1
0
mirror of https://github.com/samba-team/samba.git synced 2025-01-15 23:24:37 +03:00

158 Commits

Author SHA1 Message Date
Andrew Bartlett
dfda45802c rpc_server/drsuapi: Return the correct 3 objects for DRSUAPI_EXOP_FSMO_RID_ALLOC
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-01 10:27:19 +02:00
Andrew Bartlett
7397aa47fd rpc_server/drsuapi: Block replication of incorrect/duplicate attrid in replPropertMetaData
If custom schema is used in a replicated DC environment, these are created as soon as
an attribute is modified on more than one DC.  We have to prevent replication
as otherwise we will corrupt the client replica state.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11443
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-03-08 01:58:26 +01:00
Volker Lendecke
a99a5a34a5 Fix the developer O3 build
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Wed Feb 25 16:32:29 CET 2015 on sn-devel-104
2015-02-25 16:32:29 +01:00
Andrew Bartlett
5e1f2795f2 rpc_server-drsuapi: Improve comments and DEBUG lines
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-07-24 16:35:37 +02:00
Andrew Bartlett
e461ff5300 dsdb: Allow dsdb_find_dn_by_guid to show deleted DNs
This helps us in the KCC as we need to return the deleted DN for the GUID
in DsReplicaGetInfo calls (tested for deleted servers against Windows 2008R2).

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-06-12 10:02:07 +02:00
Andrew Bartlett
73628e9cd9 rpc_server-drsuapi: Include the failing DN when unable to convert DB objects to DRS
This is a very serious situation (it should not happen) so getting information on the
objects that this happens for would be very helpful.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-05-16 19:02:03 +02:00
Andrew Bartlett
316fd085ad drs-fsmo: Improve handling of FSMO role takeover.
This needs to be more async, and give less scary errors.

Andrew Bartlett

Reviewed-by: Stefan Metzmacher <metze@samba.org>
2013-01-17 15:10:10 +01:00
Stefan Metzmacher
f77bfed088 s4:drsuapi: try to behave more like windows for usn order (bug #9508)
We don't behave completely like a Windows server, but it's much more
identical than before.

The partition head is always the first object followed by the rest
sorted by uSNChanged.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jan  1 21:09:42 CET 2013 on sn-devel-104
2013-01-01 21:09:41 +01:00
Stefan Metzmacher
16aef75c4f s4:drsuapi: make use of LDB_TYPESAFE_QSORT() and pass getnc_state
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
88833b089a s4:drsuapi: make sure we report the meta data from the cycle start (bug #9508)
We should build the final highwatermark and uptodatevector of
a replication cycle at the start of the cycle. Before we
search for the currently missing objects.

Otherwise we risk that some objects get lost.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
1f89d641d0 s4:drsuapi: check the source_dsa_invocation_id (bug #9508)
The given highwatermark is only valid relative to the
specified source_dsa_invocation_id.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
91f7f2c04f s4:drsuapi: make sure we never return the same highwatermark twice in a replication cycle (bug #9508)
If the highwatermark given by the client is not the one we expect,
we need to start a new replication cycle. Otherwise the destination dsa
skips objects and linked attribute values.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
7e511b5831 s4:drsuapi: add drsuapi_DsReplicaHighWaterMark_cmp()
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
02de5b140c s4:drsuapi: always use the current uptodateness_vector
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
025c6d62f3 s4:drsuapi: avoid a ldb_dn_copy() and use talloc_move() instead
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
30be17bc5d s4:drsuapi: remove unused 'highest_usn' from drsuapi_getncchanges_state
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Stefan Metzmacher
551bb2ccea s4:drsuapi: move struct drsuapi_getncchanges_state to the top of getncchanges.c
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2013-01-01 19:28:07 +01:00
Matthieu Patou
5374334d68 s4-drs: fix the logic to allow REPL_SECRET if the account has GET_ALL_CHANGES 2012-10-07 21:51:02 -07:00
Matthieu Patou
8dbba524bf s4-drs: EXOP_REPL_SECRETS can be called by RW DC as well 2012-10-07 21:51:02 -07:00
Matthieu Patou
2eae16102a drs-getncchanges: do not set the highestUsn to 0
Paragraph 4.1.10.5 says that
         if err = 0 then
         msgOut.pNC := msgIn.pNC
         msgOut.usnvecFrom := msgIn.usnvecFrom
so no need to set the highestUsn to 0
2012-10-07 21:51:01 -07:00
Andrew Bartlett
7213199f6e s4-repl: Use samdb_reference_dn_is_our_ntdsa() 2012-08-14 15:37:22 +02:00
Andrew Bartlett
9566786853 s4-dsdb: Add mem_ctx argument to samdb_ntds_settings_dn
As this value is calculated new each time, we need to give it a context to live on.

