?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
libcli: Speed up sddl_decode_ace()
[samba4-gss.git] / source4 / dsdb / kcc / kcc_periodic.c
blobdf38f00e776319af7ccf9767a35796c58a598910
1 /*
2 Unix SMB/CIFS Implementation.
3 KCC service periodic handling
4
5 Copyright (C) Andrew Tridgell 2009
6 based on repl service code
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20
21 */
22
23 #include "includes.h"
24 #include "lib/events/events.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "auth/auth.h"
27 #include "samba/service.h"
28 #include "lib/messaging/irpc.h"
29 #include "dsdb/kcc/kcc_connection.h"
30 #include "dsdb/kcc/kcc_service.h"
31 #include <ldb_errors.h>
32 #include "../lib/util/dlinklist.h"
33 #include "librpc/gen_ndr/ndr_misc.h"
34 #include "librpc/gen_ndr/ndr_drsuapi.h"
35 #include "librpc/gen_ndr/ndr_drsblobs.h"
36 #include "librpc/gen_ndr/ndr_irpc_c.h"
37 #include "param/param.h"
38 #include "dsdb/common/util.h"
39
40 /*
41 * see if two repsFromToBlob blobs are for the same source DSA
42 */
43 static bool kccsrv_same_source_dsa(struct repsFromToBlob *r1, struct repsFromToBlob *r2)
44 {
45 return GUID_equal(&r1->ctr.ctr1.source_dsa_obj_guid,
46 &r2->ctr.ctr1.source_dsa_obj_guid);
47 }
48
49 /*
50 * see if a repsFromToBlob is in a list
51 */
52 static bool reps_in_list(struct repsFromToBlob *r, struct repsFromToBlob *reps, uint32_t count)
53 {
54 uint32_t i;
55 for (i=0; i<count; i++) {
56 if (kccsrv_same_source_dsa(r, &reps[i])) {
57 return true;
58 }
59 }
60 return false;
61 }
62
63 /*
64 make sure we only add repsFrom entries for DCs who are masters for
65 the partition
66 */
67 static bool check_MasterNC(struct kccsrv_service *service, struct dsdb_ldb_dn_list_node *p, struct repsFromToBlob *r,
68 struct ldb_result *res)
69 {
70 struct repsFromTo1 *r1 = &r->ctr.ctr1;
71 struct GUID invocation_id = r1->source_dsa_invocation_id;
72 unsigned int i, j;
73 TALLOC_CTX *tmp_ctx;
74
75 /* we are expecting only version 1 */
76 SMB_ASSERT(r->version == 1);
77
78 tmp_ctx = talloc_new(p);
79 if (!tmp_ctx) {
80 return false;
81 }
82
83 for (i=0; i<res->count; i++) {
84 struct ldb_message *msg = res->msgs[i];
85 struct ldb_message_element *el;
86 struct ldb_dn *dn;
87
88 struct GUID id2 = samdb_result_guid(msg, "invocationID");
89 if (GUID_all_zero(&id2) ||
90 !GUID_equal(&invocation_id, &id2)) {
91 continue;
92 }
93
94 el = ldb_msg_find_element(msg, "msDS-hasMasterNCs");
95 if (!el || el->num_values == 0) {
96 el = ldb_msg_find_element(msg, "hasMasterNCs");
97 if (!el || el->num_values == 0) {
98 continue;
99 }
100 }
101 for (j=0; j<el->num_values; j++) {
102 dn = ldb_dn_from_ldb_val(tmp_ctx, service->samdb, &el->values[j]);
103 if (!ldb_dn_validate(dn)) {
104 talloc_free(dn);
105 continue;
106 }
107 if (ldb_dn_compare(dn, p->dn) == 0) {
108 DEBUG(5,("%s %s match on %s in %s\n",
109 r1->other_info->dns_name,
110 el->name,
111 ldb_dn_get_linearized(dn),
112 ldb_dn_get_linearized(msg->dn)));
113 talloc_free(tmp_ctx);
114 return true;
115 }
116 talloc_free(dn);
