source4/dsdb/kcc/kcc_service.c

   1 /*
   2    Unix SMB/CIFS mplementation.
   3
   4    KCC service
   5
   6    Copyright (C) Andrew Tridgell 2009
   7    based on repl service code
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21
  22 */
  23
  24 #include "includes.h"
  25 #include "dsdb/samdb/samdb.h"
  26 #include "auth/auth.h"
  27 #include "smbd/service.h"
  28 #include "lib/events/events.h"
  29 #include "lib/messaging/irpc.h"
  30 #include "dsdb/kcc/kcc_service.h"
  31 #include <ldb_errors.h>
  32 #include "../lib/util/dlinklist.h"
  33 #include "librpc/gen_ndr/ndr_misc.h"
  34 #include "librpc/gen_ndr/ndr_drsuapi.h"
  35 #include "librpc/gen_ndr/ndr_drsblobs.h"
  36 #include "param/param.h"
  37 #include "libds/common/roles.h"
  38
  39 /*
  40   establish system creds
  41  */
  42 static WERROR kccsrv_init_creds(struct kccsrv_service *service)
  43 {
  44         service->system_session_info = system_session(service->task->lp_ctx);
  45         if (!service->system_session_info) {
  46                 return WERR_NOT_ENOUGH_MEMORY;
  47         }
  48
  49         return WERR_OK;
  50 }
  51
  52 /*
  53   connect to the local SAM
  54  */
  55 static WERROR kccsrv_connect_samdb(struct kccsrv_service *service, struct loadparm_context *lp_ctx)
  56 {
  57         const struct GUID *ntds_guid;
  58
  59         service->samdb = samdb_connect(service, service->task->event_ctx, lp_ctx, service->system_session_info, 0);
  60         if (!service->samdb) {
  61                 return WERR_DS_UNAVAILABLE;
  62         }
  63
  64         ntds_guid = samdb_ntds_objectGUID(service->samdb);
  65         if (!ntds_guid) {
  66                 return WERR_DS_UNAVAILABLE;
  67         }
  68
  69         service->ntds_guid = *ntds_guid;
  70
  71         if (samdb_rodc(service->samdb, &service->am_rodc) != LDB_SUCCESS) {
  72                 DEBUG(0,(__location__ ": Failed to determine RODC status\n"));
  73                 return WERR_DS_UNAVAILABLE;
  74         }
  75
  76         return WERR_OK;
  77 }
  78
  79
  80 /*
  81   load our local partition list
  82  */
  83 static WERROR kccsrv_load_partitions(struct kccsrv_service *s)
  84 {
  85         struct ldb_dn *basedn;
  86         struct ldb_result *r;
  87         struct ldb_message_element *el;
  88         static const char *attrs[] = { "namingContexts", "configurationNamingContext", NULL };
  89         unsigned int i;
  90         int ret;
  91
  92         basedn = ldb_dn_new(s, s->samdb, NULL);
  93         W_ERROR_HAVE_NO_MEMORY(basedn);
  94
  95         ret = ldb_search(s->samdb, s, &r, basedn, LDB_SCOPE_BASE, attrs,
  96                          "(objectClass=*)");
  97         talloc_free(basedn);
  98         if (ret != LDB_SUCCESS) {
  99                 return WERR_FOOBAR;
 100         } else if (r->count != 1) {
 101                 talloc_free(r);
 102                 return WERR_FOOBAR;
 103         }
 104
 105         el = ldb_msg_find_element(r->msgs[0], "namingContexts");
 106         if (!el) {
 107                 return WERR_FOOBAR;
 108         }
 109
 110         for (i=0; i < el->num_values; i++) {
 111                 const char *v = (const char *)el->values[i].data;
 112                 struct ldb_dn *pdn;
 113                 struct dsdb_ldb_dn_list_node *p;
 114
 115                 pdn = ldb_dn_new(s, s->samdb, v);
 116                 if (!ldb_dn_validate(pdn)) {
 117                         return WERR_FOOBAR;
 118                 }
 119
 120                 p = talloc_zero(s, struct dsdb_ldb_dn_list_node);
 121                 W_ERROR_HAVE_NO_MEMORY(p);
 122
 123                 p->dn = talloc_steal(p, pdn);
 124
 125                 DLIST_ADD(s->partitions, p);
 126
 127                 DEBUG(2, ("kccsrv_partition[%s] loaded\n", v));
 128         }
 129
 130         el = ldb_msg_find_element(r->msgs[0], "configurationNamingContext");
 131         if (!el) {
 132                 return WERR_FOOBAR;
 133         }
 134         s->config_dn = ldb_dn_new(s, s->samdb, (const char *)el->values[0].data);
 135         if (!ldb_dn_validate(s->config_dn)) {
 136                 return WERR_FOOBAR;
 137         }
 138
 139         talloc_free(r);
 140
 141         return WERR_OK;
 142 }
 143
 144
 145 struct kcc_manual_runcmd_state {
