source4/dsdb/kcc/kcc_periodic.c

   1 /*
   2    Unix SMB/CIFS mplementation.
   3    KCC service periodic handling
   4
   5    Copyright (C) Andrew Tridgell 2009
   6    based on repl service code
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20
  21 */
  22
  23 #include "includes.h"
  24 #include "lib/events/events.h"
  25 #include "dsdb/samdb/samdb.h"
  26 #include "auth/auth.h"
  27 #include "smbd/service.h"
  28 #include "lib/messaging/irpc.h"
  29 #include "dsdb/kcc/kcc_connection.h"
  30 #include "dsdb/kcc/kcc_service.h"
  31 #include "lib/ldb/include/ldb_errors.h"
  32 #include "../lib/util/dlinklist.h"
  33 #include "librpc/gen_ndr/ndr_misc.h"
  34 #include "librpc/gen_ndr/ndr_drsuapi.h"
  35 #include "librpc/gen_ndr/ndr_drsblobs.h"
  36 #include "librpc/gen_ndr/ndr_irpc_c.h"
  37 #include "param/param.h"
  38
  39 /*
  40  * see if two repsFromToBlob blobs are for the same source DSA
  41  */
  42 static bool kccsrv_same_source_dsa(struct repsFromToBlob *r1, struct repsFromToBlob *r2)
  43 {
  44         return GUID_compare(&r1->ctr.ctr1.source_dsa_obj_guid,
  45                             &r2->ctr.ctr1.source_dsa_obj_guid) == 0;
  46 }
  47
  48 /*
  49  * see if a repsFromToBlob is in a list
  50  */
  51 static bool reps_in_list(struct repsFromToBlob *r, struct repsFromToBlob *reps, uint32_t count)
  52 {
  53         uint32_t i;
  54         for (i=0; i<count; i++) {
  55                 if (kccsrv_same_source_dsa(r, &reps[i])) {
  56                         return true;
  57                 }
  58         }
  59         return false;
  60 }
  61
  62 /*
  63   make sure we only add repsFrom entries for DCs who are masters for
  64   the partition
  65  */
  66 static bool check_MasterNC(struct kccsrv_partition *p, struct repsFromToBlob *r,
  67                            struct ldb_result *res)
  68 {
  69         struct repsFromTo1 *r1 = &r->ctr.ctr1;
  70         struct GUID invocation_id = r1->source_dsa_invocation_id;
  71         unsigned int i, j;
  72
  73         /* we are expecting only version 1 */
  74         SMB_ASSERT(r->version == 1);
  75
  76         for (i=0; i<res->count; i++) {
  77                 struct ldb_message *msg = res->msgs[i];
  78                 struct ldb_message_element *el;
  79                 struct ldb_dn *dn;
  80
  81                 struct GUID id2 = samdb_result_guid(msg, "invocationID");
  82                 if (GUID_all_zero(&id2) ||
  83                     !GUID_equal(&invocation_id, &id2)) {
  84                         continue;
  85                 }
  86
  87                 el = ldb_msg_find_element(msg, "hasMasterNCs");
  88                 if (!el || el->num_values == 0) {
  89                         continue;
  90                 }
  91                 for (j=0; j<el->num_values; j++) {
  92                         dn = ldb_dn_from_ldb_val(p, p->service->samdb, &el->values[j]);
  93                         if (!ldb_dn_validate(dn)) {
  94                                 talloc_free(dn);
  95                                 continue;
  96                         }
  97                         if (ldb_dn_compare(dn, p->dn) == 0) {
  98                                 talloc_free(dn);
  99                                 DEBUG(5,("%s hasMasterNCs match on %s in %s\n",
 100                                          r1->other_info->dns_name, ldb_dn_get_linearized(dn),
 101                                          ldb_dn_get_linearized(msg->dn)));
 102                                 return true;
 103                         }
 104                         talloc_free(dn);
 105                 }
 106         }
 107         return false;
 108 }
 109
 110 struct kccsrv_notify_drepl_server_state {
 111         struct dreplsrv_refresh r;
 112 };
 113
 114 static void kccsrv_notify_drepl_server_done(struct tevent_req *subreq);
 115
 116 /**
 117  * Force dreplsrv to update its state as topology is changed
 118  */
 119 static void kccsrv_notify_drepl_server(struct kccsrv_service *s,
 120                                        TALLOC_CTX *mem_ctx)
 121 {
 122         struct kccsrv_notify_drepl_server_state *state;
 123         struct dcerpc_binding_handle *irpc_handle;
 124         struct tevent_req *subreq;
 125
 126         state = talloc_zero(s, struct kccsrv_notify_drepl_server_state);
 127         if (state == NULL) {
 128                 return;
 129         }
 130
 131         irpc_handle = irpc_binding_handle_by_name(state, s->task->msg_ctx,