117 }
118 }
119 talloc_free(tmp_ctx);
120 return false;
121 }
122
123 struct kccsrv_notify_drepl_server_state {
124 struct dreplsrv_refresh r;
125 };
126
127 static void kccsrv_notify_drepl_server_done(struct tevent_req *subreq);
128
129 /**
130 * Force dreplsrv to update its state as topology is changed
131 */
132 static void kccsrv_notify_drepl_server(struct kccsrv_service *s,
133 TALLOC_CTX *mem_ctx)
134 {
135 struct kccsrv_notify_drepl_server_state *state;
136 struct dcerpc_binding_handle *irpc_handle;
137 struct tevent_req *subreq;
138
139 state = talloc_zero(s, struct kccsrv_notify_drepl_server_state);
140 if (state == NULL) {
141 return;
142 }
143
144 irpc_handle = irpc_binding_handle_by_name(state, s->task->msg_ctx,
145 "dreplsrv", &ndr_table_irpc);
146 if (irpc_handle == NULL) {
147 /* dreplsrv is not running yet */
148 TALLOC_FREE(state);
149 return;
150 }
151
152 subreq = dcerpc_dreplsrv_refresh_r_send(state, s->task->event_ctx,
153 irpc_handle, &state->r);
154 if (subreq == NULL) {
155 TALLOC_FREE(state);
156 return;
157 }
158 tevent_req_set_callback(subreq, kccsrv_notify_drepl_server_done, state);
159 }
160
161 static void kccsrv_notify_drepl_server_done(struct tevent_req *subreq)
162 {
163 struct kccsrv_notify_drepl_server_state *state =
164 tevent_req_callback_data(subreq,
165 struct kccsrv_notify_drepl_server_state);
166
167 dcerpc_dreplsrv_refresh_r_recv(subreq, state);
168 TALLOC_FREE(subreq);
169
170 /* we don't care about errors */
171 TALLOC_FREE(state);
172 }
173
174 uint32_t kccsrv_replica_flags(struct kccsrv_service *s)
175 {
176 if (s->am_rodc) {
177 return DRSUAPI_DRS_INIT_SYNC |
178 DRSUAPI_DRS_PER_SYNC |
179 DRSUAPI_DRS_ADD_REF |
180 DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING |
181 DRSUAPI_DRS_NONGC_RO_REP;
182 }
183 return DRSUAPI_DRS_INIT_SYNC |
184 DRSUAPI_DRS_PER_SYNC |
185 DRSUAPI_DRS_ADD_REF |
186 DRSUAPI_DRS_WRIT_REP;
187 }
188
189 /*
190 * add any missing repsFrom structures to our partitions
191 */
192 NTSTATUS kccsrv_add_repsFrom(struct kccsrv_service *s, TALLOC_CTX *mem_ctx,
193 struct repsFromToBlob *reps, uint32_t count,
194 struct ldb_result *res)
195 {
196 struct dsdb_ldb_dn_list_node *p;
197 bool notify_dreplsrv = false;
198 uint32_t replica_flags = kccsrv_replica_flags(s);
199
200 /* update the repsFrom on all partitions */
201 for (p=s->partitions; p; p=p->next) {
202 struct repsFromToBlob *our_reps;
203 uint32_t our_count;
204 WERROR werr;
205 uint32_t i, j;
206 bool modified = false;
207
208 werr = dsdb_loadreps(s->samdb, mem_ctx, p->dn, "repsFrom", &our_reps, &our_count);
209 if (!W_ERROR_IS_OK(werr)) {
210 DEBUG(0,(__location__ ": Failed to load repsFrom from %s - %s\n",
211 ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
212 return NT_STATUS_INTERNAL_DB_CORRUPTION;
213 }
214
215 /* see if the entry already exists */
216 for (i=0; i<count; i++) {
217 for (j=0; j<our_count; j++) {
218 if (kccsrv_same_source_dsa(&reps[i], &our_reps[j])) {
219 /* we already have this one -
220 check the replica_flags are right */
