
1332	* a good place to handle extended operations
1333	*
1334	* FIXME: we don't fully support extended operations yet
1335	*/
1336	switch (req10->extended_op) {
1337	case DRSUAPI_EXOP_NONE:
1338	break;
1339	case DRSUAPI_EXOP_FSMO_RID_ALLOC:
1340	werr = getncchanges_rid_alloc(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1341	W_ERROR_NOT_OK_RETURN(werr);
1342	search_dn = ldb_get_default_basedn(sam_ctx);
1343	break;
1344	case DRSUAPI_EXOP_REPL_SECRET:
1345	werr = getncchanges_repl_secret(b_state, mem_ctx, req10, user_sid, &r->out.ctr->ctr6);
1346	r->out.result = werr;
1347	W_ERROR_NOT_OK_RETURN(werr);
1348	break;
1349	case DRSUAPI_EXOP_FSMO_REQ_ROLE:
1350	werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1351	W_ERROR_NOT_OK_RETURN(werr);
1352	break;
1353	case DRSUAPI_EXOP_FSMO_RID_REQ_ROLE:
1354	werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1355	W_ERROR_NOT_OK_RETURN(werr);
1356	break;
1357	case DRSUAPI_EXOP_FSMO_REQ_PDC:
1358	werr = getncchanges_change_master(b_state, mem_ctx, req10, &r->out.ctr->ctr6);
1359	W_ERROR_NOT_OK_RETURN(werr);
1360	break;
1361	case DRSUAPI_EXOP_REPL_OBJ:
1362	werr = getncchanges_repl_obj(b_state, mem_ctx, req10, user_sid, &r->out.ctr->ctr6);
1363	r->out.result = werr;
1364	W_ERROR_NOT_OK_RETURN(werr);
1365	break;
1366
1367	case DRSUAPI_EXOP_FSMO_ABANDON_ROLE:
1368
1369	DEBUG(0,(__location__ ": Request for DsGetNCChanges unsupported extended op 0x%x\n",
1370	(unsigned)req10->extended_op));
1371	return WERR_DS_DRA_NOT_SUPPORTED;
1372	}
1373	}
1374
1375	if (!ldb_dn_validate(getnc_state->ncRoot_dn) \|\|
1376	ldb_dn_is_null(getnc_state->ncRoot_dn)) {
1377	DEBUG(0,(__location__ ": Bad DN '%s'\n",
1378	drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
1379	return WERR_DS_DRA_INVALID_PARAMETER;
1380	}
1381
1382	/* we need the session key for encrypting password attributes */
1383	status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
1384	if (!NT_STATUS_IS_OK(status)) {
1385	DEBUG(0,(__location__ ": Failed to get session key\n"));
1386	return WERR_DS_DRA_INTERNAL_ERROR;
1387	}
1388
1389	/*
1390	TODO: MS-DRSR section 4.1.10.1.1
1391	Work out if this is the start of a new cycle */
1392
1393	if (getnc_state->guids == NULL) {
1394	char* search_filter;
1395	enum ldb_scope scope = LDB_SCOPE_SUBTREE;
1396	const char *extra_filter;
1397	struct ldb_result *search_res;
1398
1399	if (req10->extended_op == DRSUAPI_EXOP_REPL_OBJ \|\|
1400	req10->extended_op == DRSUAPI_EXOP_REPL_SECRET) {
1401	scope = LDB_SCOPE_BASE;
1402	}
1403
1404	extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
1405
1406	getnc_state->min_usn = req10->highwatermark.highest_usn;
1407
1408	/* Construct response. */
1409	search_filter = talloc_asprintf(mem_ctx,
1410	"(uSNChanged>=%llu)",
1411	(unsigned long long)(getnc_state->min_usn+1));
1412
1413	if (extra_filter) {
1414	search_filter = talloc_asprintf(mem_ctx, "(&%s(%s))", search_filter, extra_filter);
1415	}
1416
1417	if (req10->replica_flags & DRSUAPI_DRS_CRITICAL_ONLY) {
1418	search_filter = talloc_asprintf(mem_ctx,
1419	"(&%s(isCriticalSystemObject=TRUE))",
1420	search_filter);
1421	}
1422
1423	if (req10->replica_flags & DRSUAPI_DRS_ASYNC_REP) {
1424	scope = LDB_SCOPE_BASE;
1425	}
1426
1427	if (!search_dn) {
1428	search_dn = getnc_state->ncRoot_dn;
1429	}
1430
1431	DEBUG(2,(__location__ ": getncchanges on %s using filter %s\n",
1432	ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
1433	ret = drsuapi_search_with_extended_dn(sam_ctx, getnc_state, &search_res,
1434	search_dn, scope, attrs,
1435	search_filter);
1436	if (ret != LDB_SUCCESS) {
1437	return WERR_DS_DRA_INTERNAL_ERROR;
1438	}
1439
1440	if (req10->replica_flags & DRSUAPI_DRS_GET_ANC) {
