summaryrefslogtreecommitdiff
path: root/source4/dsdb/repl
AgeCommit message (Collapse)AuthorFilesLines
2019-09-18messaging4: Pass fds to messaging handlersVolker Lendecke1-2/+10
Boiler-plate replacement moving the (num_fds!=0) check down Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-04-11dsdb/repl: we need to replicate the whole schema before we can apply itStefan Metzmacher1-10/+164
Otherwise we may not be able to construct a working schema that's required to apply the changes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12204 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-02-27s4:dsdb: Remove unused header fileAndreas Schneider1-1/+0
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org>
2018-12-17drepl: schema repl race condition fixAaron Haslett1-2/+33
Adds final schema consistency check before committing changes. Aborts if corruption found. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12889 Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-11-01source4 smdb: Add a post fork hook to the service APIGary Lockyer1-12/+15
Add a post fork hook to the service API this will be called: - standard process model immediately after the task_init. - single process model immediately after the task_init - prefork process model, inhibit_pre_fork = true immediately after the task_init - prefork process model, inhibit_pre_fork = false after each service worker has forked. It is not run on the service master process. The post fork hook is not called in the standard model if a new process is forked on a new connection. It is instead called immediately after the task_init. The task_init hook has been changed to return an error code. This ensures the post_fork code is only run if the task_init code completed successfully. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2018-11-01source4 smbd: Make the service_details structure constant.Gary Lockyer1-1/+1
Make the service_details structure a static const. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
2018-08-22dsdb: Fix a typoVolker Lendecke1-2/+3
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2018-05-30dsdb: Add log when ignoring a replicated object outside of partitionTim Beale1-0/+6
This is probably a note-worthy event for debugging purposes. (Found while developing the domain rename functionality) Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed May 30 07:03:51 CEST 2018 on sn-devel-144
2018-05-30s4-repl: Try to give more information in the error codes for prepare_commit ↵Andrew Bartlett1-2/+3
failure. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2018-05-10samdb: Add remote address to connectGary Lockyer1-1/+6
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-04-12dsdb: Ensure to cancel the transaction if we fail to save the prefixMapAndrew Bartlett1-0/+1
This rare error case forgot to call ldb_transaction_cancel() Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2017-11-24schema: Make writing indices flag an enum for a new stateGarming Sam1-7/+7
In schema_load_init, we find that the writing of indices is not locked in any way. This leads to race conditions. To resolve this, we need to have a new state (SCHEMA_COMPARE) which can report to the caller that we need to open a transaction to write the indices. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-11-13dreplsrv: Use is_null_sidVolker Lendecke1-3/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2017-10-19 source4/smbd: refactor the process model for preforkGary Lockyer1-1/+6
Refactor the process model code to allow the addition of a prefork process model. - Add a process context to contain process model specific state - Add a service details structure to allow service to indicate which process model options they can support. In the new code the services advertise the features they support to the process model. The process model context is plumbed through to allow the process model to keep track of the supported options, and any state the process model may require. Signed-off-by: Gary Lockyer <gary@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-09-07debug: Add new debug class "drs_repl" for DRS replication processingAndrew Bartlett12-0/+36
This is used in the client and in the server Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2017-08-18replmd: Don't fail cycle if we get link for deleted object with GET_TGTTim Beale1-0/+4