221 if (replica_flags != our_reps[j].ctr.ctr1.replica_flags) {
222 /* we need to update the old one with
223 * the new flags
224 */
225 our_reps[j].ctr.ctr1.replica_flags = replica_flags;
226 modified = true;
227 }
228 break;
229 }
230 }
231 if (j == our_count) {
232 /* we don't have the new one - add it
233 * if it is a master
234 */
235 if (res && !check_MasterNC(s, p, &reps[i], res)) {
236 /* its not a master, we don't
237 want to pull from it */
238 continue;
239 }
240 /* we need to add it to our repsFrom */
241 our_reps = talloc_realloc(mem_ctx, our_reps, struct repsFromToBlob, our_count+1);
242 NT_STATUS_HAVE_NO_MEMORY(our_reps);
243 our_reps[our_count] = reps[i];
244 our_reps[our_count].ctr.ctr1.replica_flags = replica_flags;
245 our_count++;
246 modified = true;
247 DEBUG(4,(__location__ ": Added repsFrom for %s\n",
248 reps[i].ctr.ctr1.other_info->dns_name));
249 }
250 }
251
252 /* remove any stale ones */
253 for (i=0; i<our_count; i++) {
254 if (!reps_in_list(&our_reps[i], reps, count) ||
255 (res && !check_MasterNC(s, p, &our_reps[i], res))) {
256 DEBUG(4,(__location__ ": Removed repsFrom for %s\n",
257 our_reps[i].ctr.ctr1.other_info->dns_name));
258 memmove(&our_reps[i], &our_reps[i+1], (our_count-(i+1))*sizeof(our_reps[0]));
259 our_count--;
260 i--;
261 modified = true;
262 }
263 }
264
265 if (modified) {
266 werr = dsdb_savereps(s->samdb, mem_ctx, p->dn, "repsFrom", our_reps, our_count);
267 if (!W_ERROR_IS_OK(werr)) {
268 DEBUG(0,(__location__ ": Failed to save repsFrom to %s - %s\n",
269 ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
270 return NT_STATUS_INTERNAL_DB_CORRUPTION;
271 }
272 /* dreplsrv should refresh its state */
273 notify_dreplsrv = true;
274 }
275
276 /* remove stale repsTo entries */
277 modified = false;
278 werr = dsdb_loadreps(s->samdb, mem_ctx, p->dn, "repsTo", &our_reps, &our_count);
279 if (!W_ERROR_IS_OK(werr)) {
280 DEBUG(0,(__location__ ": Failed to load repsTo from %s - %s\n",
281 ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
282 return NT_STATUS_INTERNAL_DB_CORRUPTION;
283 }
284
285 /* remove any stale ones */
286 for (i=0; i<our_count; i++) {
287 if (!reps_in_list(&our_reps[i], reps, count)) {
288 DEBUG(4,(__location__ ": Removed repsTo for %s\n",
289 our_reps[i].ctr.ctr1.other_info->dns_name));
290 memmove(&our_reps[i], &our_reps[i+1], (our_count-(i+1))*sizeof(our_reps[0]));
291 our_count--;
292 i--;
293 modified = true;
294 }
295 }
296
297 if (modified) {
298 werr = dsdb_savereps(s->samdb, mem_ctx, p->dn, "repsTo", our_reps, our_count);
299 if (!W_ERROR_IS_OK(werr)) {
300 DEBUG(0,(__location__ ": Failed to save repsTo to %s - %s\n",
301 ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
302 return NT_STATUS_INTERNAL_DB_CORRUPTION;
303 }
304 /* dreplsrv should refresh its state */
305 notify_dreplsrv = true;
306 }
307 }
308
309 /* notify dreplsrv toplogy has changed */
310 if (notify_dreplsrv) {
311 kccsrv_notify_drepl_server(s, mem_ctx);
312 }
313
314 return NT_STATUS_OK;
315
316 }
317
