The branch, master has been updated
via 83f0dc4 s4-dsdb: special case for deleted objects one way link
via 9b981ff s4-dsdb: don't display links to deleted objects
via a729dbb s4-dsdb: fixed one_way_link calculation
via a5f311d s4-dsdb: fixed behaviour of show_deleted and show_recycled
control
via 365f705 s4-dsdb: fixed the check_optional_feature() call
from ceb831c s3:lib: remove unused/empty modules.c
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 83f0dc44a70ed7e49bcee3718ff17b2063b2a01e
Author: Andrew Tridgell <tri...@samba.org>
Date: Fri Oct 7 15:25:59 2011 +1100
s4-dsdb: special case for deleted objects one way link
we show wellknown links to the deleted objects container
Pair-Programmed-With: Andrew Bartlett <abart...@samba.org>
Autobuild-User: Andrew Tridgell <tri...@samba.org>
Autobuild-Date: Fri Oct 7 07:58:08 CEST 2011 on sn-devel-104
commit 9b981ff1e82e06c9365b6ae46ddc911a4a84f560
Author: Andrew Tridgell <tri...@samba.org>
Date: Fri Oct 7 13:20:35 2011 +1100
s4-dsdb: don't display links to deleted objects
unless the user asks for the display of deactivated links, we should
not display DNs that link to deleted objects
Pair-Programmed-With: Andrew Bartlett <abart...@samba.org>
commit a729dbb269d4a368f79dcadaa5e74adb91bfd6e2
Author: Andrew Tridgell <tri...@samba.org>
Date: Fri Oct 7 13:19:48 2011 +1100
s4-dsdb: fixed one_way_link calculation
we need to check for the other end of the link, not the current linkID
Pair-Programmed-With: Andrew Bartlett <abart...@samba.org>
commit a5f311d4690f6b76e6bd304b1fad98811488ed1f
Author: Andrew Tridgell <tri...@samba.org>
Date: Fri Oct 7 11:46:59 2011 +1100
s4-dsdb: fixed behaviour of show_deleted and show_recycled control
to correctly implement the show_deleted and show_recycled control we
need to know if the recyclebin is enabled. When not enabled, the
isRecycled attribute is ignored, and only isDeleted is used.
Pair-Programmed-With: Andrew Bartlett <abart...@samba.org>
commit 365f705345be02915fafedc83ec3c610285f6f81
Author: Andrew Tridgell <tri...@samba.org>
Date: Fri Oct 7 11:46:05 2011 +1100
s4-dsdb: fixed the check_optional_feature() call
the dsdb_check_optional_feature() call should look on our own NTDS DN
for the enabled feature. This should work for all features, not just
for forest wide fetaures.
Pair-Programmed-With: Andrew Bartlett <abart...@samba.org>
-----------------------------------------------------------------------
Summary of changes:
source4/dsdb/samdb/ldb_modules/extended_dn_out.c | 66 +++++++++++--
source4/dsdb/samdb/ldb_modules/show_deleted.c | 109 ++++++++++++++--------
source4/dsdb/samdb/ldb_modules/util.c | 43 +++++----
source4/dsdb/schema/schema_set.c | 3 +-
4 files changed, 153 insertions(+), 68 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source4/dsdb/samdb/ldb_modules/extended_dn_out.c
b/source4/dsdb/samdb/ldb_modules/extended_dn_out.c
index 9e1bec9..8e28ec7 100644
--- a/source4/dsdb/samdb/ldb_modules/extended_dn_out.c
+++ b/source4/dsdb/samdb/ldb_modules/extended_dn_out.c
@@ -353,30 +353,51 @@ struct extended_search_context {
fix one-way links to have the right string DN, to cope with
renames of the target
*/
-static int fix_one_way_link(struct extended_search_context *ac, struct ldb_dn
*dn)
+static int fix_one_way_link(struct extended_search_context *ac, struct ldb_dn
*dn,
+ bool is_deleted_objects, bool *remove_value)
{
struct GUID guid;
NTSTATUS status;
int ret;
struct ldb_dn *real_dn;
+ uint32_t search_flags;
+ TALLOC_CTX *tmp_ctx = talloc_new(ac);
+ const char *attrs[] = { NULL };
+ struct ldb_result *res;
+
+ (*remove_value) = false;
status = dsdb_get_extended_dn_guid(dn, &guid, "GUID");
if (!NT_STATUS_IS_OK(status)) {
/* this is a strange DN that doesn't have a GUID! just
