updaterefs: Do not open transaction even when unnecessary
[nivanova/samba-autobuild/.git] / source4 / rpc_server / drsuapi / updaterefs.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    implement the DRSUpdateRefs call
5
6    Copyright (C) Andrew Tridgell 2009
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "rpc_server/dcerpc_server.h"
24 #include "dsdb/samdb/samdb.h"
25 #include "libcli/security/security.h"
26 #include "libcli/security/session.h"
27 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
28 #include "auth/session.h"
29 #include "librpc/gen_ndr/ndr_drsuapi.h"
30 #include "librpc/gen_ndr/ndr_irpc_c.h"
31 #include "lib/messaging/irpc.h"
32
33 struct repsTo {
34         uint32_t count;
35         struct repsFromToBlob *r;
36 };
37
38 static WERROR uref_check_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
39                               struct ldb_dn *dn, struct GUID *dest_guid,
40                               uint32_t options)
41 {
42         struct repsTo reps;
43         WERROR werr;
44         unsigned int i;
45         bool found = false;
46
47         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
48         if (!W_ERROR_IS_OK(werr)) {
49                 return werr;
50         }
51
52         for (i=0; i<reps.count; i++) {
53                 if (GUID_equal(dest_guid,
54                                &reps.r[i].ctr.ctr1.source_dsa_obj_guid)) {
55                         found = true;
56                         break;
57                 }
58         }
59
60         if (options & DRSUAPI_DRS_ADD_REF) {
61                 if (found && !(options & DRSUAPI_DRS_DEL_REF)) {
62                         return WERR_DS_DRA_REF_ALREADY_EXISTS;
63                 }
64         }
65
66         if (options & DRSUAPI_DRS_DEL_REF) {
67                 if (!found && !(options & DRSUAPI_DRS_ADD_REF)) {
68                         return WERR_DS_DRA_REF_NOT_FOUND;
69                 }
70         }
71
72         return WERR_OK;
73 }
74
75 /*
76   add a replication destination for a given partition GUID
77  */
78 static WERROR uref_add_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, 
79                             struct ldb_dn *dn, struct repsFromTo1 *dest, 
80                             uint32_t options)
81 {
82         struct repsTo reps;
83         WERROR werr;
84         unsigned int i;
85
86         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
87         if (!W_ERROR_IS_OK(werr)) {
88                 return werr;
89         }
90
91         for (i=0; i<reps.count; i++) {
92                 if (GUID_equal(&dest->source_dsa_obj_guid,
93                                &reps.r[i].ctr.ctr1.source_dsa_obj_guid)) {
94                         if (options & DRSUAPI_DRS_GETCHG_CHECK) {
95                                 return WERR_OK;
96                         } else {
97                                 return WERR_DS_DRA_REF_ALREADY_EXISTS;
98                         }
99                 }
100         }
101
102         reps.r = talloc_realloc(mem_ctx, reps.r, struct repsFromToBlob, reps.count+1);
103         if (reps.r == NULL) {
104                 return WERR_DS_DRA_INTERNAL_ERROR;
105         }
106         ZERO_STRUCT(reps.r[reps.count]);
107         reps.r[reps.count].version = 1;
108         reps.r[reps.count].ctr.ctr1 = *dest;
109         /* add the GCSPN flag if the client asked for it */
110         reps.r[reps.count].ctr.ctr1.replica_flags |= (options & DRSUAPI_DRS_REF_GCSPN);
111         reps.count++;
112
113         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
114         if (!W_ERROR_IS_OK(werr)) {
115                 return werr;
116         }
117
118         return WERR_OK; 
119 }
120
121 /*
122   delete a replication destination for a given partition GUID
123  */
124 static WERROR uref_del_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, 
125                             struct ldb_dn *dn, struct GUID *dest_guid, 
126                             uint32_t options)
127 {
128         struct repsTo reps;
129         WERROR werr;
130         unsigned int i;
131         bool found = false;
132
133         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
134         if (!W_ERROR_IS_OK(werr)) {
135                 return werr;
136         }
137
138         for (i=0; i<reps.count; i++) {
139                 if (GUID_equal(dest_guid,
140                                &reps.r[i].ctr.ctr1.source_dsa_obj_guid)) {
141                         if (i+1 < reps.count) {
142                                 memmove(&reps.r[i], &reps.r[i+1], sizeof(reps.r[i])*(reps.count-(i+1)));
143                         }
144                         reps.count--;
145                         found = true;
146                 }
147         }
148
149         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
150         if (!W_ERROR_IS_OK(werr)) {
151                 return werr;
152         }
153
154         if (!found &&
155             !(options & DRSUAPI_DRS_GETCHG_CHECK) &&
156             !(options & DRSUAPI_DRS_ADD_REF)) {
157                 return WERR_DS_DRA_REF_NOT_FOUND;
158         }
159
160         return WERR_OK; 
161 }
162
163 struct drepl_refresh_state {
164         struct dreplsrv_refresh r;
165 };
166
167 /**
168  * @brief Update the references for the given NC and the destination DSA object
169  *
170  * This function is callable from non RPC functions (ie. getncchanges), it
171  * will validate the request to update reference and then will add/del a repsTo
172  * to the specified server referenced by its DSA GUID in the request.
