6fdbf2e04bfbd3a3b2ec237b713e533fd0343bf1
[nivanova/samba-autobuild/.git] / source4 / rpc_server / drsuapi / updaterefs.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    implement the DRSUpdateRefs call
5
6    Copyright (C) Andrew Tridgell 2009
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "rpc_server/dcerpc_server.h"
24 #include "dsdb/samdb/samdb.h"
25 #include "libcli/security/security.h"
26 #include "libcli/security/session.h"
27 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
28 #include "auth/session.h"
29 #include "librpc/gen_ndr/ndr_drsuapi.h"
30
31 struct repsTo {
32         uint32_t count;
33         struct repsFromToBlob *r;
34 };
35
36 /*
37   add a replication destination for a given partition GUID
38  */
39 static WERROR uref_add_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, 
40                             struct ldb_dn *dn, struct repsFromTo1 *dest, 
41                             uint32_t options)
42 {
43         struct repsTo reps;
44         WERROR werr;
45         unsigned int i;
46
47         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
48         if (!W_ERROR_IS_OK(werr)) {
49                 return werr;
50         }
51
52         for (i=0; i<reps.count; i++) {
53                 if (GUID_equal(&dest->source_dsa_obj_guid,
54                                &reps.r[i].ctr.ctr1.source_dsa_obj_guid)) {
55                         if (options & DRSUAPI_DRS_GETCHG_CHECK) {
56                                 return WERR_OK;
57                         } else {
58                                 return WERR_DS_DRA_REF_ALREADY_EXISTS;
59                         }
60                 }
61         }
62
63         reps.r = talloc_realloc(mem_ctx, reps.r, struct repsFromToBlob, reps.count+1);
64         if (reps.r == NULL) {
65                 return WERR_DS_DRA_INTERNAL_ERROR;
66         }
67         ZERO_STRUCT(reps.r[reps.count]);
68         reps.r[reps.count].version = 1;
69         reps.r[reps.count].ctr.ctr1 = *dest;
70         /* add the GCSPN flag if the client asked for it */
71         reps.r[reps.count].ctr.ctr1.replica_flags |= (options & DRSUAPI_DRS_REF_GCSPN);
72         reps.count++;
73
74         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
75         if (!W_ERROR_IS_OK(werr)) {
76                 return werr;
77         }
78
79         return WERR_OK; 
80 }
81
82 /*
83   delete a replication destination for a given partition GUID
84  */
85 static WERROR uref_del_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, 
86                             struct ldb_dn *dn, struct GUID *dest_guid, 
87                             uint32_t options)
88 {
89         struct repsTo reps;
90         WERROR werr;
91         unsigned int i;
92         bool found = false;
93
94         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
95         if (!W_ERROR_IS_OK(werr)) {
96                 return werr;
97         }
98
99         for (i=0; i<reps.count; i++) {
100                 if (GUID_equal(dest_guid,
101                                &reps.r[i].ctr.ctr1.source_dsa_obj_guid)) {
102                         if (i+1 < reps.count) {
103                                 memmove(&reps.r[i], &reps.r[i+1], sizeof(reps.r[i])*(reps.count-(i+1)));
104                         }
105                         reps.count--;
106                         found = true;
107                 }
108         }
109
110         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
111         if (!W_ERROR_IS_OK(werr)) {
112                 return werr;
113         }
114
115         if (!found &&
116             !(options & DRSUAPI_DRS_GETCHG_CHECK) &&
117             !(options & DRSUAPI_DRS_ADD_REF)) {
118                 return WERR_DS_DRA_REF_NOT_FOUND;
119         }
120
121         return WERR_OK; 
122 }
123
124 /**
125  * @brief Update the references for the given NC and the destination DSA object
126  *
127  * This function is callable from non RPC functions (ie. getncchanges), it
128  * will validate the request to update reference and then will add/del a repsTo
129  * to the specified server referenced by its DSA GUID in the request.
130  *
131  * @param[in]       b_state          A bind_state object
132  *
133  * @param[in]       mem_ctx          A talloc context for memory allocation
134  *
135  * @param[in]       req              A drsuapi_DsReplicaUpdateRefsRequest1
136  *                                   object which NC, which server and which
137  *                                   action (add/delete) should be performed
138  *
139  * @return                           WERR_OK is success, different error
140  *                                   otherwise.