If the value is the forced value during provision, a reference is taken.

This was responsible for the memory leak in the replication process.  In the
example I was given, this DN appeared in memory 13596 times!

Andrew Bartlett

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Aug 14 10:05:14 CEST 2012 on sn-devel-104
2012-08-14 10:05:14 +02:00
Stefan Metzmacher
601f3822d5 s4:drsuapi/getncchanges: the default for isRecycled is FALSE
metze

Autobuild-User: Matthieu Patou <mat@samba.org>
Autobuild-Date: Fri Dec 23 09:30:09 CET 2011 on sn-devel-104
2011-12-23 09:30:09 +01:00
Matthieu Patou
7d13f7d4a1 s4-drsuapi: we store boolean in upppercase so we need to test them in uppercase
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-12-23 07:57:21 +01:00
Stefan Metzmacher
b2bace63d3 s4:drsuapi/getncchanges: return WERR_NOMEM if talloc_array() fails
metze
2011-12-19 11:49:19 +01:00
Matthieu Patou
3164d7bdd5 s4-drs: introduce a timeout in the getncchanges processing to always return something in less than x seconds
Signed-off-by: Andrew Tridgell <tridge@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
2011-12-19 11:49:19 +01:00
Matthieu Patou
55af1a7cf7 s4-drs: avoid calling unecesserly ldb_msg_find_attr_as_* as this call in unefficient
Current implementation of ldb_msg_find_attr_as_* iterate on the list of
attributes returned by the search and make a string comparison. As we
sorting the array of messages / guids we tend to call this function many
times. By storing the GUID and the USN in a separate structure we are
sure to call this function only once per attribute and object.

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-12-19 11:49:19 +01:00
Matthieu Patou
b8a077296a s4-drs: check if we have a domain level >= 2k8r2 as before the isRecycled do not exists and so is always False
Having a false value cause the link on removed attribute to be always
returned which is what we try to avoid.
2011-11-13 14:11:25 +01:00
Andrew Tridgell
0167b0447f s4-drs: allow replication of the GC partial attribute set
when a DC has the GUID_DRS_GET_FILTERED_ATTRIBUTES right on a NC, we
need to allow it to replicate if all the attributes it is asking for
are in the GC partial attribute set

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Tue Sep 20 13:47:38 CEST 2011 on sn-devel-104
2011-09-20 13:47:38 +02:00
Andrew Tridgell
dea4f3941b s4-drs: fixed msdcs DNS name in getncchanges 2011-08-25 07:39:39 +10:00
Matthieu Patou
a5ba41881c s4-dcerpc: Do not return linked attribute on deleted objects it makes W2k8R2 loops when joining s4 domains
Autobuild-User: Matthieu Patou <mat@samba.org>
Autobuild-Date: Wed Jul 27 00:46:56 CEST 2011 on sn-devel-104
2011-07-27 00:46:56 +02:00
Matthieu Patou
723fc5fadd s4-drs: do not return links pointed to unexistant objects
When an object is deleted, link pointed to it are marked as inactive.
When the same object is purged we do not remmove the link pointed to it
(we can't know them) so they stay in the database, it turns to be a
problem for Windows 2008.

