source4/rpc_server/drsuapi/updaterefs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    implement the DRSUpdateRefs call
   5
   6    Copyright (C) Andrew Tridgell 2009
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "rpc_server/dcerpc_server.h"
  24 #include "dsdb/samdb/samdb.h"
  25 #include "libcli/security/security.h"
  26 #include "libcli/security/session.h"
  27 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  28 #include "auth/session.h"
  29 #include "librpc/gen_ndr/ndr_drsuapi.h"
  30 #include "librpc/gen_ndr/ndr_irpc_c.h"
  31 #include "lib/messaging/irpc.h"
  32
  33 struct repsTo {
  34         uint32_t count;
  35         struct repsFromToBlob *r;
  36 };
  37
  38 static WERROR uref_check_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
  39                               struct ldb_dn *dn, struct GUID *dest_guid,
  40                               uint32_t options)
  41 {
  42         struct repsTo reps;
  43         WERROR werr;
  44         unsigned int i;
  45         bool found = false;
  46
  47         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
  48         if (!W_ERROR_IS_OK(werr)) {
  49                 return werr;
  50         }
  51
  52         for (i=0; i<reps.count; i++) {
  53                 if (GUID_equal(dest_guid,
  54                                &reps.r[i].ctr.ctr1.source_dsa_obj_guid)) {
  55                         found = true;
  56                         break;
  57                 }
  58         }
  59
  60         if (options & DRSUAPI_DRS_ADD_REF) {
  61                 if (found && !(options & DRSUAPI_DRS_DEL_REF)) {
  62                         return WERR_DS_DRA_REF_ALREADY_EXISTS;
  63                 }
  64         }
  65
  66         if (options & DRSUAPI_DRS_DEL_REF) {
  67                 if (!found && !(options & DRSUAPI_DRS_ADD_REF)) {
  68                         return WERR_DS_DRA_REF_NOT_FOUND;
  69                 }
  70         }
  71
  72         return WERR_OK;
  73 }
  74
  75 /*
  76   add a replication destination for a given partition GUID
  77  */
  78 static WERROR uref_add_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
  79                             struct ldb_dn *dn, struct repsFromTo1 *dest,
  80                             uint32_t options)
  81 {
  82         struct repsTo reps;
  83         WERROR werr;
  84         unsigned int i;
  85
  86         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
  87         if (!W_ERROR_IS_OK(werr)) {
  88                 return werr;
  89         }
  90
  91         for (i=0; i<reps.count; i++) {
  92                 if (GUID_equal(&dest->source_dsa_obj_guid,
  93                                &reps.r[i].ctr.ctr1.source_dsa_obj_guid)) {
  94                         if (options & DRSUAPI_DRS_GETCHG_CHECK) {
  95                                 return WERR_OK;
  96                         } else {
  97                                 return WERR_DS_DRA_REF_ALREADY_EXISTS;
  98                         }
  99                 }
 100         }
 101
 102         reps.r = talloc_realloc(mem_ctx, reps.r, struct repsFromToBlob, reps.count+1);
 103         if (reps.r == NULL) {
 104                 return WERR_DS_DRA_INTERNAL_ERROR;
 105         }
 106         ZERO_STRUCT(reps.r[reps.count]);
 107         reps.r[reps.count].version = 1;
 108         reps.r[reps.count].ctr.ctr1 = *dest;
 109         /* add the GCSPN flag if the client asked for it */
 110         reps.r[reps.count].ctr.ctr1.replica_flags |= (options & DRSUAPI_DRS_REF_GCSPN);
 111         reps.count++;
 112
 113         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
 114         if (!W_ERROR_IS_OK(werr)) {
 115                 return werr;
 116         }
 117
 118         return WERR_OK;
 119 }
 120
 121 /*
 122   delete a replication destination for a given partition GUID
 123  */
 124 static WERROR uref_del_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 125                             struct ldb_dn *dn, struct GUID *dest_guid,
 126                             uint32_t options)
 127 {
 128         struct repsTo reps;
 129         WERROR werr;
 130         unsigned int i;
 131         bool found = false;
 132
 133         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
 134         if (!W_ERROR_IS_OK(werr)) {
 135                 return werr;
 136         }
 137
 138         for (i=0; i<reps.count; i++) {
 139                 if (GUID_equal(dest_guid,
 140                                &reps.r[i].ctr.ctr1.source_dsa_obj_guid)) {
 141                         if (i+1 < reps.count) {
 142                                 memmove(&reps.r[i], &reps.r[i+1], sizeof(reps.r[i])*(reps.count-(i+1)));
 143                         }
 144                         reps.count--;
 145                         found = true;
 146                 }
 147         }
 148
 149         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
 150         if (!W_ERROR_IS_OK(werr)) {
 151                 return werr;
 152         }
 153
 154         if (!found &&
 155             !(options & DRSUAPI_DRS_GETCHG_CHECK) &&
 156             !(options & DRSUAPI_DRS_ADD_REF)) {
 157                 return WERR_DS_DRA_REF_NOT_FOUND;
 158         }
 159
 160         return WERR_OK;
 161 }
 162
 163 struct drepl_refresh_state {
 164         struct dreplsrv_refresh r;
 165 };
 166
 167 /**
 168  * @brief Update the references for the given NC and the destination DSA object
 169  *
 170  * This function is callable from non RPC functions (ie. getncchanges), it
 171  * will validate the request to update reference and then will add/del a repsTo
 172  * to the specified server referenced by its DSA GUID in the request.
