getncchanges: Do not filter EXOPs using highwatermark

Prior to this patch, any REPL_SECRETS could be filtered accidentally.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source4/rpc_server/drsuapi/getncchanges.c b/source4/rpc_server/drsuapi/getncchanges.c
index ce8e7122ac52ad8dfc3cc6f7ada0ef1431dfd5f7..da294a6623aa2926f36506e28f3117e7292dd534 100644 (file)
--- a/source4/rpc_server/drsuapi/getncchanges.c
+++ b/source4/rpc_server/drsuapi/getncchanges.c
@@ -2358,28 +2358,35 @@ allowed:
 
                extra_filter = lpcfg_parm_string(dce_call->conn->dce_ctx->lp_ctx, NULL, "drs", "object filter");
 
-               if (req10->uptodateness_vector != NULL) {
-                       udv = req10->uptodateness_vector;
-               } else {
-                       udv = &empty_udv;
-               }
+               if (req10->extended_op == DRSUAPI_EXOP_NONE) {
+                       if (req10->uptodateness_vector != NULL) {
+                               udv = req10->uptodateness_vector;
+                       } else {
+                               udv = &empty_udv;
+                       }
 
-               getnc_state->min_usn = req10->highwatermark.highest_usn;
-               for (i = 0; i < udv->count; i++) {
-                       bool match;
-                       const struct drsuapi_DsReplicaCursor *cur =
-                               &udv->cursors[i];
+                       getnc_state->min_usn = req10->highwatermark.highest_usn;
+                       for (i = 0; i < udv->count; i++) {
+                               bool match;
+                               const struct drsuapi_DsReplicaCursor *cur =
+                                       &udv->cursors[i];
 
-                       match = GUID_equal(&invocation_id,
-                                          &cur->source_dsa_invocation_id);
-                       if (!match) {
-                               continue;
-                       }
-                       if (cur->highest_usn > getnc_state->min_usn) {
-                               getnc_state->min_usn = cur->highest_usn;
+                               match = GUID_equal(&invocation_id,
+                                                  &cur->source_dsa_invocation_id);
+                               if (!match) {
+                                       continue;
+                               }
+                               if (cur->highest_usn > getnc_state->min_usn) {
+                                       getnc_state->min_usn = cur->highest_usn;
+                               }
+                               break;
                        }
-                       break;
+               } else {
+                       /* We do not want REPL_SECRETS or REPL_SINGLE to return empty-handed */
+                       udv = &empty_udv;
+                       getnc_state->min_usn = 0;
                }
+
                getnc_state->max_usn = getnc_state->min_usn;
 
                getnc_state->final_udv = talloc_zero(getnc_state,