 132                                                   "dreplsrv", &ndr_table_irpc);
 133         if (irpc_handle == NULL) {
 134                 /* dreplsrv is not running yet */
 135                 TALLOC_FREE(state);
 136                 return;
 137         }
 138
 139         subreq = dcerpc_dreplsrv_refresh_r_send(state, s->task->event_ctx,
 140                                                 irpc_handle, &state->r);
 141         if (subreq == NULL) {
 142                 TALLOC_FREE(state);
 143                 return;
 144         }
 145         tevent_req_set_callback(subreq, kccsrv_notify_drepl_server_done, state);
 146 }
 147
 148 static void kccsrv_notify_drepl_server_done(struct tevent_req *subreq)
 149 {
 150         struct kccsrv_notify_drepl_server_state *state =
 151                 tevent_req_callback_data(subreq,
 152                 struct kccsrv_notify_drepl_server_state);
 153         NTSTATUS status;
 154
 155         status = dcerpc_dreplsrv_refresh_r_recv(subreq, state);
 156         TALLOC_FREE(subreq);
 157
 158         /* we don't care about errors */
 159         TALLOC_FREE(state);
 160 }
 161
 162 static uint32_t kccsrv_replica_flags(struct kccsrv_service *s)
 163 {
 164         if (s->am_rodc) {
 165                 return DRSUAPI_DRS_INIT_SYNC |
 166                         DRSUAPI_DRS_PER_SYNC |
 167                         DRSUAPI_DRS_ADD_REF |
 168                         DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING |
 169                         DRSUAPI_DRS_NONGC_RO_REP;
 170         }
 171         return DRSUAPI_DRS_INIT_SYNC |
 172                 DRSUAPI_DRS_PER_SYNC |
 173                 DRSUAPI_DRS_ADD_REF |
 174                 DRSUAPI_DRS_WRIT_REP;
 175 }
 176
 177 /*
 178  * add any missing repsFrom structures to our partitions
 179  */
 180 static NTSTATUS kccsrv_add_repsFrom(struct kccsrv_service *s, TALLOC_CTX *mem_ctx,
 181                                     struct repsFromToBlob *reps, uint32_t count,
 182                                     struct ldb_result *res)
 183 {
 184         struct kccsrv_partition *p;
 185         bool notify_dreplsrv = false;
 186         uint32_t replica_flags = kccsrv_replica_flags(s);
 187
 188         /* update the repsFrom on all partitions */
 189         for (p=s->partitions; p; p=p->next) {
 190                 struct repsFromToBlob *our_reps;
 191                 uint32_t our_count;
 192                 WERROR werr;
 193                 uint32_t i, j;
 194                 bool modified = false;
 195
 196                 werr = dsdb_loadreps(s->samdb, mem_ctx, p->dn, "repsFrom", &our_reps, &our_count);
 197                 if (!W_ERROR_IS_OK(werr)) {
 198                         DEBUG(0,(__location__ ": Failed to load repsFrom from %s - %s\n",
 199                                  ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
 200                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 201                 }
 202
 203                 /* see if the entry already exists */
 204                 for (i=0; i<count; i++) {
 205                         for (j=0; j<our_count; j++) {
 206                                 if (kccsrv_same_source_dsa(&reps[i], &our_reps[j])) {
 207                                         /* we already have this one -
 208                                            check the replica_flags are right */
 209                                         if (replica_flags != our_reps[j].ctr.ctr1.replica_flags) {
 210                                                 /* we need to update the old one with
 211                                                  * the new flags
 212                                                  */
 213                                                 our_reps[j].ctr.ctr1.replica_flags = replica_flags;
 214                                                 modified = true;
 215                                         }
 216                                         break;
 217                                 }
 218                         }
 219                         if (j == our_count) {
 220                                 /* we don't have the new one - add it
 221                                  * if it is a master
 222                                  */
 223                                 if (!check_MasterNC(p, &reps[i], res)) {
 224                                         /* its not a master, we don't
 225                                            want to pull from it */
