source4/rpc_server/drsuapi/addentry.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    implement the DsAddEntry call
   5
   6    Copyright (C) Stefan Metzmacher 2009
   7    Copyright (C) Andrew Tridgell   2009
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "rpc_server/dcerpc_server.h"
  25 #include "rpc_server/common/common.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "lib/ldb/include/ldb_errors.h"
  28 #include "param/param.h"
  29 #include "librpc/gen_ndr/ndr_drsblobs.h"
  30 #include "auth/auth.h"
  31 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  32 #include "libcli/security/security.h"
  33 #include "librpc/gen_ndr/ndr_drsblobs.h"
  34 #include "librpc/gen_ndr/ndr_drsuapi.h"
  35
  36
  37 /*
  38   add special SPNs needed for DRS replication to machine accounts when
  39   an AddEntry is done to create a nTDSDSA object
  40  */
  41 static WERROR drsuapi_add_SPNs(struct drsuapi_bind_state *b_state,
  42                                struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
  43                                const struct drsuapi_DsReplicaObjectListItem *first_object)
  44 {
  45         int ret;
  46         const struct drsuapi_DsReplicaObjectListItem *obj;
  47         const char *attrs[] = { "serverReference", "objectGUID", NULL };
  48
  49         for (obj = first_object; obj; obj=obj->next_object) {
  50                 const char *dn_string = obj->object.identifier->dn;
  51                 struct ldb_dn *dn = ldb_dn_new(mem_ctx, b_state->sam_ctx, dn_string);
  52                 struct ldb_result *res;
  53                 struct ldb_dn *ref_dn;
  54                 struct GUID ntds_guid;
  55                 struct ldb_message *msg;
  56                 struct ldb_message_element *el;
  57                 const char *ntds_guid_str;
  58                 const char *dom_string;
  59
  60                 ret = ldb_search(b_state->sam_ctx, mem_ctx, &res,
  61                                  dn, LDB_SCOPE_BASE, attrs,
  62                                  "(objectClass=ntDSDSA)");
  63                 if (ret != LDB_SUCCESS || res->count < 1) {
  64                         DEBUG(0,(__location__ ": Failed to find dn '%s'\n", dn_string));
  65                         return WERR_DS_DRA_INTERNAL_ERROR;
  66                 }
  67
  68                 ref_dn = samdb_result_dn(b_state->sam_ctx, mem_ctx, res->msgs[0], "serverReference", NULL);
  69                 if (ref_dn == NULL) {
  70                         /* we only add SPNs for objects with a
  71                            serverReference */
  72                         continue;
  73                 }
  74
  75                 ntds_guid = samdb_result_guid(res->msgs[0], "objectGUID");
  76
  77                 ntds_guid_str = GUID_string(res, &ntds_guid);
  78
  79                 dom_string = lp_realm(dce_call->conn->dce_ctx->lp_ctx);
  80
  81                 /*
  82                  * construct a modify request to add the new SPNs to
  83                  * the machine account
  84                  */
  85                 msg = ldb_msg_new(mem_ctx);
  86                 if (msg == NULL) {
  87                         return WERR_NOMEM;
  88                 }
  89
  90                 msg->dn = ref_dn;
  91                 ret = ldb_msg_add_empty(msg, "servicePrincipalName",
  92                                         LDB_FLAG_MOD_ADD, &el);
  93                 if (ret != LDB_SUCCESS) {
  94                         return WERR_NOMEM;
  95                 }
  96
  97                 el->num_values = 2;
  98                 el->values = talloc_array(el, struct ldb_val, 2);
  99                 if (el->values == NULL) {
 100                         return WERR_NOMEM;
 101                 }
 102                 /* the magic constant is the GUID of the DRSUAPI RPC
 103                    interface */
 104                 el->values[0].data = (uint8_t *)talloc_asprintf(el->values,
 105                                                                 "E3514235-4B06-11D1-AB04-00C04FC2DCD2/%s/%s",