 146         struct irpc_message *msg;
 147         struct drsuapi_DsExecuteKCC *r;
 148         struct kccsrv_service *service;
 149 };
 150
 151
 152 /*
 153  * Called when samba_kcc script has finished
 154  */
 155 static void manual_samba_kcc_done(struct tevent_req *subreq)
 156 {
 157         struct kcc_manual_runcmd_state *st =
 158                 tevent_req_callback_data(subreq,
 159                 struct kcc_manual_runcmd_state);
 160         int rc;
 161         int sys_errno;
 162         NTSTATUS status;
 163
 164         st->service->periodic.subreq = NULL;
 165
 166         rc = samba_runcmd_recv(subreq, &sys_errno);
 167         TALLOC_FREE(subreq);
 168
 169         if (rc != 0) {
 170                 status = map_nt_error_from_unix_common(sys_errno);
 171         } else {
 172                 status = NT_STATUS_OK;
 173         }
 174
 175         if (!NT_STATUS_IS_OK(status)) {
 176                 DEBUG(0,(__location__ ": Failed manual run of samba_kcc - %s\n",
 177                         nt_errstr(status)));
 178         } else {
 179                 DEBUG(3,("Completed manual run of samba_kcc OK\n"));
 180         }
 181
 182         if (!(st->r->in.req->ctr1.flags & DRSUAPI_DS_EXECUTE_KCC_ASYNCHRONOUS_OPERATION)) {
 183                 irpc_send_reply(st->msg, status);
 184         }
 185 }
 186
 187 static NTSTATUS kccsrv_execute_kcc(struct irpc_message *msg, struct drsuapi_DsExecuteKCC *r)
 188 {
 189         TALLOC_CTX *mem_ctx;
 190         NTSTATUS status = NT_STATUS_OK;
 191         struct kccsrv_service *service = talloc_get_type(msg->private_data, struct kccsrv_service);
 192
 193         const char * const *samba_kcc_command;
 194         struct kcc_manual_runcmd_state *st;
 195
 196         if (!service->samba_kcc_code) {
 197                 mem_ctx = talloc_new(service);
 198
 199                 status = kccsrv_simple_update(service, mem_ctx);
 200                 if (!NT_STATUS_IS_OK(status)) {
 201                         DEBUG(0,("kccsrv_execute_kcc failed - %s\n",
 202                                 nt_errstr(status)));
 203                 }
 204                 talloc_free(mem_ctx);
 205
 206                 return NT_STATUS_OK;
 207         }
 208
 209         /* Invocation of the samba_kcc python script for replication
 210          * topology generation.
 211          */
 212
 213         samba_kcc_command =
 214                 lpcfg_samba_kcc_command(service->task->lp_ctx);
 215
 216         st = talloc(msg, struct kcc_manual_runcmd_state);
 217         if (st == NULL) {
 218                 return NT_STATUS_NO_MEMORY;
 219         }
 220
 221         st->msg = msg;
 222         st->r = r;
 223         st->service = service;
 224
 225         /* don't run at the same time as an existing child */
 226         if (service->periodic.subreq) {
 227                 status = NT_STATUS_DS_BUSY;
 228                 return status;
 229         }
 230
 231         DEBUG(2, ("Calling samba_kcc script\n"));
 232         service->periodic.subreq = samba_runcmd_send(service,
 233                                                      service->task->event_ctx,
 234                                                      timeval_current_ofs(40, 0),
 235                                                      2, 0, samba_kcc_command, NULL);
 236
 237         if (service->periodic.subreq == NULL) {
 238                 status = NT_STATUS_NO_MEMORY;
 239                 DEBUG(0,(__location__ ": failed - %s\n", nt_errstr(status)));
 240                 return status;
 241         } else {
 242                 tevent_req_set_callback(service->periodic.subreq,
 243                                         manual_samba_kcc_done, st);
 244         }
 245
 246         if (r->in.req->ctr1.flags & DRSUAPI_DS_EXECUTE_KCC_ASYNCHRONOUS_OPERATION) {
 247                 /* This actually means reply right away, let it run in the background */
 248         } else {
 249                 /* mark the request as replied async, the caller wants to know when this is finished */
 250                 msg->defer_reply = true;
 251         }
 252         return status;
 253
 254 }
 255
 256 static NTSTATUS kccsrv_replica_get_info(struct irpc_message *msg, struct drsuapi_DsReplicaGetInfo *r)
 257 {
 258         return kccdrs_replica_get_info(msg, r);
