sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-27 03:21:53 +03:00
Code
4bb2958f16
samba-mirror/source4/rpc_server/drsuapi/getncchanges.c

611 lines
20 KiB
C
Raw Normal View History

s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
/*
Unix SMB/CIFS implementation.
implement the DRSUpdateRefs call
Copyright (C) Anatoliy Atanasov 2009
Copyright (C) Andrew Tridgell 2009
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "rpc_server/dcerpc_server.h"
#include "dsdb/samdb/samdb.h"
#include "param/param.h"
#include "librpc/gen_ndr/ndr_drsblobs.h"
#include "rpc_server/drsuapi/dcesrv_drsuapi.h"
s4/drs: enable attribute encryption This means we now get passwords vampired correctly for s4<->s4 replication.
2009-09-10 11:46:30 +04:00
#include "rpc_server/dcerpc_server_proto.h"
#include "../libcli/drsuapi/drsuapi.h"
s4-drs: lock down key DRS calls The key DRS calls should only be allowed by administrators or domain controllers
2009-09-16 06:26:33 +04:00
#include "libcli/security/security.h"
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
/*
s4/drs: enable attribute encryption This means we now get passwords vampired correctly for s4<->s4 replication.
2009-09-10 11:46:30 +04:00
drsuapi_DsGetNCChanges for one object
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
*/
static WERROR get_nc_changes_build_object(struct drsuapi_DsReplicaObjectListItemEx *obj,
struct ldb_message *msg,
struct ldb_context *sam_ctx,
struct ldb_dn *ncRoot_dn,
s4/drs: enable attribute encryption This means we now get passwords vampired correctly for s4<->s4 replication.
2009-09-10 11:46:30 +04:00
struct dsdb_schema *schema,
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
DATA_BLOB *session_key,
s4: Handle DRSUAPI_DS_REPLICA_NEIGHBOUR_SPECIAL_SECRET_PROCESSING in getncchanges When this flag is specified in the request these attributes are treated as secret: currentValue, dBCSPwd, initialAuthIncoming, initialAuthOutgoing, lmPwdHistory, ntPwdHistory, priorValue, supplementalCredentials, trustAuthIncoming, trustAuthOutgoing, unicodePwd Their value is changed to NULL and the meta_data.originating_change_time to 0
2009-09-24 03:51:55 +04:00
uint64_t highest_usn,
uint32_t replica_flags)
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
{
const struct ldb_val *md_value;
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
int i, n;
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
struct ldb_dn *obj_dn;
s4:drs match the meta_data and attributes array These two arrays need to be in sync, as they are walked in sync by the client
2009-09-09 17:38:51 +04:00
struct replPropertyMetaDataBlob md;
s4/drs: enable attribute encryption This means we now get passwords vampired correctly for s4<->s4 replication.
2009-09-10 11:46:30 +04:00
struct dom_sid *sid;
uint32_t rid = 0;
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
enum ndr_err_code ndr_err;
uint32_t *attids;
s4-drs: fill in more guids and SIDs, plus filter rDN In DsGetNCChanges we need to fill in the parentGUID and objectGUID of each object, plus we need to filter out the rDN from the meta data, and always send the instanceType
2009-09-24 00:56:10 +04:00
const char *rdn;
const struct dsdb_attribute *rdn_sa;
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
if (ldb_dn_compare(ncRoot_dn, msg->dn) == 0) {
obj->is_nc_prefix = true;
obj->parent_object_guid = NULL;
} else {
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
struct ldb_dn *parent_dn;
uint32_t instance_type;
instance_type = ldb_msg_find_attr_as_uint(msg, "instanceType", 0);
if (instance_type & INSTANCE_TYPE_IS_NC_HEAD) {
struct ldb_result *res;
int ret;
s4-drs: take advantage of system session auth in dsbind Now that the bind opens samdb with the right credentials, we no longer need the re-open in updaterefs and getncchanges
2009-10-06 11:59:30 +04:00
const char *dnstr = ldb_dn_get_linearized(msg->dn);
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
msg->dn = ldb_dn_new(msg, sam_ctx, dnstr);
/* we need to re-search the msg, to avoid the
* broken dual message problems with our
* partitions implementation */
DEBUG(6,(__location__ ": Re-fetching subref %s\n",
ldb_dn_get_linearized(msg->dn)));
ret = drsuapi_search_with_extended_dn(sam_ctx, msg, &res,
msg->dn, LDB_SCOPE_BASE, NULL,
NULL, NULL);
if (ret != LDB_SUCCESS || res->count < 1) {
DEBUG(0,(__location__ ": Failed to reload subref head %s in %s\n",
ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(ncRoot_dn)));
s4-drs: fill in more guids and SIDs, plus filter rDN In DsGetNCChanges we need to fill in the parentGUID and objectGUID of each object, plus we need to filter out the rDN from the meta data, and always send the instanceType
2009-09-24 00:56:10 +04:00
return WERR_DS_DRA_INTERNAL_ERROR;
}
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
msg = res->msgs[0];