318
319 /*
320 form a unique list of DNs from a search result and a given set of attributes
321 */
322 static int kccsrv_dn_list(struct ldb_context *ldb, struct ldb_result *res,
323 TALLOC_CTX *mem_ctx,
324 const char **attrs,
325 struct ldb_dn ***dn_list, int *dn_count)
326 {
327 int i;
328 struct ldb_dn **nc_list = NULL;
329 int nc_count = 0;
330
331 nc_list = talloc_array(mem_ctx, struct ldb_dn *, 0);
332 if (nc_list == NULL) {
333 return LDB_ERR_OPERATIONS_ERROR;
334 }
335
336 /* gather up a list of all NCs in this forest */
337 for (i=0; i<res->count; i++) {
338 struct ldb_message *msg = res->msgs[i];
339 int j;
340 for (j=0; attrs[j]; j++) {
341 struct ldb_message_element *el;
342 int k;
343
344 el = ldb_msg_find_element(msg, attrs[j]);
345 if (el == NULL) continue;
346 for (k=0; k<el->num_values; k++) {
347 struct ldb_dn *dn;
348 dn = ldb_dn_from_ldb_val(nc_list, ldb, &el->values[k]);
349 if (dn != NULL) {
350 int l;
351 for (l=0; l<nc_count; l++) {
352 if (ldb_dn_compare(nc_list[l], dn) == 0) break;
353 }
354 if (l < nc_count) continue;
355 nc_list = talloc_realloc(mem_ctx, nc_list, struct ldb_dn *, nc_count+1);
356 if (nc_list == NULL) {
357 return LDB_ERR_OPERATIONS_ERROR;
358 }
359 nc_list[nc_count] = dn;
360 nc_count++;
361 }
362 }
363 }
364 }
365
366 (*dn_list) = nc_list;
367 (*dn_count) = nc_count;
368 return LDB_SUCCESS;
369 }
370
371
372 /*
373 look for any additional global catalog partitions that we should be
374 replicating (by looking for msDS-HasDomainNCs), and add them to our
375 hasPartialReplicaNCs NTDS attribute
376 */
377 static int kccsrv_gc_update(struct kccsrv_service *s, struct ldb_result *res)
378 {
379 int i;
380 struct ldb_dn **nc_list = NULL;
381 int nc_count = 0;
382 struct ldb_dn **our_nc_list = NULL;
383 int our_nc_count = 0;
384 const char *attrs1[] = { "msDS-hasMasterNCs", "hasMasterNCs", "msDS-HasDomainNCs", NULL };
385 const char *attrs2[] = { "msDS-hasMasterNCs", "hasMasterNCs", "msDS-HasDomainNCs", "hasPartialReplicaNCs", NULL };
386 int ret;
387 TALLOC_CTX *tmp_ctx = talloc_new(res);
388 struct ldb_result *res2;
389 struct ldb_message *msg;
390
391 /* get a complete list of NCs for the forest */
392 ret = kccsrv_dn_list(s->samdb, res, tmp_ctx, attrs1, &nc_list, &nc_count);
393 if (ret != LDB_SUCCESS) {
394 DEBUG(1,("Failed to get NC list for GC update - %s\n", ldb_errstring(s->samdb)));
395 talloc_free(tmp_ctx);
396 return ret;
397 }
398
399 /* get a list of what NCs we are already replicating */
400 ret = dsdb_search_dn(s->samdb, tmp_ctx, &res2, samdb_ntds_settings_dn(s->samdb, tmp_ctx), attrs2, 0);
401 if (ret != LDB_SUCCESS) {
402 DEBUG(1,("Failed to get our NC list attributes for GC update - %s\n", ldb_errstring(s->samdb)));
403 talloc_free(tmp_ctx);
404 return ret;
405 }
406
407 ret = kccsrv_dn_list(s->samdb, res2, tmp_ctx, attrs2, &our_nc_list, &our_nc_count);
408 if (ret != LDB_SUCCESS) {
409 DEBUG(1,("Failed to get our NC list for GC update - %s\n", ldb_errstring(s->samdb)));
410 talloc_free(tmp_ctx);
411 return ret;
