s4:rpc_server/drsuapi: make use dcesrv_call_session_info()
[samba.git] / source4 / rpc_server / drsuapi / updaterefs.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    implement the DRSUpdateRefs call
5
6    Copyright (C) Andrew Tridgell 2009
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "rpc_server/dcerpc_server.h"
24 #include "dsdb/samdb/samdb.h"
25 #include "libcli/security/security.h"
26 #include "libcli/security/session.h"
27 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
28 #include "auth/session.h"
29 #include "librpc/gen_ndr/ndr_drsuapi.h"
30 #include "librpc/gen_ndr/ndr_irpc_c.h"
31 #include "lib/messaging/irpc.h"
32
33 #undef DBGC_CLASS
34 #define DBGC_CLASS            DBGC_DRS_REPL
35
36 struct repsTo {
37         uint32_t count;
38         struct repsFromToBlob *r;
39 };
40
41 static WERROR uref_check_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
42                               struct ldb_dn *dn, struct GUID *dest_guid,
43                               uint32_t options)
44 {
45         struct repsTo reps;
46         WERROR werr;
47         unsigned int i;
48         bool found = false;
49
50         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
51         if (!W_ERROR_IS_OK(werr)) {
52                 return werr;
53         }
54
55         for (i=0; i<reps.count; i++) {
56                 if (GUID_equal(dest_guid,
57                                &reps.r[i].ctr.ctr1.source_dsa_obj_guid)) {
58                         found = true;
59                         break;
60                 }
61         }
62
63         if (options & DRSUAPI_DRS_ADD_REF) {
64                 if (found && !(options & DRSUAPI_DRS_DEL_REF)) {
65                         return WERR_DS_DRA_REF_ALREADY_EXISTS;
66                 }
67         }
68
69         if (options & DRSUAPI_DRS_DEL_REF) {
70                 if (!found && !(options & DRSUAPI_DRS_ADD_REF)) {
71                         return WERR_DS_DRA_REF_NOT_FOUND;
72                 }
73         }
74
75         return WERR_OK;
76 }
77
78 /*
79   add a replication destination for a given partition GUID
80  */
81 static WERROR uref_add_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, 
82                             struct ldb_dn *dn, struct repsFromTo1 *dest, 
83                             uint32_t options)
84 {
85         struct repsTo reps;
86         WERROR werr;
87         unsigned int i;
88
89         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
90         if (!W_ERROR_IS_OK(werr)) {
91                 return werr;
92         }
93
94         for (i=0; i<reps.count; i++) {
95                 if (GUID_equal(&dest->source_dsa_obj_guid,
96                                &reps.r[i].ctr.ctr1.source_dsa_obj_guid)) {
97                         if (options & DRSUAPI_DRS_GETCHG_CHECK) {
98                                 return WERR_OK;
99                         } else {
100                                 return WERR_DS_DRA_REF_ALREADY_EXISTS;
101                         }
102                 }
103         }
104
105         reps.r = talloc_realloc(mem_ctx, reps.r, struct repsFromToBlob, reps.count+1);
106         if (reps.r == NULL) {
107                 return WERR_DS_DRA_INTERNAL_ERROR;
108         }
109         ZERO_STRUCT(reps.r[reps.count]);
110         reps.r[reps.count].version = 1;
111         reps.r[reps.count].ctr.ctr1 = *dest;
112         /* add the GCSPN flag if the client asked for it */
113         reps.r[reps.count].ctr.ctr1.replica_flags |= (options & DRSUAPI_DRS_REF_GCSPN);
114         reps.count++;
115
116         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
117         if (!W_ERROR_IS_OK(werr)) {
118                 return werr;
119         }
120
121         return WERR_OK; 
122 }
123
124 /*
125   delete a replication destination for a given partition GUID
126  */
127 static WERROR uref_del_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, 
128                             struct ldb_dn *dn, struct GUID *dest_guid, 
129                             uint32_t options)
130 {
131         struct repsTo reps;
132         WERROR werr;
133         unsigned int i;
134         bool found = false;
135
136         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
137         if (!W_ERROR_IS_OK(werr)) {
138                 return werr;
139         }
140
141         for (i=0; i<reps.count; i++) {
142                 if (GUID_equal(dest_guid,
143                                &reps.r[i].ctr.ctr1.source_dsa_obj_guid)) {
144                         if (i+1 < reps.count) {
145                                 memmove(&reps.r[i], &reps.r[i+1], sizeof(reps.r[i])*(reps.count-(i+1)));
146                         }
147                         reps.count--;
148                         found = true;
149                 }
150         }
151
152         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
153         if (!W_ERROR_IS_OK(werr)) {
154                 return werr;
155         }
156
157         if (!found &&
158             !(options & DRSUAPI_DRS_GETCHG_CHECK) &&
159             !(options & DRSUAPI_DRS_ADD_REF)) {
160                 return WERR_DS_DRA_REF_NOT_FOUND;
161         }
162
163         return WERR_OK; 
164 }
165
166 struct drepl_refresh_state {
167         struct dreplsrv_refresh r;
168 };
169
170 /**
171  * @brief Update the references for the given NC and the destination DSA object
172  *
173  * This function is callable from non RPC functions (ie. getncchanges), it
174  * will validate the request to update reference and then will add/del a repsTo
175  * to the specified server referenced by its DSA GUID in the request.
