source4/rpc_server/drsuapi/updaterefs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    implement the DRSUpdateRefs call
   5
   6    Copyright (C) Andrew Tridgell 2009
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "rpc_server/dcerpc_server.h"
  24 #include "dsdb/samdb/samdb.h"
  25 #include "libcli/security/security.h"
  26 #include "libcli/security/session.h"
  27 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  28 #include "auth/session.h"
  29 #include "librpc/gen_ndr/ndr_drsuapi.h"
  30
  31 struct repsTo {
  32         uint32_t count;
  33         struct repsFromToBlob *r;
  34 };
  35
  36 /*
  37   add a replication destination for a given partition GUID
  38  */
  39 static WERROR uref_add_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
  40                             struct ldb_dn *dn, struct repsFromTo1 *dest,
  41                             uint32_t options)
  42 {
  43         struct repsTo reps;
  44         WERROR werr;
  45         unsigned int i;
  46
  47         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
  48         if (!W_ERROR_IS_OK(werr)) {
  49                 return werr;
  50         }
  51
  52         for (i=0; i<reps.count; i++) {
  53                 if (GUID_compare(&dest->source_dsa_obj_guid,
  54                                  &reps.r[i].ctr.ctr1.source_dsa_obj_guid) == 0) {
  55                         if (options & DRSUAPI_DRS_GETCHG_CHECK) {
  56                                 return WERR_OK;
  57                         } else {
  58                                 return WERR_DS_DRA_REF_ALREADY_EXISTS;
  59                         }
  60                 }
  61         }
  62
  63         reps.r = talloc_realloc(mem_ctx, reps.r, struct repsFromToBlob, reps.count+1);
  64         if (reps.r == NULL) {
  65                 return WERR_DS_DRA_INTERNAL_ERROR;
  66         }
  67         ZERO_STRUCT(reps.r[reps.count]);
  68         reps.r[reps.count].version = 1;
  69         reps.r[reps.count].ctr.ctr1 = *dest;
  70         /* add the GCSPN flag if the client asked for it */
  71         reps.r[reps.count].ctr.ctr1.replica_flags |= (options & DRSUAPI_DRS_REF_GCSPN);
  72         reps.count++;
  73
  74         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
  75         if (!W_ERROR_IS_OK(werr)) {
  76                 return werr;
  77         }
  78
  79         return WERR_OK;
  80 }
  81
  82 /*
  83   delete a replication destination for a given partition GUID
  84  */
  85 static WERROR uref_del_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
  86                             struct ldb_dn *dn, struct GUID *dest_guid,
  87                             uint32_t options)
  88 {
  89         struct repsTo reps;
  90         WERROR werr;
  91         unsigned int i;
  92         bool found = false;
  93
  94         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
  95         if (!W_ERROR_IS_OK(werr)) {
  96                 return werr;
  97         }
  98
  99         for (i=0; i<reps.count; i++) {
 100                 if (GUID_compare(dest_guid, &reps.r[i].ctr.ctr1.source_dsa_obj_guid) == 0) {
 101                         if (i+1 < reps.count) {
 102                                 memmove(&reps.r[i], &reps.r[i+1], sizeof(reps.r[i])*(reps.count-(i+1)));
 103                         }
 104                         reps.count--;
 105                         found = true;
 106                 }
 107         }
 108
 109         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
 110         if (!W_ERROR_IS_OK(werr)) {
 111                 return werr;
 112         }
 113
 114         if (!found &&
 115             !(options & DRSUAPI_DRS_GETCHG_CHECK) &&
 116             !(options & DRSUAPI_DRS_ADD_REF)) {
 117                 return WERR_DS_DRA_REF_NOT_FOUND;
 118         }
 119
 120         return WERR_OK;
 121 }
 122
 123 /**
 124  * @brief Update the references for the given NC and the destination DSA object
 125  *
 126  * This function is callable from non RPC functions (ie. getncchanges), it
 127  * will validate the request to update reference and then will add/del a repsTo
 128  * to the specified server referenced by its DSA GUID in the request.
 129  *
 130  * @param[in]       b_state          A bind_state object
 131  *
 132  * @param[in]       mem_ctx          A talloc context for memory allocation
 133  *
 134  * @param[in]       req              A drsuapi_DsReplicaUpdateRefsRequest1
 135  *                                   object which NC, which server and which
 136  *                                   action (add/delete) should be performed
 137  *
 138  * @return                           WERR_OK is success, different error
 139  *                                   otherwise.