412 }
413
414 msg = ldb_msg_new(tmp_ctx);
415 if (msg == NULL) {
416 talloc_free(tmp_ctx);
417 return LDB_ERR_OPERATIONS_ERROR;
418 }
419 msg->dn = res2->msgs[0]->dn;
420
421 /* see if we are missing any */
422 for (i=0; i<nc_count; i++) {
423 int j;
424 for (j=0; j<our_nc_count; j++) {
425 if (ldb_dn_compare(nc_list[i], our_nc_list[j]) == 0) break;
426 }
427 if (j == our_nc_count) {
428 /* its a new one */
429 ret = ldb_msg_add_string(msg, "hasPartialReplicaNCs",
430 ldb_dn_get_extended_linearized(msg, nc_list[i], 1));
431 if (ret != LDB_SUCCESS) {
432 talloc_free(tmp_ctx);
433 return ret;
434 }
435
436 }
437 }
438
439 if (msg->num_elements == 0) {
440 /* none to add */
441 talloc_free(tmp_ctx);
442 return LDB_SUCCESS;
443 }
444
445 if (s->am_rodc) {
446 DEBUG(5, ("%d partial replica should be added but we are RODC so we skip\n", msg->num_elements));
447 talloc_free(tmp_ctx);
448 return LDB_SUCCESS;
449 }
450
451 msg->elements[0].flags = LDB_FLAG_MOD_ADD;
452
453 ret = dsdb_modify(s->samdb, msg, 0);
454 if (ret != LDB_SUCCESS) {
455 DEBUG(0,("Failed to add hasPartialReplicaNCs - %s\n",
456 ldb_errstring(s->samdb)));
457 }
458
459 talloc_free(tmp_ctx);
460 return ret;
461 }
462
463
464 /*
465 this is the core of our initial simple KCC
466 We just add a repsFrom entry for all DCs we find that have nTDSDSA
467 objects, except for ourselves
468 */
469 NTSTATUS kccsrv_simple_update(struct kccsrv_service *s, TALLOC_CTX *mem_ctx)
470 {
471 struct ldb_result *res;
472 unsigned int i;
473 int ret;
474 const char *attrs[] = { "objectGUID", "invocationID", "msDS-hasMasterNCs", "hasMasterNCs", "msDS-HasDomainNCs", NULL };
475 struct repsFromToBlob *reps = NULL;
476 uint32_t count = 0;
477 struct kcc_connection_list *ntds_conn, *dsa_conn;
478
479 ret = dsdb_search(s->samdb, mem_ctx, &res, s->config_dn, LDB_SCOPE_SUBTREE,
480 attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "objectClass=nTDSDSA");
481 if (ret != LDB_SUCCESS) {
482 DEBUG(0,(__location__ ": Failed nTDSDSA search - %s\n", ldb_errstring(s->samdb)));
483 return NT_STATUS_INTERNAL_DB_CORRUPTION;
484 }
485
486 if (samdb_is_gc(s->samdb)) {
487 kccsrv_gc_update(s, res);
488 }
489
490 /* get the current list of connections */
491 ntds_conn = kccsrv_find_connections(s, mem_ctx);
492
493 dsa_conn = talloc_zero(mem_ctx, struct kcc_connection_list);
494
495 for (i=0; i<res->count; i++) {
496 struct repsFromTo1 *r1;
497 struct GUID ntds_guid, invocation_id;
498
499 ntds_guid = samdb_result_guid(res->msgs[i], "objectGUID");
500 if (GUID_equal(&ntds_guid, &s->ntds_guid)) {
501 /* don't replicate with ourselves */
502 continue;
503 }
504
505 invocation_id = samdb_result_guid(res->msgs[i], "invocationID");
506
507 reps = talloc_realloc(mem_ctx, reps, struct repsFromToBlob, count+1);
508 NT_STATUS_HAVE_NO_MEMORY(reps);
509
510 ZERO_STRUCT(reps[count]);
511 reps[count].version = 1;
512 r1 = &reps[count].ctr.ctr1;
513
514 r1->other_info = talloc_zero(reps, struct repsFromTo1OtherInfo);
515 r1->other_info->dns_name = samdb_ntds_msdcs_dns_name(s->samdb, reps, &ntds_guid);