 173  *
 174  * @param[in]       msg_ctx          Messaging context for sending partition
 175  *                                   refresh in dreplsrv
 176  *
 177  * @param[in]       b_state          A bind_state object
 178  *
 179  * @param[in]       mem_ctx          A talloc context for memory allocation
 180  *
 181  * @param[in]       req              A drsuapi_DsReplicaUpdateRefsRequest1
 182  *                                   object which NC, which server and which
 183  *                                   action (add/delete) should be performed
 184  *
 185  * @return                           WERR_OK is success, different error
 186  *                                   otherwise.
 187  */
 188 WERROR drsuapi_UpdateRefs(struct imessaging_context *msg_ctx,
 189                           struct tevent_context *event_ctx,
 190                           struct drsuapi_bind_state *b_state, TALLOC_CTX *mem_ctx,
 191                           struct drsuapi_DsReplicaUpdateRefsRequest1 *req)
 192 {
 193         WERROR werr;
 194         int ret;
 195         struct ldb_dn *dn;
 196         struct ldb_dn *nc_root;
 197         struct ldb_context *sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
 198         struct dcerpc_binding_handle *irpc_handle;
 199         struct tevent_req *subreq;
 200         struct drepl_refresh_state *state;
 201
 202
 203         DEBUG(4,("DsReplicaUpdateRefs for host '%s' with GUID %s options 0x%08x nc=%s\n",
 204                  req->dest_dsa_dns_name, GUID_string(mem_ctx, &req->dest_dsa_guid),
 205                  req->options,
 206                  drs_ObjectIdentifier_to_string(mem_ctx, req->naming_context)));
 207
 208         /*
 209          * 4.1.26.2 Server Behavior of the IDL_DRSUpdateRefs Method
 210          * Implements the input validation checks
 211          */
 212         if (GUID_all_zero(&req->dest_dsa_guid)) {
 213                 return WERR_DS_DRA_INVALID_PARAMETER;
 214         }
 215
 216         /* FIXME it seems that we should check the length of the stuff too*/
 217         if (req->dest_dsa_dns_name == NULL) {
 218                 return WERR_DS_DRA_INVALID_PARAMETER;
 219         }
 220
 221         if (!(req->options & (DRSUAPI_DRS_DEL_REF|DRSUAPI_DRS_ADD_REF))) {
 222                 return WERR_DS_DRA_INVALID_PARAMETER;
 223         }
 224
 225         dn = drs_ObjectIdentifier_to_dn(mem_ctx, sam_ctx, req->naming_context);
 226         W_ERROR_HAVE_NO_MEMORY(dn);
 227         ret = dsdb_find_nc_root(sam_ctx, dn, dn, &nc_root);
 228         if (ret != LDB_SUCCESS) {
 229                 DEBUG(2, ("Didn't find a nc for %s\n", ldb_dn_get_linearized(dn)));
 230                 return WERR_DS_DRA_BAD_NC;
 231         }
 232         if (ldb_dn_compare(dn, nc_root) != 0) {
 233                 DEBUG(2, ("dn %s is not equal to %s\n", ldb_dn_get_linearized(dn), ldb_dn_get_linearized(nc_root)));
 234                 return WERR_DS_DRA_BAD_NC;
 235         }
 236
 237         /*
 238          * First check without a transaction open.
 239          *
 240          * This means that in the usual case, it will never open it and never
 241          * bother to refresh the dreplsrv.