1441	TYPESAFE_QSORT(search_res->msgs,
1442	search_res->count,
1443	site_res_cmp_parent_order);
1444	} else {
1445	TYPESAFE_QSORT(search_res->msgs,
1446	search_res->count,
1447	site_res_cmp_usn_order);
1448	}
1449
1450	/* extract out the GUIDs list */
1451	getnc_state->num_records = search_res->count;
1452	getnc_state->guids = talloc_array(getnc_state, struct GUID, getnc_state->num_records);
1453	W_ERROR_HAVE_NO_MEMORY(getnc_state->guids);
1454
1455	for (i=0; i<getnc_state->num_records; i++) {
1456	getnc_state->guids[i] = samdb_result_guid(search_res->msgs[i], "objectGUID");
1457	if (GUID_all_zero(&getnc_state->guids[i])) {
1458	DEBUG(2,("getncchanges: bad objectGUID from %s\n", ldb_dn_get_linearized(search_res->msgs[i]->dn)));
1459	return WERR_DS_DRA_INTERNAL_ERROR;
1460	}
1461	}
1462
1463
1464	talloc_free(search_res);
1465
1466	getnc_state->uptodateness_vector = talloc_steal(getnc_state, req10->uptodateness_vector);
1467	if (getnc_state->uptodateness_vector) {
1468	/* make sure its sorted */
1469	TYPESAFE_QSORT(getnc_state->uptodateness_vector->cursors,
1470	getnc_state->uptodateness_vector->count,
1471	drsuapi_DsReplicaCursor_compare);
1472	}
1473	}
1474
1475	/* Prefix mapping */
1476	schema = dsdb_get_schema(sam_ctx, mem_ctx);
1477	if (!schema) {
1478	DEBUG(0,("No schema in sam_ctx\n"));
1479	return WERR_DS_DRA_INTERNAL_ERROR;
1480	}
1481
1482	r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
1483	r->out.ctr->ctr6.naming_context = ncRoot;
1484
1485	if (dsdb_find_guid_by_dn(sam_ctx, getnc_state->ncRoot_dn,
1486	&r->out.ctr->ctr6.naming_context->guid) != LDB_SUCCESS) {
1487	DEBUG(0,(__location__ ": Failed to find GUID of ncRoot_dn %s\n",
1488	ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
1489	return WERR_DS_DRA_INTERNAL_ERROR;
1490	}
1491
1492	/* find the SID if there is one */
1493	dsdb_find_sid_by_dn(sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
1494
1495	dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
1496	r->out.ctr->ctr6.mapping_ctr = *ctr;
1497
1498	r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(sam_ctx));
1499	r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
1500
1501	r->out.ctr->ctr6.old_highwatermark = req10->highwatermark;
1502	r->out.ctr->ctr6.new_highwatermark = req10->highwatermark;
1503
1504	r->out.ctr->ctr6.first_object = NULL;
1505	currentObject = &r->out.ctr->ctr6.first_object;
1506
1507	/* use this to force single objects at a time, which is useful
1508	* for working out what object is giving problems
1509	*/
1510	max_objects = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max object sync", 1000);
1511	if (req10->max_object_count < max_objects) {
1512	max_objects = req10->max_object_count;
1513	}
1514	/*
1515	* TODO: work out how the maximum should be calculated
1516	*/
1517	max_links = lpcfg_parm_int(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "max link sync", 1500);
1518
1519	for (i=getnc_state->num_processed;
1520	i<getnc_state->num_records &&
1521	!null_scope &&
1522	(r->out.ctr->ctr6.object_count < max_objects);
1523	i++) {
1524	int uSN;
1525	struct drsuapi_DsReplicaObjectListItemEx *obj;
1526	struct ldb_message *msg;
1527	static const char * const msg_attrs[] = {
1528	"*",
1529	"nTSecurityDescriptor",
1530	"parentGUID",
1531	"replPropertyMetaData",
1532	DSDB_SECRET_ATTRIBUTES,
1533	NULL };
1534	struct ldb_result *msg_res;
1535	struct ldb_dn *msg_dn;
1536
1537	obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
1538	W_ERROR_HAVE_NO_MEMORY(obj);
1539
1540	msg_dn = ldb_dn_new_fmt(obj, sam_ctx, "<GUID=%s>", GUID_string(obj, &getnc_state->guids[i]));
1541	W_ERROR_HAVE_NO_MEMORY(msg_dn);
1542
1543
1544	/* by re-searching here we avoid having a lot of full