return the current DN string?? */
+ talloc_free(tmp_ctx);
return LDB_SUCCESS;
}
- ret = dsdb_module_dn_by_guid(ac->module, dn, &guid, &real_dn, ac->req);
- if (ret != LDB_SUCCESS) {
- /* it could be on another server, we need to leave the
- string DN alone */
+ search_flags = DSDB_FLAG_NEXT_MODULE |
DSDB_SEARCH_SEARCH_ALL_PARTITIONS | DSDB_SEARCH_ONE_ONLY;
+
+ if (ldb_request_get_control(ac->req,
LDB_CONTROL_SHOW_DEACTIVATED_LINK_OID) ||
+ is_deleted_objects) {
+ search_flags |= DSDB_SEARCH_SHOW_DELETED;
+ }
+
+ ret = dsdb_module_search(ac->module, tmp_ctx, &res, NULL,
LDB_SCOPE_SUBTREE, attrs,
+ search_flags, ac->req, "objectguid=%s",
GUID_string(tmp_ctx, &guid));
+ if (ret != LDB_SUCCESS || res->count != 1) {
+ /* if we can't resolve this GUID, then we don't
+ display the link. This could be a link to a NC that we don't
+ have, or it could be a link to a deleted object
+ */
+ (*remove_value) = true;
+ talloc_free(tmp_ctx);
return LDB_SUCCESS;
}
+ real_dn = res->msgs[0]->dn;
if (strcmp(ldb_dn_get_linearized(dn), ldb_dn_get_linearized(real_dn))
== 0) {
/* its already correct */
- talloc_free(real_dn);
+ talloc_free(tmp_ctx);
return LDB_SUCCESS;
}
@@ -384,10 +405,10 @@ static int fix_one_way_link(struct
extended_search_context *ac, struct ldb_dn *d
* real DN
*/
if (!ldb_dn_replace_components(dn, real_dn)) {
- talloc_free(real_dn);
+ talloc_free(tmp_ctx);
return ldb_operr(ldb_module_get_ctx(ac->module));
}
- talloc_free(real_dn);
+ talloc_free(tmp_ctx);
return LDB_SUCCESS;
}
@@ -524,6 +545,7 @@ static int extended_callback(struct ldb_request *req,
struct ldb_reply *ares,
struct ldb_dn *dn;
struct dsdb_dn *dsdb_dn = NULL;
struct ldb_val *plain_dn = &msg->elements[i].values[j];
+ bool is_deleted_objects = false;
if (!checked_reveal_control) {
have_reveal_control =
@@ -559,10 +581,21 @@ static int extended_callback(struct ldb_request *req,
struct ldb_reply *ares,
}
dn = dsdb_dn->dn;
+ /* we need to know if this is a link to the
+ deleted objects container for fixing one way
+ links */
+ if (dsdb_dn->extra_part.length == 16) {
+ char *hex_string =
data_blob_hex_string_upper(req, &dsdb_dn->extra_part);
+ if (hex_string && strcmp(hex_string,
DS_GUID_DELETED_OBJECTS_CONTAINER) == 0) {
+ is_deleted_objects = true;
+ }
+ talloc_free(hex_string);
+ }
+
/* don't let users see the internal extended
GUID components */
if (!have_reveal_control) {
- const char *accept[] = { "GUID", "SID",
"WKGUID", NULL };
+ const char *accept[] = { "GUID", "SID", NULL };
ldb_dn_extended_filter(dn, accept);
}
@@ -598,11 +631,24 @@ static int extended_callback(struct ldb_request *req,
struct ldb_reply *ares,
objectCategory elements in the schema */
if (attribute->one_way_link &&
strcasecmp(attribute->lDAPDisplayName,
"objectCategory") != 0) {
- ret = fix_one_way_link(ac, dn);
+ bool remove_value;
+ ret = fix_one_way_link(ac, dn,
is_deleted_objects, &remove_value);
if (ret != LDB_SUCCESS) {
talloc_free(dsdb_dn);
return ldb_module_done(ac->req, NULL,
NULL, ret);
}
+ if (remove_value &&
+ !ldb_request_get_control(req,
LDB_CONTROL_REVEAL_INTERNALS)) {
+ /* we show these with REVEAL
+ to allow dbcheck to find and
+ cleanup these orphaned links */
+ memmove(&msg->elements[i].values[j],
+ &msg->elements[i].values[j+1],
+
(msg->elements[i].num_values-(j+1))*sizeof(struct ldb_val));
+ msg->elements[i].num_values--;
+ j--;
+ continue;
+ }
}
if (make_extended_dn) {
diff --git a/source4/dsdb/samdb/ldb_modules/show_deleted.c
b/source4/dsdb/samdb/ldb_modules/show_deleted.c
index bef4c06..773dcfb 100644
--- a/source4/dsdb/samdb/ldb_modules/show_deleted.c
+++ b/source4/dsdb/samdb/ldb_modules/show_deleted.c
@@ -36,60 +36,83 @@
#include "dsdb/samdb/samdb.h"