}
parent_dn = ldb_dn_copy(msg, msg->dn);
obj->is_nc_prefix = false;
obj->parent_object_guid = talloc(obj, struct GUID);
if (parent_dn == NULL) {
return WERR_DS_DRA_INTERNAL_ERROR;
s4-drs: fill in more guids and SIDs, plus filter rDN In DsGetNCChanges we need to fill in the parentGUID and objectGUID of each object, plus we need to filter out the rDN from the meta data, and always send the instanceType
2009-09-24 00:56:10 +04:00
}
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
if (ldb_dn_remove_child_components(parent_dn, 1) != true) {
DEBUG(0,(__location__ ": Unable to remove DN component\n"));
return WERR_DS_DRA_INTERNAL_ERROR;
}
if (dsdb_find_guid_by_dn(sam_ctx, parent_dn, obj->parent_object_guid) != LDB_SUCCESS) {
DEBUG(0,(__location__ ": Unable to find parent DN %s %s\n",
ldb_dn_get_linearized(msg->dn), ldb_dn_get_linearized(parent_dn)));
}
talloc_free(parent_dn);
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
}
obj->next_object = NULL;
md_value = ldb_msg_find_ldb_val(msg, "replPropertyMetaData");
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
if (!md_value) {
/* nothing to send */
return WERR_OK;
}
ndr_err = ndr_pull_struct_blob(md_value, obj,
lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")), &md,
(ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return WERR_DS_DRA_INTERNAL_ERROR;
}
if (md.version != 1) {
return WERR_DS_DRA_INTERNAL_ERROR;
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
}
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
s4-drs: fill in more guids and SIDs, plus filter rDN In DsGetNCChanges we need to fill in the parentGUID and objectGUID of each object, plus we need to filter out the rDN from the meta data, and always send the instanceType
2009-09-24 00:56:10 +04:00
rdn = ldb_dn_get_rdn_name(msg->dn);
if (rdn == NULL) {
DEBUG(0,(__location__ ": No rDN for %s\n", ldb_dn_get_linearized(msg->dn)));
return WERR_DS_DRA_INTERNAL_ERROR;
}
rdn_sa = dsdb_attribute_by_lDAPDisplayName(schema, rdn);
if (rdn_sa == NULL) {
DEBUG(0,(__location__ ": Can't find dsds_attribute for rDN %s in %s\n",
rdn, ldb_dn_get_linearized(msg->dn)));
return WERR_DS_DRA_INTERNAL_ERROR;
}
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
obj->meta_data_ctr = talloc(obj, struct drsuapi_DsReplicaMetaDataCtr);
attids = talloc_array(obj, uint32_t, md.ctr.ctr1.count);
s4-drs: fixed UDV and overlapping sync calls in DRS When windows abandons a DRS sync, it will sometimes re-use the same bind handle for a new sync. This means we need to check the DN of the sync and blank the getnc_state if the DN has changed. This also fixes the UDV to use the highest uSN for the partition, not for the whole SAM.
2009-12-03 01:19:55 +03:00
obj->object.identifier = talloc(obj, struct drsuapi_DsReplicaObjectIdentifier);
obj_dn = ldb_msg_find_attr_as_dn(sam_ctx, obj, msg, "distinguishedName");
obj->object.identifier->dn = ldb_dn_get_linearized(obj_dn);
obj->object.identifier->guid = samdb_result_guid(msg, "objectGUID");
sid = samdb_result_dom_sid(obj, msg, "objectSid");
if (sid) {
dom_sid_split_rid(NULL, sid, NULL, &rid);
obj->object.identifier->sid = *sid;
} else {
ZERO_STRUCT(obj->object.identifier->sid);
}
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
obj->meta_data_ctr->meta_data = talloc_array(obj, struct drsuapi_DsReplicaMetaData, md.ctr.ctr1.count);
for (n=i=0; i<md.ctr.ctr1.count; i++) {
s4-drs: fill in more guids and SIDs, plus filter rDN In DsGetNCChanges we need to fill in the parentGUID and objectGUID of each object, plus we need to filter out the rDN from the meta data, and always send the instanceType
2009-09-24 00:56:10 +04:00
/* if the attribute has not changed, and it is not the
instanceType then don't include it */
if (md.ctr.ctr1.array[i].local_usn < highest_usn &&
md.ctr.ctr1.array[i].attid != DRSUAPI_ATTRIBUTE_instanceType) continue;
s4-drs: support DRSUAPI_DRS_ADD_REF flag The DRSUAPI_DRS_ADD_REF flag tells the DRS server to run an UpdateRefs call on behalf of the client after the DsGetNCChanges call. The lack of support for this option may explain why the repsTo attribute was not being created for w2k8-r2 replication partners.
2009-10-14 13:29:39 +04:00
s4-drs: fill in more guids and SIDs, plus filter rDN In DsGetNCChanges we need to fill in the parentGUID and objectGUID of each object, plus we need to filter out the rDN from the meta data, and always send the instanceType
2009-09-24 00:56:10 +04:00
/* don't include the rDN */
if (md.ctr.ctr1.array[i].attid == rdn_sa->attributeID_id) continue;
s4-drs: support DRSUAPI_DRS_ADD_REF flag The DRSUAPI_DRS_ADD_REF flag tells the DRS server to run an UpdateRefs call on behalf of the client after the DsGetNCChanges call. The lack of support for this option may explain why the repsTo attribute was not being created for w2k8-r2 replication partners.