516 r1->source_dsa_obj_guid = ntds_guid;
517 r1->source_dsa_invocation_id = invocation_id;
518 r1->replica_flags = kccsrv_replica_flags(s);
519 memset(r1->schedule, 0x11, sizeof(r1->schedule));
520
521 dsa_conn->servers = talloc_realloc(dsa_conn, dsa_conn->servers,
522 struct kcc_connection,
523 dsa_conn->count + 1);
524 NT_STATUS_HAVE_NO_MEMORY(dsa_conn->servers);
525 dsa_conn->servers[dsa_conn->count].dsa_guid = r1->source_dsa_obj_guid;
526 dsa_conn->count++;
527
528 count++;
529 }
530
531 kccsrv_apply_connections(s, ntds_conn, dsa_conn);
532
533 return kccsrv_add_repsFrom(s, mem_ctx, reps, count, res);
534 }
535
536
537 static void kccsrv_periodic_run(struct kccsrv_service *service);
538
539 static void kccsrv_periodic_handler_te(struct tevent_context *ev, struct tevent_timer *te,
540 struct timeval t, void *ptr)
541 {
542 struct kccsrv_service *service = talloc_get_type(ptr, struct kccsrv_service);
543 WERROR status;
544
545 service->periodic.te = NULL;
546
547 kccsrv_periodic_run(service);
548
549 status = kccsrv_periodic_schedule(service, service->periodic.interval);
550 if (!W_ERROR_IS_OK(status)) {
551 task_server_terminate(service->task, win_errstr(status), true);
552 return;
553 }
554 }
555
556 WERROR kccsrv_periodic_schedule(struct kccsrv_service *service, uint32_t next_interval)
557 {
558 TALLOC_CTX *tmp_mem;
559 struct tevent_timer *new_te;
560 struct timeval next_time;
561
562 /* prevent looping */
563 if (next_interval == 0) next_interval = 1;
564
565 next_time = timeval_current_ofs(next_interval, 50);
566
567 if (service->periodic.te) {
568 /*
569 * if the timestamp of the new event is higher,
570 * as current next we don't need to reschedule
571 */
572 if (timeval_compare(&next_time, &service->periodic.next_event) > 0) {
573 return WERR_OK;
574 }
575 }
576
577 /* reset the next scheduled timestamp */
578 service->periodic.next_event = next_time;
579
580 new_te = tevent_add_timer(service->task->event_ctx, service,
581 service->periodic.next_event,
582 kccsrv_periodic_handler_te, service);
583 W_ERROR_HAVE_NO_MEMORY(new_te);
584
585 tmp_mem = talloc_new(service);
586 DEBUG(4,("kccsrv_periodic_schedule(%u) %sscheduled for: %s\n",
587 next_interval,
588 (service->periodic.te?"re":""),
589 nt_time_string(tmp_mem, timeval_to_nttime(&next_time))));
590 talloc_free(tmp_mem);
591
592 talloc_free(service->periodic.te);
593 service->periodic.te = new_te;
594
595 return WERR_OK;
596 }
597
598 /*
599 * Check to see if any dns entries need scavenging. This only occurs if aging
600 * is enabled in general ("zone scavenging" lpcfg) and on the zone
601 * (zone->fAging is true).
602 */
603 static NTSTATUS kccsrv_dns_zone_scavenging(
604 struct kccsrv_service *s,
605 TALLOC_CTX *mem_ctx)
606 {
607
608 time_t current_time = time(NULL);
609 time_t dns_scavenge_interval;
610 NTSTATUS status;
611 char *error_string = NULL;
612
613 /*
614 * Only perform zone scavenging if it's been enabled.
615 * (it still might be disabled on all zones).