Signed-off-by: Andrew Tridgell <tridge@samba.org>
2011-07-11 14:32:45 +10:00
Andrew Tridgell
73cbcd9c99 s4-drs: added debug lines for missing linked attribute fields
this improved the logging of bugs related to linked attribute
replication

Autobuild-User: Andrew Tridgell <tridge@samba.org>
Autobuild-Date: Fri Jun 10 03:26:21 CEST 2011 on sn-devel-104
2011-06-10 03:26:21 +02:00
Andrew Tridgell
3e4c08096d s4-drs: cope with missing RMD_ADDTIME in linked attributes
upgraded links can be missing the RMD_ADDTIME field
2011-06-10 10:14:56 +10:00
Kamen Mazdrashki
647827d09c s4/getncchanges: Pre-mark extended requests as success in case a sub-function "forget" to do this 2011-05-11 21:10:53 +03:00
Kamen Mazdrashki
55916e273f s4/getncchanges: Implement placeholder for handling ex-op collection of objects
Right now it is solely based on function that handles objects
in normal DsGetNCChanges calls.
2011-05-11 21:10:53 +03:00
Kamen Mazdrashki
88a9f793aa s4/getncchanges: Move the code that collects objects into separate function 2011-05-11 21:10:52 +03:00
Kamen Mazdrashki
41496e782d s4/getncchanges: Don't mask Extended operation result - callers need it 2011-05-11 21:10:52 +03:00
Kamen Mazdrashki
232a8dfb06 s4/getncchanges: Fail extended request rather than failing whole request
in case that destination_dsa_guid is not valid
2011-05-11 21:10:51 +03:00
Matthias Dieter Wallnöfer
349b9b72ec s4:dsdb - we don't need to check if a DN != NULL if we call "ldb_dn_validate"
"ldb_dn_validate" is NULL-safe and does the check implicitly.

Reviewed by: Tridge
2011-03-04 22:07:24 +01:00
Stefan Metzmacher
3c5f537302 s4:drsuapi/getncchanges: make sure we don't process filteres objects more than once
metze

Autobuild-User: Stefan Metzmacher <metze@samba.org>
Autobuild-Date: Tue Feb 15 09:46:55 CET 2011 on sn-devel-104
2011-02-15 09:46:55 +01:00
Matthias Dieter Wallnöfer
6df6364220 s4:drsuapi RPC server - fix "enum security_user_level" warning on Tru64 2010-11-27 21:50:42 +01:00
Stefan Metzmacher
198049f3c6 s4:rpc_server/drsuapi: don't ask for constructed "distinguishedName" if we don't use it
metze
2010-11-09 22:52:55 +01:00
Stefan Metzmacher
f6e20bf52f s4:rpc_server/drsuapi: make msg_attrs static const
metze
2010-11-09 22:25:55 +01:00
Stefan Metzmacher
9fa71f8f57 s4:rpc_server/drsuapi: let dcesrv_drsuapi_DsGetNCChanges() use DSDB_SECRET_ATTRIBUTES
We should replicate all secret attributes back to other DCs.

metze
2010-11-09 22:25:53 +01:00
Andrew Tridgell
5fcb426d9a s4-drs: reduce the memory usage of the getncchanges server
we now keep just a list of GUIDs around between getncchanges calls,
instead of an entire db search. This makes the overhead of having a
pending getncchanges call much smaller.

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-11-05 23:42:09 +11:00
Kamen Mazdrashki
717b1158a6 idl: Use DRSUAPI_ATTID_ prefix instead of DRSUAPI_ATTRIBUTE_ for ATTID values
Those values are actually ATTID values and such, they are used
for ATTIDs for Attributes, Classes and Syntaxes.
2010-10-31 23:54:04 +00:00
Matthias Dieter Wallnöfer
a0e9814c0d s4:dsdb - remove "samdb_result_uint", "samdb_result_int64", "samdb_result_uint64" and "samdb_result_string"
We have ldb_msg_find_attr_as_* calls which do exactly the same. Therefore this
reduces only code redundancies.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-10-15 08:36:01 +11:00
Andrew Bartlett
8beaa29242 s4-libcli/security Use seperate subsystem for session related functions
The merged I plan in this area require spliting security.h into
two header files, a common header and a session.h for the
remaining source4-specific code.

Andrew Bartlett
2010-10-12 02:54:16 +00:00
Matthias Dieter Wallnöfer
55e3720470 s4:getncchanges.c - fix some counter types 2010-10-03 12:05:13 +02:00