 106                                                                 ntds_guid_str, dom_string);
 107                 el->values[0].length = strlen((char *)el->values[0].data);
 108                 el->values[1].data = (uint8_t *)talloc_asprintf(el->values, "ldap/%s._msdcs.%s",
 109                                                                 ntds_guid_str, dom_string);
 110                 el->values[1].length = strlen((char *)el->values[1].data);
 111
 112                 ret = ldb_modify(b_state->sam_ctx, msg);
 113                 if (ret != LDB_SUCCESS) {
 114                         DEBUG(0,(__location__ ": Failed to add SPNs - %s\n",
 115                                  ldb_errstring(b_state->sam_ctx)));
 116                         return WERR_DS_DRA_INTERNAL_ERROR;
 117                 }
 118         }
 119
 120         return WERR_OK;
 121 }
 122
 123
 124
 125
 126 /*
 127   drsuapi_DsAddEntry
 128 */
 129 WERROR dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 130                                  struct drsuapi_DsAddEntry *r)
 131 {
 132         WERROR status;
 133         struct drsuapi_bind_state *b_state;
 134         struct dcesrv_handle *h;
 135         uint32_t num = 0;
 136         struct drsuapi_DsReplicaObjectIdentifier2 *ids = NULL;
 137         int ret;
 138         const struct drsuapi_DsReplicaObjectListItem *first_object;
 139
 140         if (DEBUGLVL(4)) {
 141                 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsAddEntry, NDR_IN, r);
 142         }
 143
 144         /* TODO: check which out level the client supports */
 145
 146         ZERO_STRUCTP(r->out.ctr);
 147         *r->out.level_out = 3;
 148         r->out.ctr->ctr3.level = 1;
 149         r->out.ctr->ctr3.error = talloc_zero(mem_ctx, union drsuapi_DsAddEntryError);
 150
 151         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
 152         b_state = h->data;
 153
 154         if (security_session_user_level(dce_call->conn->auth_state.session_info) <
 155             SECURITY_DOMAIN_CONTROLLER) {
 156                 DEBUG(0,("DsAddEntry refused for security token\n"));
 157                 return WERR_DS_DRA_ACCESS_DENIED;
 158         }
 159
 160         switch (r->in.level) {
 161         case 2:
 162                 ret = ldb_transaction_start(b_state->sam_ctx);
 163                 if (ret != LDB_SUCCESS) {
 164                         return WERR_DS_DRA_INTERNAL_ERROR;
 165                 }
 166
 167
 168                 first_object = &r->in.req->req2.first_object;
 169
 170                 status = dsdb_origin_objects_commit(b_state->sam_ctx,
 171                                                     mem_ctx,
 172                                                     first_object,
 173                                                     &num,
 174                                                     &ids);
 175                 if (!W_ERROR_IS_OK(status)) {
 176                         r->out.ctr->ctr3.error->info1.status = status;
 177                         ldb_transaction_cancel(b_state->sam_ctx);
 178                         return status;
 179                 }
 180
 181                 r->out.ctr->ctr3.count = num;
 182                 r->out.ctr->ctr3.objects = ids;
 183
 184                 break;
 185         default:
 186                 return WERR_FOOBAR;
 187         }
 188
 189         /* if any of the added entries are nTDSDSA objects then we
 190          * need to add the SPNs to the machine account
 191          */
 192         status = drsuapi_add_SPNs(b_state, dce_call, mem_ctx, first_object);
 193         if (!W_ERROR_IS_OK(status)) {
 194                 r->out.ctr->ctr3.error->info1.status = status;
 195                 ldb_transaction_cancel(b_state->sam_ctx);
 196                 return status;
 197         }
 198
 199         ret = ldb_transaction_commit(b_state->sam_ctx);
 200         if (ret != LDB_SUCCESS) {
 201                 return WERR_DS_DRA_INTERNAL_ERROR;
 202         }
 203
 204         return WERR_OK;
 205 }