173  *
174  * @param[in]       msg_ctx          Messaging context for sending partition
175  *                                   refresh in dreplsrv
176  *
177  * @param[in]       b_state          A bind_state object
178  *
179  * @param[in]       mem_ctx          A talloc context for memory allocation
180  *
181  * @param[in]       req              A drsuapi_DsReplicaUpdateRefsRequest1
182  *                                   object which NC, which server and which
183  *                                   action (add/delete) should be performed
184  *
185  * @return                           WERR_OK is success, different error
186  *                                   otherwise.
187  */
188 WERROR drsuapi_UpdateRefs(struct imessaging_context *msg_ctx,
189                           struct tevent_context *event_ctx,
190                           struct drsuapi_bind_state *b_state, TALLOC_CTX *mem_ctx,
191                           struct drsuapi_DsReplicaUpdateRefsRequest1 *req)
192 {
193         WERROR werr;
194         int ret;
195         struct ldb_dn *dn;
196         struct ldb_dn *nc_root;
197         struct ldb_context *sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
198         struct dcerpc_binding_handle *irpc_handle;
199         struct tevent_req *subreq;
200         struct drepl_refresh_state *state;
201
202
203         DEBUG(4,("DsReplicaUpdateRefs for host '%s' with GUID %s options 0x%08x nc=%s\n",
204                  req->dest_dsa_dns_name, GUID_string(mem_ctx, &req->dest_dsa_guid),
205                  req->options,
206                  drs_ObjectIdentifier_to_string(mem_ctx, req->naming_context)));
207
208         /*
209          * 4.1.26.2 Server Behavior of the IDL_DRSUpdateRefs Method
210          * Implements the input validation checks
211          */
212         if (GUID_all_zero(&req->dest_dsa_guid)) {
213                 return WERR_DS_DRA_INVALID_PARAMETER;
214         }
215
216         /* FIXME it seems that we should check the length of the stuff too*/
217         if (req->dest_dsa_dns_name == NULL) {
218                 return WERR_DS_DRA_INVALID_PARAMETER;
219         }
220
221         if (!(req->options & (DRSUAPI_DRS_DEL_REF|DRSUAPI_DRS_ADD_REF))) {
222                 return WERR_DS_DRA_INVALID_PARAMETER;
223         }
224
225         dn = drs_ObjectIdentifier_to_dn(mem_ctx, sam_ctx, req->naming_context);
226         W_ERROR_HAVE_NO_MEMORY(dn);
227         ret = dsdb_find_nc_root(sam_ctx, dn, dn, &nc_root);
228         if (ret != LDB_SUCCESS) {
229                 DEBUG(2, ("Didn't find a nc for %s\n", ldb_dn_get_linearized(dn)));
230                 return WERR_DS_DRA_BAD_NC;
231         }
232         if (ldb_dn_compare(dn, nc_root) != 0) {
233                 DEBUG(2, ("dn %s is not equal to %s\n", ldb_dn_get_linearized(dn), ldb_dn_get_linearized(nc_root)));
234                 return WERR_DS_DRA_BAD_NC;
235         }
236
237         /*
238          * First check without a transaction open.
239          *
240          * This means that in the usual case, it will never open it and never
241          * bother to refresh the dreplsrv.