1545	* records in memory between calls to getncchanges
1546	*/
1547	ret = drsuapi_search_with_extended_dn(sam_ctx, obj, &msg_res,
1548	msg_dn,
1549	LDB_SCOPE_BASE, msg_attrs, NULL);
1550	if (ret != LDB_SUCCESS) {
1551	if (ret != LDB_ERR_NO_SUCH_OBJECT) {
1552	DEBUG(1,("getncchanges: failed to fetch DN %s - %s\n",
1553	ldb_dn_get_extended_linearized(obj, msg_dn, 1), ldb_errstring(sam_ctx)));
1554	}
1555	talloc_free(obj);
1556	continue;
1557	}
1558
1559	msg = msg_res->msgs[0];
1560
1561	werr = get_nc_changes_build_object(obj, msg,
1562	sam_ctx, getnc_state->ncRoot_dn,
1563	getnc_state->is_schema_nc,
1564	schema, &session_key, getnc_state->min_usn,
1565	req10->replica_flags,
1566	req10->partial_attribute_set,
1567	getnc_state->uptodateness_vector,
1568	req10->extended_op);
1569	if (!W_ERROR_IS_OK(werr)) {
1570	return werr;
1571	}
1572
1573	werr = get_nc_changes_add_links(sam_ctx, getnc_state,
1574	getnc_state->ncRoot_dn,
1575	schema, getnc_state->min_usn,
1576	req10->replica_flags,
1577	msg,
1578	&getnc_state->la_list,
1579	&getnc_state->la_count,
1580	getnc_state->uptodateness_vector);
1581	if (!W_ERROR_IS_OK(werr)) {
1582	return werr;
1583	}
1584
1585	uSN = ldb_msg_find_attr_as_int(msg, "uSNChanged", -1);
1586	if (uSN > r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn) {
1587	r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn = uSN;
1588	}
1589	if (uSN > getnc_state->highest_usn) {
1590	getnc_state->highest_usn = uSN;
1591	}
1592
1593	if (obj->meta_data_ctr == NULL) {
1594	DEBUG(8,(__location__ ": getncchanges skipping send of object %s\n",
1595	ldb_dn_get_linearized(msg->dn)));
1596	/* no attributes to send */
1597	talloc_free(obj);
1598	continue;
1599	}
1600
1601	r->out.ctr->ctr6.object_count++;
1602
1603	*currentObject = obj;
1604	currentObject = &obj->next_object;
1605
1606	talloc_free(getnc_state->last_dn);
1607	getnc_state->last_dn = ldb_dn_copy(getnc_state, msg->dn);
1608
1609	DEBUG(8,(__location__ ": replicating object %s\n", ldb_dn_get_linearized(msg->dn)));
1610
1611	talloc_free(msg_res);
1612	talloc_free(msg_dn);
1613	}
1614
1615	getnc_state->num_processed = i;
1616
1617	r->out.ctr->ctr6.nc_object_count = getnc_state->num_records;
1618
1619	/* the client can us to call UpdateRefs on its behalf to
1620	re-establish monitoring of the NC */
1621	if ((req10->replica_flags & (DRSUAPI_DRS_ADD_REF \| DRSUAPI_DRS_REF_GCSPN)) &&
1622	!GUID_all_zero(&req10->destination_dsa_guid)) {
1623	struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
1624	DEBUG(3,("UpdateRefs on getncchanges for %s\n",
1625	GUID_string(mem_ctx, &req10->destination_dsa_guid)));
1626	ureq.naming_context = ncRoot;
1627	ureq.dest_dsa_dns_name = talloc_asprintf(mem_ctx, "%s._msdcs.%s",
1628	GUID_string(mem_ctx, &req10->destination_dsa_guid),
1629	lpcfg_dnsdomain(dce_call->conn->dce_ctx->lp_ctx));
1630	if (!ureq.dest_dsa_dns_name) {
1631	return WERR_NOMEM;
1632	}
1633	ureq.dest_dsa_guid = req10->destination_dsa_guid;
1634	ureq.options = DRSUAPI_DRS_ADD_REF \|
1635	DRSUAPI_DRS_ASYNC_OP \|
1636	DRSUAPI_DRS_GETCHG_CHECK;
1637
1638	/* we also need to pass through the
1639	DRSUAPI_DRS_REF_GCSPN bit so that repsTo gets flagged
1640	to send notifies using the GC SPN */
1641	ureq.options \|= (req10->replica_flags & DRSUAPI_DRS_REF_GCSPN);
1642
1643	werr = drsuapi_UpdateRefs(b_state, mem_ctx, &ureq);
1644	if (!W_ERROR_IS_OK(werr)) {
1645	DEBUG(0,(__location__ ": Failed UpdateRefs in DsGetNCChanges - %s\n",
1646	win_errstr(werr)));
1647	}
1648	}
1649
1650	/*
1651	* TODO:
1652	* This is just a guess, how to calculate the
1653	* number of linked attributes to send, we need to
1654	* find out how to do this right.