616 */
617 if (!lpcfg_dns_zone_scavenging(s->task->lp_ctx)) {
618 DBG_INFO("DNS scavenging not enabled\n");
619 return NT_STATUS_OK;
620 }
621
622 dns_scavenge_interval = lpcfg_parm_int(s->task->lp_ctx,
623 NULL,
624 "dnsserver",
625 "scavenging_interval",
626 2 * 60 * 60);
627 if ((current_time - s->last_dns_scavenge) > dns_scavenge_interval) {
628 s->last_dns_scavenge = current_time;
629 status = dns_tombstone_records(mem_ctx, s->samdb,
630 &error_string);
631 if (!NT_STATUS_IS_OK(status)) {
632 const char *err = NULL;
633 if (error_string != NULL) {
634 err = error_string;
635 } else {
636 err = nt_errstr(status);
637 }
638 DBG_ERR("DNS record scavenging process failed: %s\n",
639 err);
640 return status;
641 }
642 }
643 DBG_INFO("Successfully tombstoned stale DNS records\n");
644 return NT_STATUS_OK;
645 }
646 /*
647 * check to see if any dns tombstones should be deleted. This is not optional
648 * ([MS-DNSP] "DsTombstoneInterval") -- stale tombstones are useless clutter.
649 *
650 * Windows does it daily at 2am; we do it roughly daily at an uncontrolled
651 * time.
652 */
653 static NTSTATUS kccsrv_dns_zone_tombstone_deletion(struct kccsrv_service *s,
654 TALLOC_CTX *mem_ctx)
655 {
656 time_t current_time = time(NULL);
657 NTSTATUS status;
658 char *error_string = NULL;
659 time_t dns_collection_interval =
660 lpcfg_parm_int(s->task->lp_ctx,
661 NULL,
662 "dnsserver",
663 "tombstone_collection_interval",
664 24 * 60 * 60);
665
666 if ((current_time - s->last_dns_tombstone_collection) >
667 dns_collection_interval) {
668 s->last_dns_tombstone_collection = current_time;
669 status = dns_delete_tombstones(mem_ctx, s->samdb,
670 &error_string);
671 if (!NT_STATUS_IS_OK(status)) {
672 const char *err = NULL;
673 if (error_string != NULL) {
674 err = error_string;
675 } else {
676 err = nt_errstr(status);
677 }
678 DBG_ERR("DNS tombstone deletion failed: %s\n", err);
679 return status;
680 }
681 }
682 DBG_INFO("Successfully deleted DNS tombstones\n");
683 return NT_STATUS_OK;
684 }
685
686 /*
687 check to see if any deleted objects need scavenging
688 */
689 static NTSTATUS kccsrv_check_deleted(struct kccsrv_service *s, TALLOC_CTX *mem_ctx)
690 {
691 time_t current_time = time(NULL);
692 time_t interval = lpcfg_parm_int(
693 s->task->lp_ctx, NULL, "kccsrv", "check_deleted_interval", 86400);
694 uint32_t tombstoneLifetime;
695 int ret;
696 unsigned int num_objects_removed = 0;
697 unsigned int num_links_removed = 0;
698 NTSTATUS status;
699 char *error_string = NULL;
700
701 if (current_time - s->last_deleted_check < interval) {
702 return NT_STATUS_OK;
703 }
704
705 ret = dsdb_tombstone_lifetime(s->samdb, &tombstoneLifetime);
706 if (ret != LDB_SUCCESS) {
707 DEBUG(1,(__location__ ": Failed to get tombstone lifetime\n"));
708 return NT_STATUS_INTERNAL_DB_CORRUPTION;
709 }
710
711 s->last_deleted_check = current_time;
712
713 status = dsdb_garbage_collect_tombstones(mem_ctx, s->samdb,
714 s->partitions,
715 current_time, tombstoneLifetime,
716 &num_objects_removed,
717 &num_links_removed,
718 &error_string);
719
720 if (NT_STATUS_IS_OK(status)) {
721 DEBUG(5, ("garbage_collect_tombstones: Removed %u tombstone objects "
722 "and %u tombstone links successfully\n",