2009-10-14 13:29:39 +04:00
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
obj->meta_data_ctr->meta_data[n].originating_change_time = md.ctr.ctr1.array[i].originating_change_time;
obj->meta_data_ctr->meta_data[n].version = md.ctr.ctr1.array[i].version;
obj->meta_data_ctr->meta_data[n].originating_invocation_id = md.ctr.ctr1.array[i].originating_invocation_id;
obj->meta_data_ctr->meta_data[n].originating_usn = md.ctr.ctr1.array[i].originating_usn;
attids[n] = md.ctr.ctr1.array[i].attid;
n++;
}
s4-drs: allow replication of renames a rename may have no attribute changes
2009-09-15 00:12:32 +04:00
/*
note that if n==0 we still need to send the change, as it
could be a rename, which changes the uSNChanged, but not any
of the replicated attributes
*/
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
obj->meta_data_ctr->count = n;
s4-drs: fill in more guids and SIDs, plus filter rDN In DsGetNCChanges we need to fill in the parentGUID and objectGUID of each object, plus we need to filter out the rDN from the meta data, and always send the instanceType
2009-09-24 00:56:10 +04:00
obj->object.flags = DRSUAPI_DS_REPLICA_OBJECT_FROM_MASTER;
s4:drs match the meta_data and attributes array These two arrays need to be in sync, as they are walked in sync by the client
2009-09-09 17:38:51 +04:00
obj->object.attribute_ctr.num_attributes = obj->meta_data_ctr->count;
obj->object.attribute_ctr.attributes = talloc_array(obj, struct drsuapi_DsReplicaAttribute,
obj->object.attribute_ctr.num_attributes);
/*
* Note that the meta_data array and the attributes array must
* be the same size and in the same order
*/
for (i=0; i<obj->object.attribute_ctr.num_attributes; i++) {
struct ldb_message_element *el;
WERROR werr;
s4-drs: fill in more guids and SIDs, plus filter rDN In DsGetNCChanges we need to fill in the parentGUID and objectGUID of each object, plus we need to filter out the rDN from the meta data, and always send the instanceType
2009-09-24 00:56:10 +04:00
const struct dsdb_attribute *sa;
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
sa = dsdb_attribute_by_attributeID_id(schema, attids[i]);
s4:drs match the meta_data and attributes array These two arrays need to be in sync, as they are walked in sync by the client
2009-09-09 17:38:51 +04:00
if (!sa) {
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
DEBUG(0,("Unable to find attributeID %u in schema\n", attids[i]));
s4:drs match the meta_data and attributes array These two arrays need to be in sync, as they are walked in sync by the client
2009-09-09 17:38:51 +04:00
return WERR_DS_DRA_INTERNAL_ERROR;
}
el = ldb_msg_find_element(msg, sa->lDAPDisplayName);
if (el == NULL) {
s4-drs: fixed UDV and overlapping sync calls in DRS When windows abandons a DRS sync, it will sometimes re-use the same bind handle for a new sync. This means we need to check the DN of the sync and blank the getnc_state if the DN has changed. This also fixes the UDV to use the highest uSN for the partition, not for the whole SAM.
2009-12-03 01:19:55 +03:00
/* this happens for attributes that have been removed */
DEBUG(5,("No element '%s' for attributeID %u in message\n",
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
sa->lDAPDisplayName, attids[i]));
s4/drs: when we don't find an attribute use zero values thanks to metze for pointing this out
2009-09-09 19:27:12 +04:00
ZERO_STRUCT(obj->object.attribute_ctr.attributes[i]);
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
obj->object.attribute_ctr.attributes[i].attid = attids[i];
s4/drs: when we don't find an attribute use zero values thanks to metze for pointing this out
2009-09-09 19:27:12 +04:00
} else {
werr = dsdb_attribute_ldb_to_drsuapi(sam_ctx, schema, el, obj,
&obj->object.attribute_ctr.attributes[i]);
if (!W_ERROR_IS_OK(werr)) {
DEBUG(0,("Unable to convert %s to DRS object - %s\n",
sa->lDAPDisplayName, win_errstr(werr)));
return werr;
}
s4-drs: support DRSUAPI_DRS_ADD_REF flag The DRSUAPI_DRS_ADD_REF flag tells the DRS server to run an UpdateRefs call on behalf of the client after the DsGetNCChanges call. The lack of support for this option may explain why the repsTo attribute was not being created for w2k8-r2 replication partners.
2009-10-14 13:29:39 +04:00
/* if DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING is set
s4: Handle DRSUAPI_DS_REPLICA_NEIGHBOUR_SPECIAL_SECRET_PROCESSING in getncchanges When this flag is specified in the request these attributes are treated as secret: currentValue, dBCSPwd, initialAuthIncoming, initialAuthOutgoing, lmPwdHistory, ntPwdHistory, priorValue, supplementalCredentials, trustAuthIncoming, trustAuthOutgoing, unicodePwd Their value is changed to NULL and the meta_data.originating_change_time to 0
2009-09-24 03:51:55 +04:00
* check if attribute is secret and send a null value
*/
s4-drs: support DRSUAPI_DRS_ADD_REF flag The DRSUAPI_DRS_ADD_REF flag tells the DRS server to run an UpdateRefs call on behalf of the client after the DsGetNCChanges call. The lack of support for this option may explain why the repsTo attribute was not being created for w2k8-r2 replication partners.