We are going to end up supporting 2 different server schemes: A. the old/default behaviour of sending all the linked attributes last, at the end of the replication cycle. B. the new/Microsoft way of sending the linked attributes interleaved with the source/target objects. Normally if we're talking to a server using the old scheme-A, we won't ever use the GET_TGT flag. However, there are a couple of cases where it can happen: - A link to a new object was added during the replication cycle. - An object was deleted while the replication was in progress (and the linked attribute got queued before the object was deleted). Talking to an Samba DC running the old scheme will just cause it to start the replication cycle from scratch again, which is fairly harmless. However, there is a chance that the same thing can happen again, in which case the replication cycle will fail (because GET_TGT was already set). Even if we're using the new scheme (B), we could still potentially hit this case, as we can still queue up linked attributes between requests (group memberships can be larger than what can fit into a single replication chunk). If GET_TGT is set in the GetNcChanges request, then the local copy of the target object should always be up-to-date when we process the linked attribute. So if we still think the target object is deleted/recycled at this point, then it's safe to ignore the linked attribute (because we know our local copy is up-to-date). This logic matches the MS spec logic in ProcessLinkValue(). Not failing the replication cycle may be beneficial if we're trying to do a full-sync of a large database. Otherwise it might be time-consuming and frustrating to repeat the sync unnecessarily. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12972
2017-08-18drepl: Support GET_TGT on periodic replication clientTim Beale3-17/+83
- Update IDL comments to include Microsoft reference doc - Add support for sending v10 GetNCChanges request (needed for the GET_TGT flag, which is in the new 'more_flags' field) - Update to also set the GET_TGT flag in the same place we were setting GET_ANC (I split this logic out into a separate function). - The state struct now needs to hold a 'more_flags' field as well (this flag is different to the GET_ANC replica flag) Note that using the GET_TGT when replicating from a Windows DC could be highly inefficient. Because Samba keeps the GET_TGT flag set throughout the replication cycle, it will basically receive a repeated object from Windows for every single linked attribute that it receives. I believe Windows behaviour only expects the client to set the GET_TGT flag when it actually needs to (i.e. when it receives a target object it doesn't know about), rather than throughout the replication cycle. However, this approach won't work with Samba-to-Samba replication, because when the server receives the GET_TGT flag it restarts the replication cycle from scratch. So if we only set the GET_TGT flag when the client encountered an unknown target then Samba-to-Samba could potentially get into an endless replication loop. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12972
2017-08-18drs: Check target object is known after applying objectsTim Beale1-4/+7
Currently we only check that the target object is known at the end of the transaction (i.e. the .prepare_commit hook). It's too late at this point to resend the request with GET_TGT. Move this processing earlier on, after we've applied all the objects (i.e. off the .extended hook). In reality, we need to perform the checks at both points. I've split the common code that gets the source/target details out of the la_entry into a helper function. It's not the greatest function ever, but seemed to make more sense than duplicating the code. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12972
2017-08-18drs: Fail replication transaction instead of dropping linksTim Beale1-0/+4
If the DRS client received a linked attribute that it couldn't resolve the target for, then it would just ignore that link and keep going. That link would then be lost forever (although a full-sync would resolve this). Instead of silently ignoring the link, fail the transaction. This *can* happen on Samba, but it is unusual. The target object and linked-attribute would need to be added while a replication is still in progress. It can also happen fairly easily when talking to a Windows DC. There are two import exceptions to this: 1). Linked attributes that span partitions. We can never guarantee that we will have received the target object, because it may be in a partition we haven't replicated yet. Samba doesn't have a great way of handling this currently, but we shouldn't fail the replication (because that breaks basic join tests). Just skip that linked attribute and hope that a subsequent full-sync will fix it. (I queried Microsoft and they said resolving cross-partition linked attributes is a implementation-specific problem to solve. GET_TGT won't resolve it) 2). When the replication involves a subset of objects, e.g. critical-only. In these cases, we don't increase the highwater-mark, so it is probably not such a dire problem if we don't add the link. In the case of critical-only, we will do a subsequent full sync which will then add the links. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Garming Sam <garming@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> BUG: https://bugzilla.samba.org/show_bug.cgi?id=12972