1655	*/
1656	if (r->out.ctr->ctr6.object_count >= max_links) {
1657	max_links = 0;
1658	} else {
1659	max_links -= r->out.ctr->ctr6.object_count;
1660	}
1661
1662	link_total = getnc_state->la_count;
1663
1664	if (i < getnc_state->num_records) {
1665	r->out.ctr->ctr6.more_data = true;
1666	} else {
1667	/* sort the whole array the first time */
1668	if (!getnc_state->la_sorted) {
1669	LDB_TYPESAFE_QSORT(getnc_state->la_list, getnc_state->la_count,
1670	sam_ctx, linked_attribute_compare);
1671	getnc_state->la_sorted = true;
1672	}
1673
1674	link_count = getnc_state->la_count - getnc_state->la_idx;
1675	link_count = MIN(max_links, link_count);
1676
1677	r->out.ctr->ctr6.linked_attributes_count = link_count;
1678	r->out.ctr->ctr6.linked_attributes = getnc_state->la_list + getnc_state->la_idx;
1679
1680	getnc_state->la_idx += link_count;
1681	link_given = getnc_state->la_idx;
1682
1683	if (getnc_state->la_idx < getnc_state->la_count) {
1684	r->out.ctr->ctr6.more_data = true;
1685	}
1686	}
1687
1688	if (!r->out.ctr->ctr6.more_data) {
1689	talloc_steal(mem_ctx, getnc_state->la_list);
1690
1691	r->out.ctr->ctr6.uptodateness_vector = talloc(mem_ctx, struct drsuapi_DsReplicaCursor2CtrEx);
1692	r->out.ctr->ctr6.new_highwatermark.highest_usn = r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn;
1693
1694	werr = get_nc_changes_udv(sam_ctx, getnc_state->ncRoot_dn,
1695	r->out.ctr->ctr6.uptodateness_vector);
1696	if (!W_ERROR_IS_OK(werr)) {
1697	return werr;
1698	}
1699
1700	talloc_free(getnc_state);
1701	b_state->getncchanges_state = NULL;
1702	}
1703
1704	if (req10->extended_op != DRSUAPI_EXOP_NONE) {
1705	r->out.ctr->ctr6.uptodateness_vector = NULL;
1706	r->out.ctr->ctr6.nc_object_count = 0;
1707	ZERO_STRUCT(r->out.ctr->ctr6.new_highwatermark);
1708	r->out.ctr->ctr6.extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
1709	}
1710
1711	DEBUG(r->out.ctr->ctr6.more_data?4:2,
1712	("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %u/%u) %u links (done %u/%u (as %s))\n",
1713	(unsigned long long)(req10->highwatermark.highest_usn+1),
1714	req10->replica_flags, drs_ObjectIdentifier_to_string(mem_ctx, ncRoot),
1715	r->out.ctr->ctr6.object_count,
1716	i, r->out.ctr->ctr6.more_data?getnc_state->num_records:i,
1717	r->out.ctr->ctr6.linked_attributes_count,
1718	link_given, link_total,
1719	dom_sid_string(mem_ctx, user_sid)));
1720
1721	#if 0
1722	if (!r->out.ctr->ctr6.more_data && req10->extended_op != DRSUAPI_EXOP_NONE) {
1723	NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsGetNCChanges, NDR_BOTH, r);
1724	}
1725	#endif
1726
1727	return WERR_OK;
1728	}

Note: See TracBrowser for help on using the repository browser.

Context Navigation

source: trunk/server/source4/rpc_server/drsuapi/getncchanges.c

Download in other formats: