s4:rpc_server/drsuapi: make use dcesrv_call_session_info()
[samba.git] / source4 / rpc_server / drsuapi / writespn.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    implement the DsWriteAccountSpn call
5
6    Copyright (C) Stefan Metzmacher 2009
7    Copyright (C) Andrew Tridgell   2010
8
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "rpc_server/dcerpc_server.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "dsdb/common/util.h"
27 #include "system/kerberos.h"
28 #include "auth/kerberos/kerberos.h"
29 #include "libcli/security/security.h"
30 #include "libcli/security/session.h"
31 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
32 #include "librpc/gen_ndr/ndr_drsuapi.h"
33 #include "auth/session.h"
34
35 #undef DBGC_CLASS
36 #define DBGC_CLASS            DBGC_DRS_REPL
37
38 /*
39   check that the SPN update should be allowed as an override
40   via sam_ctx_system
41
42   This is only called if the client is not a domain controller or
43   administrator
44  */
45 static bool writespn_check_spn(struct drsuapi_bind_state *b_state,
46                                struct dcesrv_call_state *dce_call,
47                                struct ldb_dn *dn,
48                                const char *spn)
49 {
50         /*
51          * we only allow SPN updates if:
52          *
53          * 1) they are on the clients own account object
54          * 2) they are of the form SERVICE/dnshostname
55          */
56         struct auth_session_info *session_info =
57                 dcesrv_call_session_info(dce_call);
58         struct dom_sid *user_sid, *sid;
59         TALLOC_CTX *tmp_ctx = talloc_new(dce_call);
60         struct ldb_result *res;
61         const char *attrs[] = { "objectSID", "dNSHostName", NULL };
62         int ret;
63         krb5_context krb_ctx;
64         krb5_error_code kerr;
65         krb5_principal principal;
66         const krb5_data *component;
67         const char *dns_name, *dnsHostName;
68
69         /* The service principal name shouldn't be NULL */
70         if (spn == NULL) {
71                 talloc_free(tmp_ctx);
72                 return false;
73         }
74
75         /*
76           get the objectSid of the DN that is being modified, and
77           check it matches the user_sid in their token
78          */
79
80         ret = dsdb_search_dn(b_state->sam_ctx, tmp_ctx, &res, dn, attrs,
81                              DSDB_SEARCH_ONE_ONLY);
82         if (ret != LDB_SUCCESS) {
83                 talloc_free(tmp_ctx);
84                 return false;
85         }
86
87         user_sid = &session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
88         sid = samdb_result_dom_sid(tmp_ctx, res->msgs[0], "objectSid");
89         if (sid == NULL) {
90                 talloc_free(tmp_ctx);
91                 return false;
92         }
93
94         dnsHostName = ldb_msg_find_attr_as_string(res->msgs[0], "dNSHostName",
95                                                   NULL);
96         if (dnsHostName == NULL) {
97                 talloc_free(tmp_ctx);
98                 return false;
99         }
100
101         if (!dom_sid_equal(sid, user_sid)) {
102                 talloc_free(tmp_ctx);
103                 return false;
104         }
105
106         kerr = smb_krb5_init_context_basic(tmp_ctx,
107                                            dce_call->conn->dce_ctx->lp_ctx,
108                                            &krb_ctx);
109         if (kerr != 0) {
110                 talloc_free(tmp_ctx);
111                 return false;
112         }
113
114         ret = krb5_parse_name_flags(krb_ctx, spn, KRB5_PRINCIPAL_PARSE_NO_REALM,
115                                     &principal);
116         if (kerr != 0) {
117                 krb5_free_context(krb_ctx);
118                 talloc_free(tmp_ctx);
119                 return false;
120         }
121
122         if (krb5_princ_size(krb_ctx, principal) != 2) {
123                 krb5_free_principal(krb_ctx, principal);
124                 krb5_free_context(krb_ctx);
125                 talloc_free(tmp_ctx);
126                 return false;
127         }
128
129         component = krb5_princ_component(krb_ctx, principal, 1);
130         dns_name = (const char *)component->data;
131
132         if (strcasecmp(dns_name, dnsHostName) != 0) {
133                 krb5_free_principal(krb_ctx, principal);
134                 krb5_free_context(krb_ctx);
135                 talloc_free(tmp_ctx);
136                 return false;
137         }
138
139         /* its a simple update on their own account - allow it with
140          * permissions override */
141         krb5_free_principal(krb_ctx, principal);
142         krb5_free_context(krb_ctx);
143         talloc_free(tmp_ctx);
144
145         return true;
146 }
147
148 /*
149   drsuapi_DsWriteAccountSpn
150 */
151 WERROR dcesrv_drsuapi_DsWriteAccountSpn(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
152                                         struct drsuapi_DsWriteAccountSpn *r)
153 {
