Bug 11139 - Objects referenced by a DN+Binary forward (e.g. msDS-RevealedUsers) link can't be deleted
Objects referenced by a DN+Binary forward (e.g. msDS-RevealedUsers) link can'...
Status: NEW
Product: Samba 4.1 and newer
Classification: Unclassified
All All
: P5 normal
: 4.3
Assigned To: Andrew Bartlett
Samba QA Contact
Depends on:
Blocks: 9998
  Show dependency treegraph
Reported: 2015-03-06 10:19 UTC by Stefan Metzmacher
Modified: 2016-06-03 10:20 UTC (History)
1 user (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Metzmacher 2015-03-06 10:19:00 UTC
Objects referenced by a DN+Binary forward (e.g. msDS-RevealedUsers) link can't be deleted.

dsdb_dn_parse() fails with LDB_ERR_INVALID_DN_SYNTAX, because the internal code tries to delete

msDS-RevealedUsers: CN=delete1,CN=Users,DC=samba,DC=example,DC=com
from object CN=LOCALVAMPIREDC,OU=Domain Controllers,DC=samba,DC=example,DC=com.

B:96:000...000:CN=delete1,CN=Users,DC=samba,DC=example,DC=com would be
a valid value for msDS-RevealedUsers attribute.

While the client deletes CN=delete1,CN=Users,DC=samba,DC=example,DC=com.

The reason is that the backlink doesn't know about the Binary part of the dn,
while trying to delete the forward link.

Note there might be two problem related to this one for originating updates
and one for replicated updates. Replicated updates result in a failure
in dsdb_replicated_objects_commit/ldb_extended(ldb, DSDB_EXTENDED_REPLICATED_OBJECTS_OID) The error is LDB_ERR_OPERATIONS_ERROR

This is the backtrace from an originating update with:

ldbdel -H ... CN=delete1,CN=Users,DC=samba,DC=example,DC=com

#0  dsdb_dn_parse (mem_ctx=0x555556452050, ldb=0x555555760530, dn_blob=0x7fffffffca20, dn_oid=0x7ffff57fdcf2 "1.2.840.113556.1.4.903")
    at ../source4/dsdb/common/dsdb_dn.c:107
#1  0x00007fffe91cf743 in get_parsed_dns (module=0x5555558134a0, mem_ctx=0x555556410490, el=0x55555600d2f0, pdn=0x7fffffffc6f8,
    ldap_oid=0x7ffff57fdcf2 "1.2.840.113556.1.4.903", parent=0x5555568d6c30) at ../source4/dsdb/samdb/ldb_modules/repl_meta_data.c:1670
#2  0x00007fffe91d0be5 in replmd_modify_la_delete (module=0x5555558134a0, schema=0x555555e42810, msg=0x5555559d6990, el=0x55555600d2f0, old_el=0x55555615a950,
    schema_attr=0x5555572586d0, seq_num=3502, t=1425633526, msg_guid=0x7fffffffc810, parent=0x5555568d6c30)
    at ../source4/dsdb/samdb/ldb_modules/repl_meta_data.c:2094
#3  0x00007fffe91d1bc4 in replmd_modify_handle_linked_attribs (module=0x5555558134a0, msg=0x5555559d6990, seq_num=3502, t=1425633526, parent=0x5555568d6c30)
    at ../source4/dsdb/samdb/ldb_modules/repl_meta_data.c:2418
#4  0x00007fffe91d2212 in replmd_modify (module=0x5555558134a0, req=0x5555568d6c30) at ../source4/dsdb/samdb/ldb_modules/repl_meta_data.c:2554
#5  0x00007ffff676ab5a in dsdb_module_modify (module=0x5555558134a0, message=0x555556113b40, dsdb_flags=4194304, parent=0x555555f7c290)
    at ../source4/dsdb/samdb/ldb_modules/util.c:460
#6  0x00007fffe91d330b in replmd_delete_remove_link (module=0x5555558134a0, schema=0x555555e42810, dn=0x5555569bcf50, el=0x555556038ce0, sa=0x555557258280,
    parent=0x555555f7c290) at ../source4/dsdb/samdb/ldb_modules/repl_meta_data.c:2947
#7  0x00007fffe91d445e in replmd_delete_internals (module=0x5555558134a0, req=0x555555f7c290, re_delete=false)
    at ../source4/dsdb/samdb/ldb_modules/repl_meta_data.c:3304
#8  0x00007fffe91d4af9 in replmd_delete (module=0x5555558134a0, req=0x555555f7c290) at ../source4/dsdb/samdb/ldb_modules/repl_meta_data.c:3444
Comment 1 Stefan Metzmacher 2016-06-03 10:08:21 UTC
Andrew, is this the fix?
Comment 2 Stefan Metzmacher 2016-06-03 10:09:04 UTC
(In reply to Stefan Metzmacher from comment #1)
Comment 3 Stefan Metzmacher 2016-06-03 10:15:09 UTC
(In reply to Stefan Metzmacher from comment #2)

Maybe together with
Comment 4 Stefan Metzmacher 2016-06-03 10:18:59 UTC
(In reply to Stefan Metzmacher from comment #3)

Ok, they seem to be basically the same, but dereference

schema_attr at different levels.

I guess I'd prefer Andrew's version that passes the full
Comment 5 Andrew Bartlett 2016-06-03 10:20:49 UTC
(In reply to Stefan Metzmacher from comment #4)
It is the fix, but it broke make test and so we dropped it so that we could get whatever else we were doing at the time into master.