#include "dsdb/samdb/ldb_modules/util.h"
+struct show_deleted_state {
+ bool need_refresh;
+ bool recycle_bin_enabled;
+};
+
static int show_deleted_search(struct ldb_module *module, struct ldb_request
*req)
{
struct ldb_context *ldb;
struct ldb_control *show_del, *show_rec;
struct ldb_request *down_req;
struct ldb_parse_tree *new_tree = req->op.search.tree;
+ struct show_deleted_state *state;
int ret;
+ const char *attr_filter = NULL;
ldb = ldb_module_get_ctx(module);
+ state = talloc_get_type(ldb_module_get_private(module), struct
show_deleted_state);
+
+ /* note that state may be NULL during initialisation */
+ if (state != NULL && state->need_refresh) {
+ state->need_refresh = false;
+ ret = dsdb_recyclebin_enabled(module,
&state->recycle_bin_enabled);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+
+ /* This is the logic from MS-ADTS 3.1.1.3.4.1.14 that
+ determines if objects are visible
+
+ Extended control name Deleted-objects
Tombstones Recycled-objects
+ LDAP_SERVER_SHOW_DELETED_OID Visible
Visible Not Visible
+ LDAP_SERVER_SHOW_RECYCLED_OID Visible
Visible Visible
+
+ Note that if the recycle bin is disabled, then the
+ isRecycled attribute is ignored, and objects are either
+ "normal" or "tombstone".
+
+ When the recycle bin is enabled, then objects are in one of
+ 3 states, "normal", "deleted" or "recycled"
+ */
+
/* check if there's a show deleted control */
show_del = ldb_request_get_control(req, LDB_CONTROL_SHOW_DELETED_OID);
/* check if there's a show recycled control */
show_rec = ldb_request_get_control(req, LDB_CONTROL_SHOW_RECYCLED_OID);
- if ((show_del == NULL) && (show_rec == NULL)) {
- /* Here we have to suppress all deleted objects:
- * MS-ADTS 3.1.1.3.4.1
- *
- * Filter: (&(!(isDeleted=TRUE))(...))
- */
- /* FIXME: we could use a constant tree here once we are sure
- * that no ldb modules modify trees in-site */
- new_tree = talloc(req, struct ldb_parse_tree);
- if (!new_tree) {
- return ldb_oom(ldb);
+
+ if (state == NULL || !state->recycle_bin_enabled) {
+ /* when recycle bin is not enabled, then all we look
+ at is the isDeleted attribute. We hide objects with this
+ attribute set to TRUE when the client has not specified
either
+ SHOW_DELETED or SHOW_RECYCLED
+ */
+ if (show_del != NULL || show_rec != NULL) {
+ attr_filter = NULL;
+ } else {
+ attr_filter = "isDeleted";
}
- new_tree->operation = LDB_OP_AND;
- new_tree->u.list.num_elements = 2;
- new_tree->u.list.elements = talloc_array(new_tree, struct
ldb_parse_tree *, 2);
- if (!new_tree->u.list.elements) {
- return ldb_oom(ldb);
+ } else {
+ /* the recycle bin is enabled
+ */
+ if (show_rec != NULL) {
+ attr_filter = NULL;
+ } else if (show_del != NULL) {
+ /* we want deleted but not recycled objects */
+ attr_filter = "isRecycled";
+ } else {
+ /* we don't want deleted or recycled objects,
+ * which we get by filtering on isDeleted */
+ attr_filter = "isDeleted";
}
+ }
- new_tree->u.list.elements[0] =
talloc(new_tree->u.list.elements, struct ldb_parse_tree);
- new_tree->u.list.elements[0]->operation = LDB_OP_NOT;
- new_tree->u.list.elements[0]->u.isnot.child =
- talloc(new_tree->u.list.elements, struct
ldb_parse_tree);
- if (!new_tree->u.list.elements[0]->u.isnot.child) {
- return ldb_oom(ldb);
- }
- new_tree->u.list.elements[0]->u.isnot.child->operation =
LDB_OP_EQUALITY;
- new_tree->u.list.elements[0]->u.isnot.child->u.equality.attr =
"isDeleted";
- new_tree->u.list.elements[0]->u.isnot.child->u.equality.value =
data_blob_string_const("TRUE");
- new_tree->u.list.elements[1] = req->op.search.tree;
- } else if ((show_del != NULL) && (show_rec == NULL)) {
- /* Here we need to suppress all recycled objects:
- * MS-ADTS 3.1.1.3.4.1
- *
- * Filter: (&(!(isRecycled=TRUE))(...))