 226                                         continue;
 227                                 }
 228                                 /* we need to add it to our repsFrom */
 229                                 our_reps = talloc_realloc(mem_ctx, our_reps, struct repsFromToBlob, our_count+1);
 230                                 NT_STATUS_HAVE_NO_MEMORY(our_reps);
 231                                 our_reps[our_count] = reps[i];
 232                                 our_reps[our_count].ctr.ctr1.replica_flags = replica_flags;
 233                                 our_count++;
 234                                 modified = true;
 235                                 DEBUG(4,(__location__ ": Added repsFrom for %s\n",
 236                                          reps[i].ctr.ctr1.other_info->dns_name));
 237                         }
 238                 }
 239
 240                 /* remove any stale ones */
 241                 for (i=0; i<our_count; i++) {
 242                         if (!reps_in_list(&our_reps[i], reps, count) ||
 243                             !check_MasterNC(p, &our_reps[i], res)) {
 244                                 DEBUG(4,(__location__ ": Removed repsFrom for %s\n",
 245                                          our_reps[i].ctr.ctr1.other_info->dns_name));
 246                                 memmove(&our_reps[i], &our_reps[i+1], (our_count-(i+1))*sizeof(our_reps[0]));
 247                                 our_count--;
 248                                 i--;
 249                                 modified = true;
 250                         }
 251                 }
 252
 253                 if (modified) {
 254                         werr = dsdb_savereps(s->samdb, mem_ctx, p->dn, "repsFrom", our_reps, our_count);
 255                         if (!W_ERROR_IS_OK(werr)) {
 256                                 DEBUG(0,(__location__ ": Failed to save repsFrom to %s - %s\n",
 257                                          ldb_dn_get_linearized(p->dn), ldb_errstring(s->samdb)));
 258                                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 259                         }
 260                         /* dreplsrv should refresh its state */
 261                         notify_dreplsrv = true;
 262                 }
 263         }
 264
 265         /* notify dreplsrv toplogy has changed */
 266         if (notify_dreplsrv) {
 267                 kccsrv_notify_drepl_server(s, mem_ctx);
 268         }
 269
 270         return NT_STATUS_OK;
 271
 272 }
 273
 274 /*
 275   this is the core of our initial simple KCC
 276   We just add a repsFrom entry for all DCs we find that have nTDSDSA
 277   objects, except for ourselves
 278  */
 279 NTSTATUS kccsrv_simple_update(struct kccsrv_service *s, TALLOC_CTX *mem_ctx)
 280 {
 281         struct ldb_result *res;
 282         unsigned int i;
 283         int ret;
 284         const char *attrs[] = { "objectGUID", "invocationID", "hasMasterNCs", NULL };
 285         struct repsFromToBlob *reps = NULL;
 286         uint32_t count = 0;
 287         struct kcc_connection_list *ntds_conn, *dsa_conn;
 288
 289         ret = ldb_search(s->samdb, mem_ctx, &res, s->config_dn, LDB_SCOPE_SUBTREE,
 290                          attrs, "objectClass=nTDSDSA");
 291         if (ret != LDB_SUCCESS) {
 292                 DEBUG(0,(__location__ ": Failed nTDSDSA search - %s\n", ldb_errstring(s->samdb)));
 293                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 294         }
 295
 296         /* get the current list of connections */
 297         ntds_conn = kccsrv_find_connections(s, mem_ctx);
 298
 299         dsa_conn = talloc_zero(mem_ctx, struct kcc_connection_list);
 300
 301         for (i=0; i<res->count; i++) {
 302                 struct repsFromTo1 *r1;
 303                 struct GUID ntds_guid, invocation_id;
 304
 305                 ntds_guid = samdb_result_guid(res->msgs[i], "objectGUID");
 306                 if (GUID_compare(&ntds_guid, &s->ntds_guid) == 0) {
 307                         /* don't replicate with ourselves */
 308                         continue;
 309                 }
 310
 311                 invocation_id = samdb_result_guid(res->msgs[i], "invocationID");
 312
 313                 reps = talloc_realloc(mem_ctx, reps, struct repsFromToBlob, count+1);
 314                 NT_STATUS_HAVE_NO_MEMORY(reps);
 315
 316                 ZERO_STRUCT(reps[count]);
 317                 reps[count].version = 1;