 242          */
 243         werr = uref_check_dest(sam_ctx, mem_ctx, dn, &req->dest_dsa_guid,
 244                                req->options);
 245         if (W_ERROR_EQUAL(werr, WERR_DS_DRA_REF_ALREADY_EXISTS) ||
 246             W_ERROR_EQUAL(werr, WERR_DS_DRA_REF_NOT_FOUND)) {
 247                 if (req->options & DRSUAPI_DRS_GETCHG_CHECK) {
 248                         return WERR_OK;
 249                 }
 250                 return werr;
 251         }
 252
 253         if (ldb_transaction_start(sam_ctx) != LDB_SUCCESS) {
 254                 DEBUG(0,(__location__ ": Failed to start transaction on samdb: %s\n",
 255                          ldb_errstring(sam_ctx)));
 256                 return WERR_DS_DRA_INTERNAL_ERROR;
 257         }
 258
 259         if (req->options & DRSUAPI_DRS_DEL_REF) {
 260                 werr = uref_del_dest(sam_ctx, mem_ctx, dn, &req->dest_dsa_guid, req->options);
 261                 if (!W_ERROR_IS_OK(werr)) {
 262                         DEBUG(0,("Failed to delete repsTo for %s: %s\n",
 263                                  GUID_string(mem_ctx, &req->dest_dsa_guid),
 264                                  win_errstr(werr)));
 265                         goto failed;
 266                 }
 267         }
 268
 269         if (req->options & DRSUAPI_DRS_ADD_REF) {
 270                 struct repsFromTo1 dest;
 271                 struct repsFromTo1OtherInfo oi;
 272
 273                 ZERO_STRUCT(dest);
 274                 ZERO_STRUCT(oi);
 275
 276                 oi.dns_name = req->dest_dsa_dns_name;
 277                 dest.other_info          = &oi;
 278                 dest.source_dsa_obj_guid = req->dest_dsa_guid;
 279                 dest.replica_flags       = req->options;
 280
 281                 werr = uref_add_dest(sam_ctx, mem_ctx, dn, &dest, req->options);
 282                 if (!W_ERROR_IS_OK(werr)) {
 283                         DEBUG(0,("Failed to add repsTo for %s: %s\n",
 284                                  GUID_string(mem_ctx, &dest.source_dsa_obj_guid),
 285                                  win_errstr(werr)));
 286                         goto failed;
 287                 }
 288         }
 289
 290         if (ldb_transaction_commit(sam_ctx) != LDB_SUCCESS) {
 291                 DEBUG(0,(__location__ ": Failed to commit transaction on samdb: %s\n",
 292                          ldb_errstring(sam_ctx)));
 293                 return WERR_DS_DRA_INTERNAL_ERROR;
 294         }
 295
 296         state = talloc_zero(mem_ctx, struct drepl_refresh_state);
 297         if (state == NULL) {
 298                 return WERR_OK;
 299         }
 300
 301         irpc_handle = irpc_binding_handle_by_name(mem_ctx, msg_ctx,
 302                                                   "dreplsrv", &ndr_table_irpc);
 303         if (irpc_handle == NULL) {
 304                 /* dreplsrv is not running yet */
 305                 TALLOC_FREE(state);
 306                 return WERR_OK;
 307         }
 308
 309         /*
 310          * [Taken from auth_sam_trigger_repl_secret in auth_sam.c]
 311          *
 312          * This seem to rely on the current IRPC implementation,
 313          * which delivers the message in the _send function.
 314          *
 315          * TODO: we need a ONE_WAY IRPC handle and register
 316          * a callback and wait for it to be triggered!
 317          */
 318         subreq = dcerpc_dreplsrv_refresh_r_send(state, event_ctx,
 319                                                 irpc_handle, &state->r);
 320         TALLOC_FREE(subreq);
 321         TALLOC_FREE(state);
 322
 323         return WERR_OK;
 324
 325 failed:
 326         ldb_transaction_cancel(sam_ctx);
 327         return werr;
 328 }
 329
 330 /*
 331   drsuapi_DsReplicaUpdateRefs
 332 */
 333 WERROR dcesrv_drsuapi_DsReplicaUpdateRefs(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 334                                           struct drsuapi_DsReplicaUpdateRefs *r)
 335 {
 336         struct dcesrv_handle *h;
 337         struct drsuapi_bind_state *b_state;
 338         struct drsuapi_DsReplicaUpdateRefsRequest1 *req;
 339         WERROR werr;
 340         int ret;
 341         enum security_user_level security_level;
 342
 343         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
 344         b_state = h->data;
 345
 346         if (r->in.level != 1) {
 347                 DEBUG(0,("DrReplicUpdateRefs - unsupported level %u\n", r->in.level));
 348                 return WERR_DS_DRA_INVALID_PARAMETER;
 349         }
 350         req = &r->in.req.req1;
 351         werr = drs_security_access_check(b_state->sam_ctx,
 352                                          mem_ctx,
 353                                          dce_call->conn->auth_state.session_info->security_token,
 354                                          req->naming_context,
 355                                          GUID_DRS_MANAGE_TOPOLOGY);
 356
 357         if (!W_ERROR_IS_OK(werr)) {
 358                 return werr;
 359         }
 360
 361         security_level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
 362         if (security_level < SECURITY_ADMINISTRATOR) {
 363                 /* check that they are using an DSA objectGUID that they own */
 364                 ret = dsdb_validate_dsa_guid(b_state->sam_ctx,
 365                                              &req->dest_dsa_guid,
 366                                              &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]);
 367                 if (ret != LDB_SUCCESS) {
 368                         DEBUG(0,(__location__ ": Refusing DsReplicaUpdateRefs for sid %s with GUID %s\n",
 369                                  dom_sid_string(mem_ctx,
 370                                                 &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]),
 371                                  GUID_string(mem_ctx, &req->dest_dsa_guid)));
 372                         return WERR_DS_DRA_ACCESS_DENIED;
 373                 }
 374         }
 375
 376         werr = drsuapi_UpdateRefs(dce_call->msg_ctx, dce_call->event_ctx,
 377                                   b_state, mem_ctx, req);
 378
 379 #if 0
 380         NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsReplicaUpdateRefs, NDR_BOTH, r);
 381 #endif
 382
 383         return werr;
 384 }