- */
- /* FIXME: we could use a constant tree here once we are sure
- * that no ldb modules modify trees in-site */
+ if (attr_filter != NULL) {
new_tree = talloc(req, struct ldb_parse_tree);
if (!new_tree) {
return ldb_oom(ldb);
@@ -109,9 +132,8 @@ static int show_deleted_search(struct ldb_module *module,
struct ldb_request *re
return ldb_oom(ldb);
}
new_tree->u.list.elements[0]->u.isnot.child->operation =
LDB_OP_EQUALITY;
- new_tree->u.list.elements[0]->u.isnot.child->u.equality.attr =
"isRecycled";
+ new_tree->u.list.elements[0]->u.isnot.child->u.equality.attr =
attr_filter;
new_tree->u.list.elements[0]->u.isnot.child->u.equality.value =
data_blob_string_const("TRUE");
-
new_tree->u.list.elements[1] = req->op.search.tree;
}
@@ -144,6 +166,13 @@ static int show_deleted_init(struct ldb_module *module)
{
struct ldb_context *ldb;
int ret;
+ struct show_deleted_state *state;
+
+ state = talloc_zero(module, struct show_deleted_state);
+ if (state == NULL) {
+ return ldb_module_oom(module);
+ }
+ state->need_refresh = true;
ldb = ldb_module_get_ctx(module);
@@ -161,7 +190,11 @@ static int show_deleted_init(struct ldb_module *module)
return ldb_operr(ldb);
}
- return ldb_next_init(module);
+ ret = ldb_next_init(module);
+
+ ldb_module_set_private(module, state);
+
+ return ret;
}
static const struct ldb_module_ops ldb_show_deleted_module_ops = {
diff --git a/source4/dsdb/samdb/ldb_modules/util.c
b/source4/dsdb/samdb/ldb_modules/util.c
index 7f601af..cee9ac0 100644
--- a/source4/dsdb/samdb/ldb_modules/util.c
+++ b/source4/dsdb/samdb/ldb_modules/util.c
@@ -652,8 +652,16 @@ int dsdb_check_single_valued_link(const struct
dsdb_attribute *attr,
return LDB_SUCCESS;
}
-int dsdb_check_optional_feature(struct ldb_module *module, struct ldb_dn
*scope,
- struct GUID op_feature_guid, bool
*feature_enabled)
+/*
+ check if an optional feature is enabled on our own NTDS DN
+
+ Note that features can be marked as enabled in more than one
+ place. For example, the recyclebin feature is marked as enabled both
+ on the CN=Partitions,CN=Configurration object and on the NTDS DN of
+ each DC in the forest. It seems likely that it is the job of the KCC
+ to propogate between the two
+ */
+int dsdb_check_optional_feature(struct ldb_module *module, struct GUID
op_feature_guid, bool *feature_enabled)
{
TALLOC_CTX *tmp_ctx;
struct ldb_context *ldb = ldb_module_get_ctx(module);
@@ -664,33 +672,35 @@ int dsdb_check_optional_feature(struct ldb_module
*module, struct ldb_dn *scope,
int ret;
unsigned int i;
struct ldb_message_element *el;
+ struct ldb_dn *feature_dn;
+
+ feature_dn = samdb_ntds_settings_dn(ldb_module_get_ctx(module));
+ if (feature_dn == NULL) {
+ return ldb_operr(ldb_module_get_ctx(module));
+ }
*feature_enabled = false;