 318                 r1 = &reps[count].ctr.ctr1;
 319
 320                 r1->other_info               = talloc_zero(reps, struct repsFromTo1OtherInfo);
 321                 r1->other_info->dns_name     = talloc_asprintf(r1->other_info, "%s._msdcs.%s",
 322                                                                GUID_string(mem_ctx, &ntds_guid),
 323                                                                lpcfg_dnsdomain(s->task->lp_ctx));
 324                 r1->source_dsa_obj_guid      = ntds_guid;
 325                 r1->source_dsa_invocation_id = invocation_id;
 326                 r1->replica_flags = kccsrv_replica_flags(s);
 327                 memset(r1->schedule, 0x11, sizeof(r1->schedule));
 328
 329                 dsa_conn->servers = talloc_realloc(dsa_conn, dsa_conn->servers,
 330                                                   struct kcc_connection,
 331                                                   dsa_conn->count + 1);
 332                 NT_STATUS_HAVE_NO_MEMORY(dsa_conn->servers);
 333                 dsa_conn->servers[dsa_conn->count].dsa_guid = r1->source_dsa_obj_guid;
 334                 dsa_conn->count++;
 335
 336                 count++;
 337         }
 338
 339         kccsrv_apply_connections(s, ntds_conn, dsa_conn);
 340
 341         return kccsrv_add_repsFrom(s, mem_ctx, reps, count, res);
 342 }
 343
 344
 345 static void kccsrv_periodic_run(struct kccsrv_service *service);
 346
 347 static void kccsrv_periodic_handler_te(struct tevent_context *ev, struct tevent_timer *te,
 348                                          struct timeval t, void *ptr)
 349 {
 350         struct kccsrv_service *service = talloc_get_type(ptr, struct kccsrv_service);
 351         WERROR status;
 352
 353         service->periodic.te = NULL;
 354
 355         kccsrv_periodic_run(service);
 356
 357         status = kccsrv_periodic_schedule(service, service->periodic.interval);
 358         if (!W_ERROR_IS_OK(status)) {
 359                 task_server_terminate(service->task, win_errstr(status), true);
 360                 return;
 361         }
 362 }
 363
 364 WERROR kccsrv_periodic_schedule(struct kccsrv_service *service, uint32_t next_interval)
 365 {
 366         TALLOC_CTX *tmp_mem;
 367         struct tevent_timer *new_te;
 368         struct timeval next_time;
 369
 370         /* prevent looping */
 371         if (next_interval == 0) next_interval = 1;
 372
 373         next_time = timeval_current_ofs(next_interval, 50);
 374
 375         if (service->periodic.te) {
 376                 /*
 377                  * if the timestamp of the new event is higher,
 378                  * as current next we don't need to reschedule
 379                  */
 380                 if (timeval_compare(&next_time, &service->periodic.next_event) > 0) {
 381                         return WERR_OK;
 382                 }
 383         }
 384
 385         /* reset the next scheduled timestamp */
 386         service->periodic.next_event = next_time;
 387
 388         new_te = event_add_timed(service->task->event_ctx, service,
 389                                  service->periodic.next_event,
 390                                  kccsrv_periodic_handler_te, service);
 391         W_ERROR_HAVE_NO_MEMORY(new_te);
 392
 393         tmp_mem = talloc_new(service);
 394         DEBUG(2,("kccsrv_periodic_schedule(%u) %sscheduled for: %s\n",
 395                 next_interval,
 396                 (service->periodic.te?"re":""),
 397                 nt_time_string(tmp_mem, timeval_to_nttime(&next_time))));
 398         talloc_free(tmp_mem);
 399
 400         talloc_free(service->periodic.te);
 401         service->periodic.te = new_te;
 402
 403         return WERR_OK;
 404 }
 405
 406 static void kccsrv_periodic_run(struct kccsrv_service *service)
 407 {
 408         TALLOC_CTX *mem_ctx;
 409         NTSTATUS status;
 410
 411         DEBUG(2,("kccsrv_periodic_run(): simple update\n"));
 412
 413         mem_ctx = talloc_new(service);
 414         status = kccsrv_simple_update(service, mem_ctx);
 415         if (!NT_STATUS_IS_OK(status)) {
 416                 DEBUG(0,("kccsrv_simple_update failed - %s\n", nt_errstr(status)));
 417         }
 418
 419         status = kccsrv_check_deleted(service, mem_ctx);
 420         if (!NT_STATUS_IS_OK(status)) {
 421                 DEBUG(0,("kccsrv_check_deleted failed - %s\n", nt_errstr(status)));
 422         }
 423         talloc_free(mem_ctx);
 424 }