s4-drepl: Refactor dreplsrv_run_pull_ops() to

1. Take into account DSA options - we should not send replication
   requests in case OUTBOUND_REPLICATION is disabled
2. Use replication flags for the operation to determine if
   a forced replication is requested
3. In case outbound replication is disabled and we don't have
   DRSUAPI_DRS_SYNC_FORCED flag set, then we should record
   WERR_DS_DRA_SINK_DISABLED error as a last replication result

1 files changed, 33 insertions, 16 deletions

diff --git a/source4/dsdb/repl/drepl_out_pull.c b/source4/dsdb/repl/drepl_out_pull.c
index 0c68cc9310..86b513d21d 100644
--- a/source4/dsdb/repl/drepl_out_pull.c
+++ b/source4/dsdb/repl/drepl_out_pull.c
@@ -178,6 +178,7 @@ void dreplsrv_run_pull_ops(struct dreplsrv_service *s)
 	time_t t;
 	NTTIME now;
 	struct tevent_req *subreq;
+	WERROR werr;
 
 	if (s->ops.current) {
 		/* if there's still one running, we're done */
@@ -198,24 +199,40 @@ void dreplsrv_run_pull_ops(struct dreplsrv_service *s)
 
 	op->source_dsa->repsFrom1->last_attempt = now;
 
-	subreq = dreplsrv_op_pull_source_send(op, s->task->event_ctx, op);
-	if (!subreq) {
-		struct repsFromTo1 *rf = op->source_dsa->repsFrom1;
-
-		if (op->extended_op == DRSUAPI_EXOP_NONE) {
-			drepl_reps_update(s, "repsFrom", op->source_dsa->partition->dn,
-					  &rf->source_dsa_obj_guid, WERR_NOMEM);
+	/* check if inbound replication is enabled */
+	if (!(op->options & DRSUAPI_DRS_SYNC_FORCED)) {
+		uint32_t rep_options;
+		if (samdb_ntds_options(op->service->samdb, &rep_options) != LDB_SUCCESS) {
+			werr = WERR_DS_DRA_INTERNAL_ERROR;
+			goto failed;
 		}
-		s->ops.current = NULL;
-
-		/*
-		 * call the callback (if any) so it gets the chance
-		 * to do its job just like in any other failure situation
-		 */
-		if (op->callback) {
-			op->callback(s, WERR_NOMEM, op->extended_ret, op->cb_data);
+
+		if ((rep_options & DS_NTDSDSA_OPT_DISABLE_INBOUND_REPL)) {
+			werr = WERR_DS_DRA_SINK_DISABLED;
+			goto failed;
 		}
-		return;
 	}
+
+	subreq = dreplsrv_op_pull_source_send(op, s->task->event_ctx, op);
+	if (!subreq) {
+		werr = WERR_NOMEM;
+		goto failed;
+	}
+
 	tevent_req_set_callback(subreq, dreplsrv_pending_op_callback, op);
+	return;
+
+failed:
+	if (op->extended_op == DRSUAPI_EXOP_NONE) {
+		drepl_reps_update(s, "repsFrom", op->source_dsa->partition->dn,
+				  &op->source_dsa->repsFrom1->source_dsa_obj_guid, werr);
+	}
+	/* unblock queue processing */
+	s->ops.current = NULL;
+	/*
+	 * let the callback do its job just like in any other failure situation
+	 */
+	if (op->callback) {
+		op->callback(s, werr, op->extended_ret, op->cb_data);
+	}
 }