tmp_ctx = talloc_new(ldb);
- ret = ldb_search(ldb, tmp_ctx, &res,
- scope, LDB_SCOPE_BASE, attrs,
- NULL);
+ ret = dsdb_module_search_dn(module, tmp_ctx, &res, feature_dn, attrs,
DSDB_FLAG_NEXT_MODULE, NULL);
if (ret != LDB_SUCCESS) {
ldb_asprintf_errstring(ldb,
- "Could no find the scope object - dn: %s\n",
- ldb_dn_get_linearized(scope));
+ "Could not find the feature object - dn: %s\n",
+ ldb_dn_get_linearized(feature_dn));
talloc_free(tmp_ctx);
return LDB_ERR_OPERATIONS_ERROR;
}
if (res->msgs[0]->num_elements > 0) {
+ const char *attrs2[] = {"msDS-OptionalFeatureGUID", NULL};
el = ldb_msg_find_element(res->msgs[0],"msDS-EnabledFeature");
- attrs[0] = "msDS-OptionalFeatureGUID";
-
for (i=0; i<el->num_values; i++) {
search_dn = ldb_dn_from_ldb_val(tmp_ctx, ldb,
&el->values[i]);
- ret = ldb_search(ldb, tmp_ctx, &res,
- search_dn,
LDB_SCOPE_BASE, attrs,
- NULL);
+ ret = dsdb_module_search_dn(module, tmp_ctx, &res,
+ search_dn, attrs2,
DSDB_FLAG_NEXT_MODULE, NULL);
if (ret != LDB_SUCCESS) {
ldb_asprintf_errstring(ldb,
"Could no find object dn: %s\n",
@@ -701,7 +711,7 @@ int dsdb_check_optional_feature(struct ldb_module *module,
struct ldb_dn *scope,
search_guid = samdb_result_guid(res->msgs[0],
"msDS-OptionalFeatureGUID");
- if (GUID_compare(&search_guid, &op_feature_guid) == 0){
+ if (GUID_compare(&search_guid, &op_feature_guid) == 0) {
*feature_enabled = true;
break;
}
@@ -1007,22 +1017,17 @@ bool dsdb_module_am_administrator(struct ldb_module
*module)
int dsdb_recyclebin_enabled(struct ldb_module *module, bool *enabled)
{
struct ldb_context *ldb = ldb_module_get_ctx(module);
- struct ldb_dn *partitions_dn;
struct GUID recyclebin_guid;
int ret;
- partitions_dn = samdb_partitions_dn(ldb, module);
-
GUID_from_string(DS_GUID_FEATURE_RECYCLE_BIN, &recyclebin_guid);
- ret = dsdb_check_optional_feature(module, partitions_dn,
recyclebin_guid, enabled);
+ ret = dsdb_check_optional_feature(module, recyclebin_guid, enabled);
if (ret != LDB_SUCCESS) {
ldb_asprintf_errstring(ldb, "Could not verify if Recycle Bin is
enabled \n");
- talloc_free(partitions_dn);
return LDB_ERR_UNWILLING_TO_PERFORM;
}
- talloc_free(partitions_dn);
return LDB_SUCCESS;
}
diff --git a/source4/dsdb/schema/schema_set.c b/source4/dsdb/schema/schema_set.c
index 8cb06bb..18f3ab7 100644
--- a/source4/dsdb/schema/schema_set.c
+++ b/source4/dsdb/schema/schema_set.c
@@ -241,7 +241,8 @@ static void dsdb_setup_attribute_shortcuts(struct
ldb_context *ldb, struct dsdb_
continue;
}
/* handle attributes with a linkID but no backlink */
- if (dsdb_attribute_by_linkID(schema, attribute->linkID) ==
NULL) {
+ if ((attribute->linkID & 1) == 0 &&
+ dsdb_attribute_by_linkID(schema, attribute->linkID + 1) ==
NULL) {
attribute->one_way_link = true;
continue;
}
--
Samba Shared Repository