2009-10-14 13:29:39 +04:00
if (replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
s4: Handle DRSUAPI_DS_REPLICA_NEIGHBOUR_SPECIAL_SECRET_PROCESSING in getncchanges When this flag is specified in the request these attributes are treated as secret: currentValue, dBCSPwd, initialAuthIncoming, initialAuthOutgoing, lmPwdHistory, ntPwdHistory, priorValue, supplementalCredentials, trustAuthIncoming, trustAuthOutgoing, unicodePwd Their value is changed to NULL and the meta_data.originating_change_time to 0
2009-09-24 03:51:55 +04:00
drsuapi_process_secret_attribute(&obj->object.attribute_ctr.attributes[i],
&obj->meta_data_ctr->meta_data[i]);
}
s4/drs: enable attribute encryption This means we now get passwords vampired correctly for s4<->s4 replication.
2009-09-10 11:46:30 +04:00
/* some attributes needs to be encrypted
before being sent */
werr = drsuapi_encrypt_attribute(obj, session_key, rid,
&obj->object.attribute_ctr.attributes[i]);
if (!W_ERROR_IS_OK(werr)) {
DEBUG(0,("Unable to encrypt %s in DRS object - %s\n",
sa->lDAPDisplayName, win_errstr(werr)));
return werr;
}
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
}
}
return WERR_OK;
}
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
/*
load replUpToDateVector from a DN
*/
static WERROR load_udv(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
struct ldb_dn *dn, struct replUpToDateVectorBlob *ouv)
Fix up-to-dateness vector creation.
2009-09-10 13:41:48 +04:00
{
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
const char *attrs[] = { "replUpToDateVector", NULL };
struct ldb_result *res = NULL;
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
struct ldb_message_element *el;
enum ndr_err_code ndr_err;
ZERO_STRUCTP(ouv);
if (ldb_search(sam_ctx, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, NULL) != LDB_SUCCESS ||
res->count < 1) {
DEBUG(0,("load_udv: failed to read partition object\n"));
talloc_free(tmp_ctx);
return WERR_DS_DRA_INTERNAL_ERROR;
}
Fix up-to-dateness vector creation.
2009-09-10 13:41:48 +04:00
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
el = ldb_msg_find_element(res->msgs[0], "replUpToDateVector");
if (el == NULL || el->num_values < 1) {
talloc_free(tmp_ctx);
ouv->version = 2;
return WERR_OK;
}
Fix up-to-dateness vector creation.
2009-09-10 13:41:48 +04:00
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
ndr_err = ndr_pull_struct_blob(&el->values[0],
mem_ctx, lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")),
ouv,
(ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
talloc_free(tmp_ctx);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
DEBUG(0,(__location__ ": Failed to parse replUpToDateVector for %s\n",
ldb_dn_get_linearized(dn)));
return WERR_DS_DRA_INTERNAL_ERROR;
}
return WERR_OK;
}
/*
fill in the cursors return based on the replUpToDateVector for the ncRoot_dn
*/
static WERROR get_nc_changes_udv(struct ldb_context *sam_ctx,
struct ldb_dn *ncRoot_dn,
s4-drs: fixed UDV and overlapping sync calls in DRS When windows abandons a DRS sync, it will sometimes re-use the same bind handle for a new sync. This means we need to check the DN of the sync and blank the getnc_state if the DN has changed. This also fixes the UDV to use the highest uSN for the partition, not for the whole SAM.
2009-12-03 01:19:55 +03:00
struct drsuapi_DsReplicaCursor2CtrEx *udv,
uint64_t highestUSN)
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
{
WERROR werr;
struct drsuapi_DsReplicaCursor2 *tmp_cursor;
NTTIME now;
time_t t = time(NULL);
struct replUpToDateVectorBlob ouv;
werr = load_udv(sam_ctx, udv, ncRoot_dn, &ouv);
if (!W_ERROR_IS_OK(werr)) {
return werr;
}
tmp_cursor = talloc(udv, struct drsuapi_DsReplicaCursor2);
tmp_cursor->source_dsa_invocation_id = *(samdb_ntds_invocation_id(sam_ctx));
s4-drs: fixed UDV and overlapping sync calls in DRS When windows abandons a DRS sync, it will sometimes re-use the same bind handle for a new sync. This means we need to check the DN of the sync and blank the getnc_state if the DN has changed. This also fixes the UDV to use the highest uSN for the partition, not for the whole SAM.
2009-12-03 01:19:55 +03:00
tmp_cursor->highest_usn = highestUSN;
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
unix_to_nt_time(&now, t);
tmp_cursor->last_sync_success = now;
udv->count = ouv.ctr.ctr2.count + 1;
udv->cursors = talloc_steal(udv, ouv.ctr.ctr2.cursors);
udv->cursors = talloc_realloc(udv, udv->cursors, struct drsuapi_DsReplicaCursor2, udv->count);
if (!udv->cursors) {
return WERR_DS_DRA_INTERNAL_ERROR;
}
udv->cursors[udv->count - 1] = *tmp_cursor;
qsort(udv->cursors, udv->count,
sizeof(struct drsuapi_DsReplicaCursor2),
Move replmd_drsuapi_DsReplicaCursor2_compare to a common place.
2009-09-14 22:46:59 +04:00
(comparison_fn_t)drsuapi_DsReplicaCursor2_compare);
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
Fix up-to-dateness vector creation.
2009-09-10 13:41:48 +04:00
return WERR_OK;
}
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
/* state of a partially completed getncchanges call */
struct drsuapi_getncchanges_state {
struct ldb_result *site_res;
uint32_t num_sent;
struct ldb_dn *ncRoot_dn;
s4-drs: fixed UDV and overlapping sync calls in DRS When windows abandons a DRS sync, it will sometimes re-use the same bind handle for a new sync. This means we need to check the DN of the sync and blank the getnc_state if the DN has changed. This also fixes the UDV to use the highest uSN for the partition, not for the whole SAM.