723 num_objects_removed, num_links_removed));
724 } else {
725 DEBUG(2, ("garbage_collect_tombstones: Failure removing tombstone "
726 "objects and links after removing %u tombstone objects "
727 "and %u tombstone links successfully: %s\n",
728 num_objects_removed, num_links_removed,
729 error_string ? error_string : nt_errstr(status)));
730 }
731 return status;
732 }
733
734 static void kccsrv_periodic_run(struct kccsrv_service *service)
735 {
736 TALLOC_CTX *mem_ctx;
737 NTSTATUS status;
738
739 DEBUG(4,("kccsrv_periodic_run(): update\n"));
740
741 mem_ctx = talloc_new(service);
742
743 if (service->samba_kcc_code) {
744 status = kccsrv_samba_kcc(service);
745 if (!NT_STATUS_IS_OK(status)) {
746 DBG_ERR("kccsrv_samba_kcc failed - %s\n",
747 nt_errstr(status));
748 }
749 } else {
750 status = kccsrv_simple_update(service, mem_ctx);
751 if (!NT_STATUS_IS_OK(status))
752 DEBUG(0,("kccsrv_simple_update failed - %s\n",
753 nt_errstr(status)));
754 }
755
756 status = kccsrv_check_deleted(service, mem_ctx);
757 if (!NT_STATUS_IS_OK(status)) {
758 DEBUG(0,("kccsrv_check_deleted failed - %s\n", nt_errstr(status)));
759 }
760 status = kccsrv_dns_zone_scavenging(service, mem_ctx);
761 if (!NT_STATUS_IS_OK(status)) {
762 DBG_ERR("kccsrv_dns_zone_aging failed - %s\n",
763 nt_errstr(status));
764 }
765 status = kccsrv_dns_zone_tombstone_deletion(service, mem_ctx);
766 if (!NT_STATUS_IS_OK(status)) {
767 DBG_ERR("kccsrv_dns_zone_tombstone_scavenging failed - %s\n",
768 nt_errstr(status));
769 }
770 talloc_free(mem_ctx);
771 }
772
773 /* Called when samba_kcc script has finished
774 */
775 static void samba_kcc_done(struct tevent_req *subreq)
776 {
777 struct kccsrv_service *service =
778 tevent_req_callback_data(subreq, struct kccsrv_service);
779 int rc;
780 int sys_errno;
781
782 service->periodic.subreq = NULL;
783
784 rc = samba_runcmd_recv(subreq, &sys_errno);
785 TALLOC_FREE(subreq);
786
787 if (rc != 0)
788 service->periodic.status =
789 map_nt_error_from_unix_common(sys_errno);
790 else
791 service->periodic.status = NT_STATUS_OK;
792
793 if (!NT_STATUS_IS_OK(service->periodic.status))
794 DEBUG(0,(__location__ ": Failed samba_kcc - %s\n",
795 nt_errstr(service->periodic.status)));
796 else
797 DEBUG(3,("Completed samba_kcc OK\n"));
798 }
799
800 /* Invocation of the samba_kcc python script for replication
801 * topology generation.
802 */
803 NTSTATUS kccsrv_samba_kcc(struct kccsrv_service *service)
804 {
805 NTSTATUS status = NT_STATUS_OK;
806 const char * const *samba_kcc_command =
807 lpcfg_samba_kcc_command(service->task->lp_ctx);
808
809 /* kill any existing child */
810 TALLOC_FREE(service->periodic.subreq);
811
812 DEBUG(2, ("Calling samba_kcc script\n"));
813 service->periodic.subreq = samba_runcmd_send(service,
814 service->task->event_ctx,
815 timeval_current_ofs(40, 0),
816 2, 0, samba_kcc_command, NULL);
817
818 if (service->periodic.subreq == NULL) {
819 status = NT_STATUS_NO_MEMORY;
820 goto xerror;
821 }
822 tevent_req_set_callback(service->periodic.subreq,
823 samba_kcc_done, service);
824
825 xerror:
826 if (!NT_STATUS_IS_OK(status))
827 DEBUG(0,(__location__ ": failed - %s\n", nt_errstr(status)));
828 return status;
829 }
GSS-enabled samba4