176  *
177  * @param[in]       msg_ctx          Messaging context for sending partition
178  *                                   refresh in dreplsrv
179  *
180  * @param[in]       b_state          A bind_state object
181  *
182  * @param[in]       mem_ctx          A talloc context for memory allocation
183  *
184  * @param[in]       req              A drsuapi_DsReplicaUpdateRefsRequest1
185  *                                   object which NC, which server and which
186  *                                   action (add/delete) should be performed
187  *
188  * @return                           WERR_OK is success, different error
189  *                                   otherwise.
190  */
191 WERROR drsuapi_UpdateRefs(struct imessaging_context *msg_ctx,
192                           struct tevent_context *event_ctx,
193                           struct drsuapi_bind_state *b_state, TALLOC_CTX *mem_ctx,
194                           struct drsuapi_DsReplicaUpdateRefsRequest1 *req)
195 {
196         WERROR werr;
197         int ret;
198         struct ldb_dn *dn;
199         struct ldb_dn *nc_root;
200         struct ldb_context *sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
201         struct dcerpc_binding_handle *irpc_handle;
202         struct tevent_req *subreq;
203         struct drepl_refresh_state *state;
204
205
206         DEBUG(4,("DsReplicaUpdateRefs for host '%s' with GUID %s options 0x%08x nc=%s\n",
207                  req->dest_dsa_dns_name, GUID_string(mem_ctx, &req->dest_dsa_guid),
208                  req->options,
209                  drs_ObjectIdentifier_to_string(mem_ctx, req->naming_context)));
210
211         /*
212          * 4.1.26.2 Server Behavior of the IDL_DRSUpdateRefs Method
213          * Implements the input validation checks
214          */
215         if (GUID_all_zero(&req->dest_dsa_guid)) {
216                 return WERR_DS_DRA_INVALID_PARAMETER;
217         }
218
219         /* FIXME it seems that we should check the length of the stuff too*/
220         if (req->dest_dsa_dns_name == NULL) {
221                 return WERR_DS_DRA_INVALID_PARAMETER;
222         }
223
224         if (!(req->options & (DRSUAPI_DRS_DEL_REF|DRSUAPI_DRS_ADD_REF))) {
225                 return WERR_DS_DRA_INVALID_PARAMETER;
226         }
227
228         dn = drs_ObjectIdentifier_to_dn(mem_ctx, sam_ctx, req->naming_context);
229         W_ERROR_HAVE_NO_MEMORY(dn);
230         ret = dsdb_find_nc_root(sam_ctx, dn, dn, &nc_root);
231         if (ret != LDB_SUCCESS) {
232                 DEBUG(2, ("Didn't find a nc for %s\n", ldb_dn_get_linearized(dn)));
233                 return WERR_DS_DRA_BAD_NC;
234         }
235         if (ldb_dn_compare(dn, nc_root) != 0) {
236                 DEBUG(2, ("dn %s is not equal to %s\n", ldb_dn_get_linearized(dn), ldb_dn_get_linearized(nc_root)));
237                 return WERR_DS_DRA_BAD_NC;
238         }
239
240         /*
241          * First check without a transaction open.
242          *
243          * This means that in the usual case, it will never open it and never
244          * bother to refresh the dreplsrv.