2009-12-03 01:19:55 +03:00
uint64_t min_usn;
uint64_t highest_usn;
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
};
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
/*
drsuapi_DsGetNCChanges
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
see MS-DRSR 4.1.10.5.2 for basic logic of this function
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
*/
WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
struct drsuapi_DsGetNCChanges *r)
{
struct drsuapi_DsReplicaObjectIdentifier *ncRoot;
int ret;
int i;
struct dsdb_schema *schema;
struct drsuapi_DsReplicaOIDMapping_Ctr *ctr;
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
struct drsuapi_DsReplicaObjectListItemEx **currentObject;
s4/drs: enable attribute encryption This means we now get passwords vampired correctly for s4<->s4 replication.
2009-09-10 11:46:30 +04:00
NTSTATUS status;
DATA_BLOB session_key;
s4-dsdb: some more attribuutes that we should only give if asked for
2009-11-20 07:19:35 +03:00
const char *attrs[] = { "*", "distinguishedName",
"ntSecurityDescriptor",
"replPropertyMetaData",
"lmPwdHistory",
"ntPwdHistory",
"supplementalCredentials",
"unicodePwd",
NULL };
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
WERROR werr;
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
struct dcesrv_handle *h;
struct drsuapi_bind_state *b_state;
struct drsuapi_getncchanges_state *getnc_state;
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
struct drsuapi_DsGetNCChangesRequest8 *req8;
uint32_t options;
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
b_state = h->data;
s4: Handle DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY req in getncchanges
2009-09-24 02:47:14 +04:00
s4-drs: lock down key DRS calls The key DRS calls should only be allowed by administrators or domain controllers
2009-09-16 06:26:33 +04:00
*r->out.level_out = 6;
/* TODO: linked attributes*/
r->out.ctr->ctr6.linked_attributes_count = 0;
r->out.ctr->ctr6.linked_attributes = NULL;
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
s4-drs: lock down key DRS calls The key DRS calls should only be allowed by administrators or domain controllers
2009-09-16 06:26:33 +04:00
r->out.ctr->ctr6.object_count = 0;
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
r->out.ctr->ctr6.nc_object_count = 0;
s4-drs: lock down key DRS calls The key DRS calls should only be allowed by administrators or domain controllers
2009-09-16 06:26:33 +04:00
r->out.ctr->ctr6.more_data = false;
r->out.ctr->ctr6.uptodateness_vector = NULL;
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
/* a RODC doesn't allow for any replication */
if (samdb_rodc(ldb_get_opaque(b_state->sam_ctx, "loadparm"))) {
DEBUG(0,(__location__ ": DsGetNCChanges attempt on RODC\n"));
return WERR_DS_DRA_SOURCE_DISABLED;
}
/* Check request revision.
TODO: Adding mappings to req8 from the other levels
*/
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
if (r->in.level != 8) {
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
DEBUG(0,(__location__ ": Request for DsGetNCChanges with unsupported level %u\n",
r->in.level));
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
return WERR_REVISION_MISMATCH;
}
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
req8 = &r->in.req->req8;
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
/* Perform access checks. */
s4-drs: fixed UDV and overlapping sync calls in DRS When windows abandons a DRS sync, it will sometimes re-use the same bind handle for a new sync. This means we need to check the DN of the sync and blank the getnc_state if the DN has changed. This also fixes the UDV to use the highest uSN for the partition, not for the whole SAM.
2009-12-03 01:19:55 +03:00
/* TODO: we need to support a sync on a specific non-root
* DN. We'll need to find the real partition root here */
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
ncRoot = req8->naming_context;
if (ncRoot == NULL) {
DEBUG(0,(__location__ ": Request for DsGetNCChanges with no NC\n"));
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
return WERR_DS_DRA_INVALID_PARAMETER;
}
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
if (samdb_ntds_options(b_state->sam_ctx, &options) != LDB_SUCCESS) {
return WERR_DS_DRA_INTERNAL_ERROR;
}
if ((options & DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL) &&
!(req8->replica_flags & DRSUAPI_DRS_SYNC_FORCED)) {
return WERR_DS_DRA_SOURCE_DISABLED;
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
}
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_SYNC_PACKET) {
s4: Handle DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_SYNC_PACKET in getncchanges When this flag is specified in the request we shouldn't use the uptodateness vector in the request.
2009-09-24 03:58:58 +04:00
/* Ignore the _in_ uptpdateness vector*/
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
req8->uptodateness_vector = NULL;
s4: Handle DRSUAPI_DS_REPLICA_NEIGHBOUR_FULL_SYNC_PACKET in getncchanges When this flag is specified in the request we shouldn't use the uptodateness vector in the request.
2009-09-24 03:58:58 +04:00
}
Add drs_security_level_check for dcesrv calls security checks There is also an option to disable the security check by specifying in the smb.conf file: drs:disable_sec_check = true
2009-09-20 02:08:19 +04:00
werr = drs_security_level_check(dce_call, "DsGetNCChanges");
if (!W_ERROR_IS_OK(werr)) {
return werr;
s4-drs: lock down key DRS calls The key DRS calls should only be allowed by administrators or domain controllers
2009-09-16 06:26:33 +04:00
}
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
getnc_state = b_state->getncchanges_state;
s4-drs: fixed UDV and overlapping sync calls in DRS When windows abandons a DRS sync, it will sometimes re-use the same bind handle for a new sync. This means we need to check the DN of the sync and blank the getnc_state if the DN has changed. This also fixes the UDV to use the highest uSN for the partition, not for the whole SAM.