2017-07-28repl: Remove old TODOTim Beale1-2/+0
This TODO was added in 2007 before we supported linked attributes. It's no longer relevant. Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-07-23s4-drepl: Block GetNCChanges during a DsReplicaSyncAndrew Bartlett1-1/+1
If we do not block these, we can get RPC faults (DCERPC_NCA_S_PROTO_ERROR) which gives WERR_WRITE_FAULT back to the DsReplicaSync call as there are two outstanding requests on the wire at the one time. We will get to the next operation as soon as this is finished when we call run_pending_ops(). BUG: https://bugzilla.samba.org/show_bug.cgi?id=12926 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Sun Jul 23 12:32:49 CEST 2017 on sn-devel-144
2017-07-22s4-drepl: Use tevent_schedule_immediate() in DsReplicaSync handlerAndrew Bartlett3-65/+24
When we are sent a DsReplicaSync() we should work on inbound replication (ideally from the requested source, but so far we just start the whole queue) right away, not after 1 second. We should also target inbound replication, not any outbound replication notification that may happen to be due. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12921 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Jul 22 07:45:31 CEST 2017 on sn-devel-144
2017-07-02dsdb: Improve debugging on start transacton failureAndrew Bartlett1-1/+2
Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2017-06-15repl: Set GET_ALL_GROUP_MEMBERSHIP flag in the drepl serverGarming Sam1-0/+14
Although we do not currently support this in the server, this will cause data loss against a Windows DC unless we set this flag as per the docs. This flag is required for the RODC. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Garming Sam <garming@samba.org> Autobuild-Date(master): Thu Jun 15 05:31:59 CEST 2017 on sn-devel-144
2017-05-11s4: Add TALLOC_CTX * to register_server_service().Jeremy Allison1-1/+1
Use the passed in context from callers. Remove one talloc_autofree_context(). Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2017-04-22lib: modules: Change XXX_init interface from XXX_init(void) to ↵Jeremy Allison1-1/+1
XXX_init(TALLOC_CTX *) Not currently used - no logic changes inside. This will make it possible to pass down a long-lived talloc context from the loading function for modules to use instead of having them internally all use talloc_autofree_context() which is a hidden global. Updated all known module interface numbers, and added a WHATSNEW. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: Ralph Böhme <slow@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Apr 22 01:17:00 CEST 2017 on sn-devel-144
2017-04-13drepl: Add partial attribute set in the case of repl secretGarming Sam1-1/+1
Against Windows, the call will always fail without it. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-03-27repl_secret: Error condition should sound harmlessGarming Sam1-2/+8
In the case it is not in the replication group, it it correct to deny the replication to succeed. Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-02-22Correct "successfuly" typos.Chris Lamb1-1/+1
Signed-off-by: Chris Lamb <chris@chris-lamb.co.uk> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-02-22Correct "enought" typo.Chris Lamb1-1/+1
Signed-off-by: Chris Lamb <chris@chris-lamb.co.uk> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-02-08s4:dsdb/repl: s/highestCommitedUsn/highestCommittedUSNStefan Metzmacher1-1/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-09-28werror: replace WERR_NOMEM with WERR_NOT_ENOUGH_MEMORY in source4/dsdb/Günther Deschner4-15/+15
Guenther Signed-off-by: Guenther Deschner <gd@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-09-02s4-dsdb: Change debug level for replicationAndreas Schneider1-25/+26
Most of the time it is spamming the logs, so increase the level to debug for most messages. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Sep 2 05:06:00 CEST 2016 on sn-devel-144
2016-08-25drepl_out: Send the prefix map alongside the global catalog partial ↵Garming Sam1-2/+10
attribute set Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-08-25drepl_out: Send the prefix map alongside the RODC partial attribute setGarming Sam1-4/+13
Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-08-25replicated_objects: Add missing newline for debugGarming Sam1-2/+2
Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-08-11s4:dsdb/repl: let dsdb_replicated_objects_convert() change remote to local ↵Stefan Metzmacher1-5/+57