 140  */
 141 WERROR drsuapi_UpdateRefs(struct drsuapi_bind_state *b_state, TALLOC_CTX *mem_ctx,
 142                           struct drsuapi_DsReplicaUpdateRefsRequest1 *req)
 143 {
 144         WERROR werr;
 145         int ret;
 146         struct ldb_dn *dn;
 147         struct ldb_dn *nc_root;
 148         struct ldb_context *sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
 149
 150         dn = drs_ObjectIdentifier_to_dn(mem_ctx, sam_ctx, req->naming_context);
 151         W_ERROR_HAVE_NO_MEMORY(dn);
 152
 153         DEBUG(4,("DsReplicaUpdateRefs for host '%s' with GUID %s options 0x%08x nc=%s\n",
 154                  req->dest_dsa_dns_name, GUID_string(mem_ctx, &req->dest_dsa_guid),
 155                  req->options,
 156                  ldb_dn_get_extended_linearized(dn)));
 157
 158         /*
 159          * 4.1.26.2 Server Behavior of the IDL_DRSUpdateRefs Method
 160          * Implements the input validation checks
 161          */
 162         if (GUID_all_zero(&req->dest_dsa_guid)) {
 163                 return WERR_DS_DRA_INVALID_PARAMETER;
 164         }
 165
 166         /* FIXME it seems that we should check the length of the stuff too*/
 167         if (req->dest_dsa_dns_name == NULL) {
 168                 return WERR_DS_DRA_INVALID_PARAMETER;
 169         }
 170
 171         if (!(req->options & (DRSUAPI_DRS_DEL_REF|DRSUAPI_DRS_ADD_REF))) {
 172                 return WERR_DS_DRA_INVALID_PARAMETER;
 173         }
 174
 175         ret = dsdb_find_nc_root(sam_ctx, dn, dn, &nc_root);
 176         if (ret != LDB_SUCCESS) {
 177                 DEBUG(2, ("Didn't find a nc for %s\n", ldb_dn_get_linearized(dn)));
 178                 return WERR_DS_DRA_BAD_NC;
 179         }
 180         if (ldb_dn_compare(dn, nc_root) != 0) {
 181                 DEBUG(2, ("dn %s is not equal to %s\n", ldb_dn_get_linearized(dn), ldb_dn_get_linearized(nc_root)));
 182                 return WERR_DS_DRA_BAD_NC;
 183         }
 184
 185         if (ldb_transaction_start(sam_ctx) != LDB_SUCCESS) {
 186                 DEBUG(0,(__location__ ": Failed to start transaction on samdb: %s\n",
 187                          ldb_errstring(sam_ctx)));
 188                 return WERR_DS_DRA_INTERNAL_ERROR;
 189         }
 190
 191         if (req->options & DRSUAPI_DRS_DEL_REF) {
 192                 werr = uref_del_dest(sam_ctx, mem_ctx, dn, &req->dest_dsa_guid, req->options);
 193                 if (!W_ERROR_IS_OK(werr)) {
 194                         DEBUG(0,("Failed to delete repsTo for %s: %s\n",
 195                                  GUID_string(mem_ctx, &req->dest_dsa_guid),
 196                                  win_errstr(werr)));
 197                         goto failed;
 198                 }
 199         }
 200
 201         if (req->options & DRSUAPI_DRS_ADD_REF) {
 202                 struct repsFromTo1 dest;
 203                 struct repsFromTo1OtherInfo oi;
 204
 205                 ZERO_STRUCT(dest);
 206                 ZERO_STRUCT(oi);
 207
 208                 oi.dns_name = req->dest_dsa_dns_name;
 209                 dest.other_info          = &oi;
 210                 dest.source_dsa_obj_guid = req->dest_dsa_guid;
 211                 dest.replica_flags       = req->options;
 212
 213                 werr = uref_add_dest(sam_ctx, mem_ctx, dn, &dest, req->options);
 214                 if (!W_ERROR_IS_OK(werr)) {
 215                         DEBUG(0,("Failed to add repsTo for %s: %s\n",
 216                                  GUID_string(mem_ctx, &dest.source_dsa_obj_guid),
 217                                  win_errstr(werr)));
 218                         goto failed;
 219                 }
 220         }
 221
 222         if (ldb_transaction_commit(sam_ctx) != LDB_SUCCESS) {
 223                 DEBUG(0,(__location__ ": Failed to commit transaction on samdb: %s\n",
 224                          ldb_errstring(sam_ctx)));
 225                 return WERR_DS_DRA_INTERNAL_ERROR;
 226         }
 227
 228         return WERR_OK;
 229
 230 failed:
 231         ldb_transaction_cancel(sam_ctx);
 232         return werr;
 233 }
 234
 235 /*
 236   drsuapi_DsReplicaUpdateRefs
 237 */
 238 WERROR dcesrv_drsuapi_DsReplicaUpdateRefs(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 239                                           struct drsuapi_DsReplicaUpdateRefs *r)
 240 {
 241         struct dcesrv_handle *h;
 242         struct drsuapi_bind_state *b_state;
 243         struct drsuapi_DsReplicaUpdateRefsRequest1 *req;
 244         WERROR werr;
 245         int ret;
 246         enum security_user_level security_level;
 247
 248         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
 249         b_state = h->data;
 250
 251         if (r->in.level != 1) {
 252                 DEBUG(0,("DrReplicUpdateRefs - unsupported level %u\n", r->in.level));
 253                 return WERR_DS_DRA_INVALID_PARAMETER;
 254         }
 255         req = &r->in.req.req1;
 256         werr = drs_security_access_check(b_state->sam_ctx,
 257                                          mem_ctx,
 258                                          dce_call->conn->auth_state.session_info->security_token,
 259                                          req->naming_context,
 260                                          GUID_DRS_MANAGE_TOPOLOGY);
 261
 262         if (!W_ERROR_IS_OK(werr)) {
 263                 return werr;
 264         }
 265
 266         security_level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
 267         if (security_level < SECURITY_ADMINISTRATOR) {
 268                 /* check that they are using an DSA objectGUID that they own */
 269                 ret = dsdb_validate_dsa_guid(b_state->sam_ctx,
 270                                              &req->dest_dsa_guid,
 271                                              &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]);
 272                 if (ret != LDB_SUCCESS) {
 273                         DEBUG(0,(__location__ ": Refusing DsReplicaUpdateRefs for sid %s with GUID %s\n",
 274                                  dom_sid_string(mem_ctx,
 275                                                 &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]),
 276                                  GUID_string(mem_ctx, &req->dest_dsa_guid)));
 277                         return WERR_DS_DRA_ACCESS_DENIED;
 278                 }
 279         }
 280
 281         werr = drsuapi_UpdateRefs(b_state, mem_ctx, req);
 282
 283 #if 0
 284         NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsReplicaUpdateRefs, NDR_BOTH, r);
 285 #endif
 286
 287         return werr;
 288 }