2009-12-03 01:19:55 +03:00
/* see if a previous replication has been abandoned */
if (getnc_state) {
struct ldb_dn *new_dn = ldb_dn_new(getnc_state, b_state->sam_ctx, ncRoot->dn);
if (ldb_dn_compare(new_dn, getnc_state->ncRoot_dn) != 0) {
DEBUG(0,(__location__ ": DsGetNCChanges 2nd replication on different DN %s %s\n",
ldb_dn_get_linearized(new_dn),
ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
talloc_free(getnc_state);
getnc_state = NULL;
}
}
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
if (getnc_state == NULL) {
getnc_state = talloc_zero(b_state, struct drsuapi_getncchanges_state);
if (getnc_state == NULL) {
return WERR_NOMEM;
}
b_state->getncchanges_state = getnc_state;
s4-drs: lock down key DRS calls The key DRS calls should only be allowed by administrators or domain controllers
2009-09-16 06:26:33 +04:00
}
s4/drs: enable attribute encryption This means we now get passwords vampired correctly for s4<->s4 replication.
2009-09-10 11:46:30 +04:00
/* we need the session key for encrypting password attributes */
status = dcesrv_inherited_session_key(dce_call->conn, &session_key);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(0,(__location__ ": Failed to get session key\n"));
return WERR_DS_DRA_INTERNAL_ERROR;
}
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
/* we don't yet support extended operations */
if (req8->extended_op != DRSUAPI_EXOP_NONE) {
DEBUG(0,(__location__ ": Request for DsGetNCChanges extended op 0x%x\n",
(unsigned)req8->extended_op));
return WERR_DS_DRA_NOT_SUPPORTED;
}
/*
TODO: MS-DRSR section 4.1.10.1.1
Work out if this is the start of a new cycle */
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
if (getnc_state->site_res == NULL) {
char* search_filter;
enum ldb_scope scope = LDB_SCOPE_SUBTREE;
s4: Handle DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY req in getncchanges
2009-09-24 02:47:14 +04:00
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
getnc_state->min_usn = req8->highwatermark.highest_usn;
s4: Handle DRSUAPI_DS_REPLICA_NEIGHBOUR_ASYNC_REP in getncchanges When this flag is specified in the request we should return for ncRoot only and so scope of search is LDB_SCOPE_BASE.
2009-09-24 03:52:34 +04:00
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
/* Construct response. */
search_filter = talloc_asprintf(mem_ctx,
"(uSNChanged>=%llu)",
(unsigned long long)(getnc_state->min_usn+1));
s4-repl: check that a DsGetNCChanges is a continuation, and fix sorting When we indicate that a getncchanges request is not complete, we set the more_data flag to true in the response. The client usually then asks for the next block of data. If the client decides it wants to skip that replication and do a different replication then we need to make sure that the next call is in fact a continuation of the existing call, and not a new call. This relies on returning the results sorted by uSNChanged, as the client uses the tmp_highest_usn in each result to see if progress is being made.
2009-10-13 06:09:07 +04:00
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_CRITICAL_ONLY) {
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
search_filter = talloc_asprintf(mem_ctx,
"(&%s(isCriticalSystemObject=TRUE))",
search_filter);
}
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
if (req8->replica_flags & DRSUAPI_DS_REPLICA_NEIGHBOUR_ASYNC_REP) {
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
scope = LDB_SCOPE_BASE;
}
DEBUG(6,(__location__ ": getncchanges on %s using filter %s\n",
ldb_dn_get_linearized(getnc_state->ncRoot_dn), search_filter));
s4-drs: take advantage of system session auth in dsbind Now that the bind opens samdb with the right credentials, we no longer need the re-open in updaterefs and getncchanges
2009-10-06 11:59:30 +04:00
ret = drsuapi_search_with_extended_dn(b_state->sam_ctx, getnc_state, &getnc_state->site_res,
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
getnc_state->ncRoot_dn, scope, attrs,
s4-repl: check that a DsGetNCChanges is a continuation, and fix sorting When we indicate that a getncchanges request is not complete, we set the more_data flag to true in the response. The client usually then asks for the next block of data. If the client decides it wants to skip that replication and do a different replication then we need to make sure that the next call is in fact a continuation of the existing call, and not a new call. This relies on returning the results sorted by uSNChanged, as the client uses the tmp_highest_usn in each result to see if progress is being made.