attid for linked attributes We already do that for objects in dsdb_convert_object_ex(). We need to be consistent and do the same for linked attributes. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12128 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-11s4:dsdb/repl: set working_schema->resolving_in_progress during schema creationStefan Metzmacher1-0/+3
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12128 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-11s4:dsdb/repl: make sure the working_schema prefix map is populated with the ↵Stefan Metzmacher1-0/+35
remote prefix map We should create the working_schema prefix map before we try to resolve the schema. This allows getting the same mapping (if there's not already a conflict) and allows us to remove the implicit prefix mapping creation in the prefix mapping lookup functions. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12128 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-11s4:dsdb/repl: Improve memory handling in replicated schema codeAndrew Bartlett1-4/+10
This attempts to make it clear what memory is short term and what memory is long term BUG: https://bugzilla.samba.org/show_bug.cgi?id=12115 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2016-08-11s4:dsdb/repl: avoid recursion after fetching schema changes.Stefan Metzmacher2-17/+25
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12115 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-08-06s4: repl: Ensure all error paths in ↵Jeremy Allison1-0/+4
dreplsrv_op_pull_source_get_changes_trigger() are protected with tevent returns. Otherwise dreplsrv_op_pull_source_get_changes_trigger() could infinitely recurse. Signed-off-by: Jeremy Allison <jra@samba.org> Reviewed-by: Michael Adam <obnox@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Aug 6 01:24:05 CEST 2016 on sn-devel-144
2016-07-23s4:dsdb/replicated_objects: don't skip notifications on resolved conflictsStefan Metzmacher1-4/+16
We should propagate resolved conflicts immediately. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Jul 23 03:18:58 CEST 2016 on sn-devel-144
2016-07-21drepl: Fix a typoGarming Sam1-1/+1
Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-07-19drs: pass the forced-replication flag from DsReplicaSync to GetNCChangesAndrew Bartlett1-0/+4
This ensures we and sync from a server with DISABLE_OUTBOUND_REPL set Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2016-07-19repl: Remove check for parentGUID being NULL in dsdb_convert_object_ex()Andrew Bartlett1-5/+0
We find that Windows 2012R2 sends a NULL parent_guid here, probably when no change to name is replicated. That is, if there has not been a rename, this is not required information, as we can just merge with the existing object, not matter where it is Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2016-07-13dsdb: Fix CID 1363810: Null pointer dereferencesVolker Lendecke1-3/+6
The if-condition explicitly tests for new_schema==NULL, so this seems to be a valid error case. The DEBUG statement would segfault in this case. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ira Cooper <ira@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Jul 13 06:34:33 CEST 2016 on sn-devel-144
2016-07-06dsdb: Remove 120 second delay and USN from schema refresh checkAndrew Bartlett1-69/+11
We now refresh it once the schema changes, so that replication can proceed right away. We use the sequence number in the metadata.tdb. The previous commit added a cache for this value, protected by tdb_seqnum(). metadata.tdb is now opened at startup to provide this support. Note that while still supported, schemaUpdateNow is essentially rudundent: instead, to ensure we increment the sequence number correctly, we unify that check into repl_meta_data at the transaction close. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-06-07repl: Avoid use-after-free when working with the working_schemaAndrew Bartlett1-1/+1
The original schema must live as long as the working_schema as the working_schema starts as a shallow-copy of schema. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> BUG: https://bugzilla.samba.org/show_bug.cgi?id=11953 Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Jun 7 14:33:39 CEST 2016 on sn-devel-144
2016-06-07dsdb: Fix rename and RDN handling for replPropertyMetaDataAndrew Bartlett1-64/+22
This matches Windows 2012R2, which both has the RDN not sorted last and has it updated with the local invocation_id and a local version. The RDN attribute, unlike name, is not replicated over DRS, so the impact for interopability extends only to the incorrect RDN values that we were finding with dbcheck (values that did not match the name values). Finally, we always force the RDN to match the name attribute, which avoids issues in dbcheck where these diverge. As such, we can finally remove dbcheck as a flapping test, last re-added in e4bab3a8282d263eb2391bc7e8a6fd64ae068935 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-11 04:26:47 +0000