 259 }
 260
 261 /*
 262   startup the kcc service task
 263 */
 264 static void kccsrv_task_init(struct task_server *task)
 265 {
 266         WERROR status;
 267         struct kccsrv_service *service;
 268         uint32_t periodic_startup_interval;
 269
 270         switch (lpcfg_server_role(task->lp_ctx)) {
 271         case ROLE_STANDALONE:
 272                 task_server_terminate(task, "kccsrv: no KCC required in standalone configuration", false);
 273                 return;
 274         case ROLE_DOMAIN_MEMBER:
 275                 task_server_terminate(task, "kccsrv: no KCC required in domain member configuration", false);
 276                 return;
 277         case ROLE_ACTIVE_DIRECTORY_DC:
 278                 /* Yes, we want a KCC */
 279                 break;
 280         }
 281
 282         task_server_set_title(task, "task[kccsrv]");
 283
 284         service = talloc_zero(task, struct kccsrv_service);
 285         if (!service) {
 286                 task_server_terminate(task, "kccsrv_task_init: out of memory", true);
 287                 return;
 288         }
 289         service->task           = task;
 290         service->startup_time   = timeval_current();
 291         task->private_data      = service;
 292
 293         status = kccsrv_init_creds(service);
 294         if (!W_ERROR_IS_OK(status)) {
 295                 task_server_terminate(task,
 296                                       talloc_asprintf(task,
 297                                                       "kccsrv: Failed to obtain server credentials: %s\n",
 298                                                       win_errstr(status)), true);
 299                 return;
 300         }
 301
 302         status = kccsrv_connect_samdb(service, task->lp_ctx);
 303         if (!W_ERROR_IS_OK(status)) {
 304                 task_server_terminate(task, talloc_asprintf(task,
 305                                       "kccsrv: Failed to connect to local samdb: %s\n",
 306                                                             win_errstr(status)), true);
 307                 return;
 308         }
 309
 310         status = kccsrv_load_partitions(service);
 311         if (!W_ERROR_IS_OK(status)) {
 312                 task_server_terminate(task, talloc_asprintf(task,
 313                                       "kccsrv: Failed to load partitions: %s\n",
 314                                                             win_errstr(status)), true);
 315                 return;
 316         }
 317
 318         periodic_startup_interval =
 319                 lpcfg_parm_int(task->lp_ctx, NULL, "kccsrv",
 320                               "periodic_startup_interval", 15); /* in seconds */
 321         service->periodic.interval =
 322                 lpcfg_parm_int(task->lp_ctx, NULL, "kccsrv",
 323                               "periodic_interval", 300); /* in seconds */
 324
 325         /* (kccsrv:samba_kcc=true) will run newer samba_kcc replication
 326          * topology generation code.
 327          */
 328         service->samba_kcc_code = lpcfg_parm_bool(task->lp_ctx, NULL,
 329                                                 "kccsrv", "samba_kcc", true);
 330
 331         status = kccsrv_periodic_schedule(service, periodic_startup_interval);
 332         if (!W_ERROR_IS_OK(status)) {
 333                 task_server_terminate(task, talloc_asprintf(task,
 334                                       "kccsrv: Failed to periodic schedule: %s\n",
 335                                                             win_errstr(status)), true);
 336                 return;
 337         }
 338
 339         irpc_add_name(task->msg_ctx, "kccsrv");
 340
 341         IRPC_REGISTER(task->msg_ctx, drsuapi, DRSUAPI_DSEXECUTEKCC, kccsrv_execute_kcc, service);
 342         IRPC_REGISTER(task->msg_ctx, drsuapi, DRSUAPI_DSREPLICAGETINFO, kccsrv_replica_get_info, service);
 343 }
 344
 345 /*
 346   register ourselves as a available server
 347 */
 348 NTSTATUS server_service_kcc_init(TALLOC_CTX *ctx)
 349 {
 350         struct service_details details = {
 351                 .inhibit_fork_on_accept = true,
 352                 .inhibit_pre_fork = true
 353         };
 354         return register_server_service(ctx, "kcc", kccsrv_task_init, &details);
 355 }