141  */
142 WERROR drsuapi_UpdateRefs(struct drsuapi_bind_state *b_state, TALLOC_CTX *mem_ctx,
143                           struct drsuapi_DsReplicaUpdateRefsRequest1 *req)
144 {
145         WERROR werr;
146         int ret;
147         struct ldb_dn *dn;
148         struct ldb_dn *nc_root;
149         struct ldb_context *sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
150
151         DEBUG(4,("DsReplicaUpdateRefs for host '%s' with GUID %s options 0x%08x nc=%s\n",
152                  req->dest_dsa_dns_name, GUID_string(mem_ctx, &req->dest_dsa_guid),
153                  req->options,
154                  drs_ObjectIdentifier_to_string(mem_ctx, req->naming_context)));
155
156         /*
157          * 4.1.26.2 Server Behavior of the IDL_DRSUpdateRefs Method
158          * Implements the input validation checks
159          */
160         if (GUID_all_zero(&req->dest_dsa_guid)) {
161                 return WERR_DS_DRA_INVALID_PARAMETER;
162         }
163
164         /* FIXME it seems that we should check the length of the stuff too*/
165         if (req->dest_dsa_dns_name == NULL) {
166                 return WERR_DS_DRA_INVALID_PARAMETER;
167         }
168
169         if (!(req->options & (DRSUAPI_DRS_DEL_REF|DRSUAPI_DRS_ADD_REF))) {
170                 return WERR_DS_DRA_INVALID_PARAMETER;
171         }
172
173         dn = drs_ObjectIdentifier_to_dn(mem_ctx, sam_ctx, req->naming_context);
174         W_ERROR_HAVE_NO_MEMORY(dn);
175         ret = dsdb_find_nc_root(sam_ctx, dn, dn, &nc_root);
176         if (ret != LDB_SUCCESS) {
177                 DEBUG(2, ("Didn't find a nc for %s\n", ldb_dn_get_linearized(dn)));
178                 return WERR_DS_DRA_BAD_NC;
179         }
180         if (ldb_dn_compare(dn, nc_root) != 0) {
181                 DEBUG(2, ("dn %s is not equal to %s\n", ldb_dn_get_linearized(dn), ldb_dn_get_linearized(nc_root)));
182                 return WERR_DS_DRA_BAD_NC;
183         }
184
185         if (ldb_transaction_start(sam_ctx) != LDB_SUCCESS) {
186                 DEBUG(0,(__location__ ": Failed to start transaction on samdb: %s\n",
187                          ldb_errstring(sam_ctx)));
188                 return WERR_DS_DRA_INTERNAL_ERROR;
189         }
190
191         if (req->options & DRSUAPI_DRS_DEL_REF) {
192                 werr = uref_del_dest(sam_ctx, mem_ctx, dn, &req->dest_dsa_guid, req->options);
193                 if (!W_ERROR_IS_OK(werr)) {
194                         DEBUG(0,("Failed to delete repsTo for %s: %s\n",
195                                  GUID_string(mem_ctx, &req->dest_dsa_guid),
196                                  win_errstr(werr)));
197                         goto failed;
198                 }
199         }
200
201         if (req->options & DRSUAPI_DRS_ADD_REF) {
202                 struct repsFromTo1 dest;
203                 struct repsFromTo1OtherInfo oi;
204                 
205                 ZERO_STRUCT(dest);
206                 ZERO_STRUCT(oi);
207
208                 oi.dns_name = req->dest_dsa_dns_name;
209                 dest.other_info          = &oi;
210                 dest.source_dsa_obj_guid = req->dest_dsa_guid;
211                 dest.replica_flags       = req->options;
212
213                 werr = uref_add_dest(sam_ctx, mem_ctx, dn, &dest, req->options);
214                 if (!W_ERROR_IS_OK(werr)) {
215                         DEBUG(0,("Failed to add repsTo for %s: %s\n",
216                                  GUID_string(mem_ctx, &dest.source_dsa_obj_guid),
217                                  win_errstr(werr)));
218                         goto failed;
219                 }
220         }
221
222         if (ldb_transaction_commit(sam_ctx) != LDB_SUCCESS) {
223                 DEBUG(0,(__location__ ": Failed to commit transaction on samdb: %s\n",
224                          ldb_errstring(sam_ctx)));
225                 return WERR_DS_DRA_INTERNAL_ERROR;              
226         }
227
228         return WERR_OK;
229
230 failed:
231         ldb_transaction_cancel(sam_ctx);
232         return werr;
233 }
234
235 /* 
236   drsuapi_DsReplicaUpdateRefs
237 */
238 WERROR dcesrv_drsuapi_DsReplicaUpdateRefs(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
239                                           struct drsuapi_DsReplicaUpdateRefs *r)
240 {
241         struct dcesrv_handle *h;
242         struct drsuapi_bind_state *b_state;
243         struct drsuapi_DsReplicaUpdateRefsRequest1 *req;
244         WERROR werr;
245         int ret;
246         enum security_user_level security_level;
247
248         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
249         b_state = h->data;
250
251         if (r->in.level != 1) {
252                 DEBUG(0,("DrReplicUpdateRefs - unsupported level %u\n", r->in.level));
253                 return WERR_DS_DRA_INVALID_PARAMETER;
254         }
255         req = &r->in.req.req1;
256         werr = drs_security_access_check(b_state->sam_ctx,
257                                          mem_ctx,
258                                          dce_call->conn->auth_state.session_info->security_token,
259                                          req->naming_context,
260                                          GUID_DRS_MANAGE_TOPOLOGY);
261
262         if (!W_ERROR_IS_OK(werr)) {
263                 return werr;
264         }
265
266         security_level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
267         if (security_level < SECURITY_ADMINISTRATOR) {
268                 /* check that they are using an DSA objectGUID that they own */
269                 ret = dsdb_validate_dsa_guid(b_state->sam_ctx,
270                                              &req->dest_dsa_guid,
271                                              &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]);
272                 if (ret != LDB_SUCCESS) {
273                         DEBUG(0,(__location__ ": Refusing DsReplicaUpdateRefs for sid %s with GUID %s\n",
274                                  dom_sid_string(mem_ctx,
275                                                 &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]),
276                                  GUID_string(mem_ctx, &req->dest_dsa_guid)));
277                         return WERR_DS_DRA_ACCESS_DENIED;
278                 }
279         }
280
281         werr = drsuapi_UpdateRefs(b_state, mem_ctx, req);
282
283 #if 0
284         NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsReplicaUpdateRefs, NDR_BOTH, r);
285 #endif
286
287         return werr;
288 }