245          */
246         werr = uref_check_dest(sam_ctx, mem_ctx, dn, &req->dest_dsa_guid,
247                                req->options);
248         if (W_ERROR_EQUAL(werr, WERR_DS_DRA_REF_ALREADY_EXISTS) ||
249             W_ERROR_EQUAL(werr, WERR_DS_DRA_REF_NOT_FOUND)) {
250                 if (req->options & DRSUAPI_DRS_GETCHG_CHECK) {
251                         return WERR_OK;
252                 }
253                 return werr;
254         }
255
256         if (ldb_transaction_start(sam_ctx) != LDB_SUCCESS) {
257                 DEBUG(0,(__location__ ": Failed to start transaction on samdb: %s\n",
258                          ldb_errstring(sam_ctx)));
259                 return WERR_DS_DRA_INTERNAL_ERROR;
260         }
261
262         if (req->options & DRSUAPI_DRS_DEL_REF) {
263                 werr = uref_del_dest(sam_ctx, mem_ctx, dn, &req->dest_dsa_guid, req->options);
264                 if (!W_ERROR_IS_OK(werr)) {
265                         DEBUG(0,("Failed to delete repsTo for %s: %s\n",
266                                  GUID_string(mem_ctx, &req->dest_dsa_guid),
267                                  win_errstr(werr)));
268                         goto failed;
269                 }
270         }
271
272         if (req->options & DRSUAPI_DRS_ADD_REF) {
273                 struct repsFromTo1 dest;
274                 struct repsFromTo1OtherInfo oi;
275
276                 ZERO_STRUCT(dest);
277                 ZERO_STRUCT(oi);
278
279                 oi.dns_name = req->dest_dsa_dns_name;
280                 dest.other_info          = &oi;
281                 dest.source_dsa_obj_guid = req->dest_dsa_guid;
282                 dest.replica_flags       = req->options;
283
284                 werr = uref_add_dest(sam_ctx, mem_ctx, dn, &dest, req->options);
285                 if (!W_ERROR_IS_OK(werr)) {
286                         DEBUG(0,("Failed to add repsTo for %s: %s\n",
287                                  GUID_string(mem_ctx, &dest.source_dsa_obj_guid),
288                                  win_errstr(werr)));
289                         goto failed;
290                 }
291         }
292
293         if (ldb_transaction_commit(sam_ctx) != LDB_SUCCESS) {
294                 DEBUG(0,(__location__ ": Failed to commit transaction on samdb: %s\n",
295                          ldb_errstring(sam_ctx)));
296                 return WERR_DS_DRA_INTERNAL_ERROR;
297         }
298
299         state = talloc_zero(mem_ctx, struct drepl_refresh_state);
300         if (state == NULL) {
301                 return WERR_OK;
302         }
303
304         irpc_handle = irpc_binding_handle_by_name(mem_ctx, msg_ctx,
305                                                   "dreplsrv", &ndr_table_irpc);
306         if (irpc_handle == NULL) {
307                 /* dreplsrv is not running yet */
308                 TALLOC_FREE(state);
309                 return WERR_OK;
310         }
311
312         /*
313          * [Taken from auth_sam_trigger_repl_secret in auth_sam.c]
314          *
315          * This seem to rely on the current IRPC implementation,
316          * which delivers the message in the _send function.
317          *
318          * TODO: we need a ONE_WAY IRPC handle and register
319          * a callback and wait for it to be triggered!
320          */
321         subreq = dcerpc_dreplsrv_refresh_r_send(state, event_ctx,
322                                                 irpc_handle, &state->r);
323         TALLOC_FREE(subreq);
324         TALLOC_FREE(state);
325
326         return WERR_OK;
327
328 failed:
329         ldb_transaction_cancel(sam_ctx);
330         return werr;
331 }
332
333 /* 
334   drsuapi_DsReplicaUpdateRefs
335 */
336 WERROR dcesrv_drsuapi_DsReplicaUpdateRefs(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
337                                           struct drsuapi_DsReplicaUpdateRefs *r)
338 {
339         struct auth_session_info *session_info =
340                 dcesrv_call_session_info(dce_call);
341         struct dcesrv_handle *h;
342         struct drsuapi_bind_state *b_state;
343         struct drsuapi_DsReplicaUpdateRefsRequest1 *req;
344         WERROR werr;
345         int ret;
346         enum security_user_level security_level;
347
348         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
349         b_state = h->data;
350
351         if (r->in.level != 1) {
352                 DEBUG(0,("DrReplicUpdateRefs - unsupported level %u\n", r->in.level));
353                 return WERR_DS_DRA_INVALID_PARAMETER;
354         }
355         req = &r->in.req.req1;
356         werr = drs_security_access_check(b_state->sam_ctx,
357                                          mem_ctx,
358                                          session_info->security_token,
359                                          req->naming_context,
360                                          GUID_DRS_MANAGE_TOPOLOGY);
361
362         if (!W_ERROR_IS_OK(werr)) {
363                 return werr;
364         }
365
366         security_level = security_session_user_level(session_info, NULL);
367         if (security_level < SECURITY_ADMINISTRATOR) {
368                 /* check that they are using an DSA objectGUID that they own */
369                 ret = dsdb_validate_dsa_guid(b_state->sam_ctx,
370                                              &req->dest_dsa_guid,
371                                              &session_info->security_token->sids[PRIMARY_USER_SID_INDEX]);
372                 if (ret != LDB_SUCCESS) {
373                         DEBUG(0,(__location__ ": Refusing DsReplicaUpdateRefs for sid %s with GUID %s\n",
374                                  dom_sid_string(mem_ctx,
375                                                 &session_info->security_token->sids[PRIMARY_USER_SID_INDEX]),
376                                  GUID_string(mem_ctx, &req->dest_dsa_guid)));
377                         return WERR_DS_DRA_ACCESS_DENIED;
378                 }
379         }
380
381         werr = drsuapi_UpdateRefs(dce_call->msg_ctx, dce_call->event_ctx,
382                                   b_state, mem_ctx, req);
383
384 #if 0
385         NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsReplicaUpdateRefs, NDR_BOTH, r);
386 #endif
387
388         return werr;
389 }