154         struct drsuapi_bind_state *b_state;
155         struct dcesrv_handle *h;
156
157         *r->out.level_out = r->in.level;
158
159         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
160         b_state = h->data;
161
162         r->out.res = talloc(mem_ctx, union drsuapi_DsWriteAccountSpnResult);
163         W_ERROR_HAVE_NO_MEMORY(r->out.res);
164
165         switch (r->in.level) {
166                 case 1: {
167                         struct drsuapi_DsWriteAccountSpnRequest1 *req;
168                         struct ldb_message *msg;
169                         uint32_t count;
170                         unsigned int i;
171                         int ret;
172                         unsigned spn_count=0;
173                         bool passed_checks = true;
174                         struct ldb_context *sam_ctx;
175
176                         req = &r->in.req->req1;
177                         count = req->count;
178
179                         msg = ldb_msg_new(mem_ctx);
180                         if (msg == NULL) {
181                                 return WERR_NOT_ENOUGH_MEMORY;
182                         }
183
184                         msg->dn = ldb_dn_new(msg, b_state->sam_ctx,
185                                              req->object_dn);
186                         if ( ! ldb_dn_validate(msg->dn)) {
187                                 r->out.res->res1.status = WERR_OK;
188                                 return WERR_OK;
189                         }
190
191                         /* construct mods */
192                         for (i = 0; i < count; i++) {
193                                 if (!writespn_check_spn(b_state,
194                                                        dce_call,
195                                                        msg->dn,
196                                                        req->spn_names[i].str)) {
197                                         passed_checks = false;
198                                 }
199                                 ret = ldb_msg_add_string(msg,
200                                                          "servicePrincipalName",
201                                                          req->spn_names[i].str);
202                                 if (ret != LDB_SUCCESS) {
203                                         return WERR_NOT_ENOUGH_MEMORY;
204                                 }
205                                 spn_count++;
206                         }
207
208                         if (msg->num_elements == 0) {
209                                 DEBUG(2,("No SPNs need changing on %s\n",
210                                          ldb_dn_get_linearized(msg->dn)));
211                                 r->out.res->res1.status = WERR_OK;
212                                 return WERR_OK;
213                         }
214
215                         for (i=0;i<msg->num_elements;i++) {
216                                 switch (req->operation) {
217                                 case DRSUAPI_DS_SPN_OPERATION_ADD:
218                                         msg->elements[i].flags = LDB_FLAG_MOD_ADD;
219                                         break;
220                                 case DRSUAPI_DS_SPN_OPERATION_REPLACE:
221                                         msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
222                                         break;
223                                 case DRSUAPI_DS_SPN_OPERATION_DELETE:
224                                         msg->elements[i].flags = LDB_FLAG_MOD_DELETE;
225                                         break;
226                                 }
227                         }
228
229                         if (passed_checks && b_state->sam_ctx_system) {
230                                 sam_ctx = b_state->sam_ctx_system;
231                         } else {
232                                 sam_ctx = b_state->sam_ctx;
233                         }
234
235                         /* Apply to database */
236                         ret = dsdb_modify(sam_ctx, msg, DSDB_MODIFY_PERMISSIVE);
237                         if (ret != LDB_SUCCESS) {
238                                 DEBUG(0,("Failed to modify SPNs on %s: %s\n",
239                                          ldb_dn_get_linearized(msg->dn),
240                                          ldb_errstring(b_state->sam_ctx)));
241                                 NDR_PRINT_IN_DEBUG(
242                                         drsuapi_DsWriteAccountSpn, r);
243                                 r->out.res->res1.status = WERR_ACCESS_DENIED;
244                         } else {
245                                 DEBUG(2,("Modified %u SPNs on %s\n", spn_count,
246                                          ldb_dn_get_linearized(msg->dn)));
247                                 r->out.res->res1.status = WERR_OK;
248                         }
249
250                         return WERR_OK;
251                 }
252         }
253
254         return WERR_INVALID_LEVEL;
255 }