2009-10-13 06:09:07 +04:00
"uSNChanged",
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
search_filter);
if (ret != LDB_SUCCESS) {
return WERR_DS_DRA_INTERNAL_ERROR;
}
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
}
/* Prefix mapping */
s4-drs: take advantage of system session auth in dsbind Now that the bind opens samdb with the right credentials, we no longer need the re-open in updaterefs and getncchanges
2009-10-06 11:59:30 +04:00
schema = dsdb_get_schema(b_state->sam_ctx);
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
if (!schema) {
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
DEBUG(0,("No schema in sam_ctx\n"));
return WERR_DS_DRA_INTERNAL_ERROR;
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
}
s4-drs: lock down key DRS calls The key DRS calls should only be allowed by administrators or domain controllers
2009-09-16 06:26:33 +04:00
r->out.ctr->ctr6.naming_context = talloc(mem_ctx, struct drsuapi_DsReplicaObjectIdentifier);
*r->out.ctr->ctr6.naming_context = *ncRoot;
s4-drs: take advantage of system session auth in dsbind Now that the bind opens samdb with the right credentials, we no longer need the re-open in updaterefs and getncchanges
2009-10-06 11:59:30 +04:00
if (dsdb_find_guid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn,
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
&r->out.ctr->ctr6.naming_context->guid) != LDB_SUCCESS) {
s4-drs: fill in more guids and SIDs, plus filter rDN In DsGetNCChanges we need to fill in the parentGUID and objectGUID of each object, plus we need to filter out the rDN from the meta data, and always send the instanceType
2009-09-24 00:56:10 +04:00
DEBUG(0,(__location__ ": Failed to find GUID of ncRoot_dn %s\n",
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
ldb_dn_get_linearized(getnc_state->ncRoot_dn)));
s4-drs: fill in more guids and SIDs, plus filter rDN In DsGetNCChanges we need to fill in the parentGUID and objectGUID of each object, plus we need to filter out the rDN from the meta data, and always send the instanceType
2009-09-24 00:56:10 +04:00
return WERR_DS_DRA_INTERNAL_ERROR;
}
/* find the SID if there is one */
s4-drs: take advantage of system session auth in dsbind Now that the bind opens samdb with the right credentials, we no longer need the re-open in updaterefs and getncchanges
2009-10-06 11:59:30 +04:00
dsdb_find_sid_by_dn(b_state->sam_ctx, getnc_state->ncRoot_dn, &r->out.ctr->ctr6.naming_context->sid);
s4-drs: fill in more guids and SIDs, plus filter rDN In DsGetNCChanges we need to fill in the parentGUID and objectGUID of each object, plus we need to filter out the rDN from the meta data, and always send the instanceType
2009-09-24 00:56:10 +04:00
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
dsdb_get_oid_mappings_drsuapi(schema, true, mem_ctx, &ctr);
r->out.ctr->ctr6.mapping_ctr = *ctr;
s4-drs: take advantage of system session auth in dsbind Now that the bind opens samdb with the right credentials, we no longer need the re-open in updaterefs and getncchanges
2009-10-06 11:59:30 +04:00
r->out.ctr->ctr6.source_dsa_guid = *(samdb_ntds_objectGUID(b_state->sam_ctx));
r->out.ctr->ctr6.source_dsa_invocation_id = *(samdb_ntds_invocation_id(b_state->sam_ctx));
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
r->out.ctr->ctr6.old_highwatermark = req8->highwatermark;
r->out.ctr->ctr6.new_highwatermark = req8->highwatermark;
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
r->out.ctr->ctr6.first_object = NULL;
currentObject = &r->out.ctr->ctr6.first_object;
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
for(i=getnc_state->num_sent;
i<getnc_state->site_res->count &&
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
(r->out.ctr->ctr6.object_count < req8->max_object_count);
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
i++) {
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
int uSN;
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
struct drsuapi_DsReplicaObjectListItemEx *obj;
obj = talloc_zero(mem_ctx, struct drsuapi_DsReplicaObjectListItemEx);
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
uSN = ldb_msg_find_attr_as_int(getnc_state->site_res->msgs[i], "uSNChanged", -1);
if (uSN > r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn) {
s4-drs: also fill in tmp_highest_usn Without this the client will not update its repsFrom highest_usn values
2009-09-12 07:06:32 +04:00
r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn = uSN;
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
}
s4-drs: fixed UDV and overlapping sync calls in DRS When windows abandons a DRS sync, it will sometimes re-use the same bind handle for a new sync. This means we need to check the DN of the sync and blank the getnc_state if the DN has changed. This also fixes the UDV to use the highest uSN for the partition, not for the whole SAM.
2009-12-03 01:19:55 +03:00
if (uSN > getnc_state->highest_usn) {
getnc_state->highest_usn = uSN;
}
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
werr = get_nc_changes_build_object(obj, getnc_state->site_res->msgs[i],
s4-drs: take advantage of system session auth in dsbind Now that the bind opens samdb with the right credentials, we no longer need the re-open in updaterefs and getncchanges
2009-10-06 11:59:30 +04:00
b_state->sam_ctx, getnc_state->ncRoot_dn,
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
schema, &session_key, getnc_state->min_usn,
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
req8->replica_flags);
s4/drs: broke out the core of the getncchanges code It is easier to understand without the heavy nesting
2009-09-09 15:26:17 +04:00
if (!W_ERROR_IS_OK(werr)) {
return werr;
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
}
Fix up-to-dateness vector creation.
2009-09-10 13:41:48 +04:00
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
if (obj->meta_data_ctr == NULL) {
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
DEBUG(0,(__location__ ": getncchanges skipping send of object %s\n",
ldb_dn_get_linearized(getnc_state->site_res->msgs[i]->dn)));
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
/* no attributes to send */
talloc_free(obj);
continue;
Fix up-to-dateness vector creation.
2009-09-10 13:41:48 +04:00
}
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
r->out.ctr->ctr6.object_count++;
*currentObject = obj;
currentObject = &obj->next_object;
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
}
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
getnc_state->num_sent += r->out.ctr->ctr6.object_count;
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
r->out.ctr->ctr6.nc_object_count = getnc_state->site_res->count;
s4-drs: support DRSUAPI_DRS_ADD_REF flag The DRSUAPI_DRS_ADD_REF flag tells the DRS server to run an UpdateRefs call on behalf of the client after the DsGetNCChanges call. The lack of support for this option may explain why the repsTo attribute was not being created for w2k8-r2 replication partners.
2009-10-14 13:29:39 +04:00
/* the client can us to call UpdateRefs on its behalf to
re-establish monitoring of the NC */
if ((req8->replica_flags & DRSUAPI_DRS_ADD_REF) &&
!GUID_all_zero(&req8->destination_dsa_guid)) {
struct drsuapi_DsReplicaUpdateRefsRequest1 ureq;
ureq.naming_context = ncRoot;
ureq.dest_dsa_dns_name = talloc_asprintf(mem_ctx, "%s._msdcs.%s",
GUID_string(mem_ctx, &req8->destination_dsa_guid),
lp_realm(dce_call->conn->dce_ctx->lp_ctx));
if (!ureq.dest_dsa_dns_name) {
return WERR_NOMEM;
}
ureq.dest_dsa_guid = req8->destination_dsa_guid;
ureq.options = DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE |
DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION |
DRSUAPI_DS_REPLICA_UPDATE_GETCHG_CHECK;
werr = drsuapi_UpdateRefs(b_state, mem_ctx, &ureq);
if (!W_ERROR_IS_OK(werr)) {
DEBUG(0,(__location__ ": Failed UpdateRefs in DsGetNCChanges - %s\n",
win_errstr(werr)));
}
}
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
if (i < getnc_state->site_res->count) {
r->out.ctr->ctr6.more_data = true;
} else {
r->out.ctr->ctr6.uptodateness_vector = talloc(mem_ctx, struct drsuapi_DsReplicaCursor2CtrEx);
r->out.ctr->ctr6.uptodateness_vector->version = 2;
r->out.ctr->ctr6.uptodateness_vector->reserved1 = 0;
r->out.ctr->ctr6.uptodateness_vector->reserved2 = 0;
r->out.ctr->ctr6.new_highwatermark.highest_usn = r->out.ctr->ctr6.new_highwatermark.tmp_highest_usn;
s4-drs: take advantage of system session auth in dsbind Now that the bind opens samdb with the right credentials, we no longer need the re-open in updaterefs and getncchanges
2009-10-06 11:59:30 +04:00
werr = get_nc_changes_udv(b_state->sam_ctx, getnc_state->ncRoot_dn,
s4-drs: fixed UDV and overlapping sync calls in DRS When windows abandons a DRS sync, it will sometimes re-use the same bind handle for a new sync. This means we need to check the DN of the sync and blank the getnc_state if the DN has changed. This also fixes the UDV to use the highest uSN for the partition, not for the whole SAM.
2009-12-03 01:19:55 +03:00
r->out.ctr->ctr6.uptodateness_vector,
getnc_state->highest_usn);
s4-dsruapi: plugfest updates - always fetch parentGUID from databases, don't rely on parentGUID in attributes - re-fetch nc root mesages to avoid the problem of dual messages for roots - support returning messages a chunk at a time, using max_object_count from request
2009-09-26 02:17:44 +04:00
if (!W_ERROR_IS_OK(werr)) {
return werr;
}
talloc_free(getnc_state);
b_state->getncchanges_state = NULL;
}
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
s4-drs: fixed UDV and overlapping sync calls in DRS When windows abandons a DRS sync, it will sometimes re-use the same bind handle for a new sync. This means we need to check the DN of the sync and blank the getnc_state if the DN has changed. This also fixes the UDV to use the highest uSN for the partition, not for the whole SAM.
2009-12-03 01:19:55 +03:00
DEBUG(2,("DsGetNCChanges with uSNChanged >= %llu flags 0x%08x on %s gave %u objects (done %d/%d)\n",
drs: improved error checking Check the validity of the requested options in DsGetNCChanges
2009-10-13 12:49:08 +04:00
(unsigned long long)(req8->highwatermark.highest_usn+1),
s4-drs: support DRSUAPI_DRS_ADD_REF flag The DRSUAPI_DRS_ADD_REF flag tells the DRS server to run an UpdateRefs call on behalf of the client after the DsGetNCChanges call. The lack of support for this option may explain why the repsTo attribute was not being created for w2k8-r2 replication partners.
2009-10-14 13:29:39 +04:00
req8->replica_flags,
s4-drs: fixed UDV and overlapping sync calls in DRS When windows abandons a DRS sync, it will sometimes re-use the same bind handle for a new sync. This means we need to check the DN of the sync and blank the getnc_state if the DN has changed. This also fixes the UDV to use the highest uSN for the partition, not for the whole SAM.
2009-12-03 01:19:55 +03:00
ncRoot->dn, r->out.ctr->ctr6.object_count,
i, r->out.ctr->ctr6.more_data?getnc_state->site_res->count:i));
s4-drs: fixed the cursor generation to always be filled in We were relying on the uSNChanged>=n search always finding the DN of the root of the partition, but this now doesn't happen very often as we are now restricting when we change uSNChanged. This means we need to always load the replUpToDateVector attribute from the NC root and use it to populate the cursors in the return.
2009-09-12 05:14:29 +04:00
s4:drs split addentry and getncchanges into separate files These will get quite complex eventually, I think we are better separating them so the code is a bit easier to follow
2009-09-09 15:00:01 +04:00
return WERR_OK;
}
Copy Permalink