242          */
243         werr = uref_check_dest(sam_ctx, mem_ctx, dn, &req->dest_dsa_guid,
244                                req->options);
245         if (W_ERROR_EQUAL(werr, WERR_DS_DRA_REF_ALREADY_EXISTS) ||
246             W_ERROR_EQUAL(werr, WERR_DS_DRA_REF_NOT_FOUND)) {
247                 if (req->options & DRSUAPI_DRS_GETCHG_CHECK) {
248                         return WERR_OK;
249                 }
250                 return werr;
251         }
252
253         if (ldb_transaction_start(sam_ctx) != LDB_SUCCESS) {
254                 DEBUG(0,(__location__ ": Failed to start transaction on samdb: %s\n",
255                          ldb_errstring(sam_ctx)));
256                 return WERR_DS_DRA_INTERNAL_ERROR;
257         }
258
259         if (req->options & DRSUAPI_DRS_DEL_REF) {
260                 werr = uref_del_dest(sam_ctx, mem_ctx, dn, &req->dest_dsa_guid, req->options);
261                 if (!W_ERROR_IS_OK(werr)) {
262                         DEBUG(0,("Failed to delete repsTo for %s: %s\n",
263                                  GUID_string(mem_ctx, &req->dest_dsa_guid),
264                                  win_errstr(werr)));
265                         goto failed;
266                 }
267         }
268
269         if (req->options & DRSUAPI_DRS_ADD_REF) {
270                 struct repsFromTo1 dest;
271                 struct repsFromTo1OtherInfo oi;
272
273                 ZERO_STRUCT(dest);
274                 ZERO_STRUCT(oi);
275
276                 oi.dns_name = req->dest_dsa_dns_name;
277                 dest.other_info          = &oi;
278                 dest.source_dsa_obj_guid = req->dest_dsa_guid;
279                 dest.replica_flags       = req->options;
280
281                 werr = uref_add_dest(sam_ctx, mem_ctx, dn, &dest, req->options);
282                 if (!W_ERROR_IS_OK(werr)) {
283                         DEBUG(0,("Failed to add repsTo for %s: %s\n",
284                                  GUID_string(mem_ctx, &dest.source_dsa_obj_guid),
285                                  win_errstr(werr)));
286                         goto failed;
287                 }
288         }
289
290         if (ldb_transaction_commit(sam_ctx) != LDB_SUCCESS) {
291                 DEBUG(0,(__location__ ": Failed to commit transaction on samdb: %s\n",
292                          ldb_errstring(sam_ctx)));
293                 return WERR_DS_DRA_INTERNAL_ERROR;
294         }
295
296         state = talloc_zero(mem_ctx, struct drepl_refresh_state);
297         if (state == NULL) {
298                 return WERR_OK;
299         }
300
301         irpc_handle = irpc_binding_handle_by_name(mem_ctx, msg_ctx,
302                                                   "dreplsrv", &ndr_table_irpc);
303         if (irpc_handle == NULL) {
304                 /* dreplsrv is not running yet */
305                 TALLOC_FREE(state);
306                 return WERR_OK;
307         }
308
309         /*
310          * [Taken from auth_sam_trigger_repl_secret in auth_sam.c]
311          *
312          * This seem to rely on the current IRPC implementation,
313          * which delivers the message in the _send function.
314          *
315          * TODO: we need a ONE_WAY IRPC handle and register
316          * a callback and wait for it to be triggered!
317          */
318         subreq = dcerpc_dreplsrv_refresh_r_send(state, event_ctx,
319                                                 irpc_handle, &state->r);
320         TALLOC_FREE(subreq);
321         TALLOC_FREE(state);
322
323         return WERR_OK;
324
325 failed:
326         ldb_transaction_cancel(sam_ctx);
327         return werr;
328 }
329
330 /* 
331   drsuapi_DsReplicaUpdateRefs
332 */
333 WERROR dcesrv_drsuapi_DsReplicaUpdateRefs(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
334                                           struct drsuapi_DsReplicaUpdateRefs *r)
335 {
336         struct dcesrv_handle *h;
337         struct drsuapi_bind_state *b_state;
338         struct drsuapi_DsReplicaUpdateRefsRequest1 *req;
339         WERROR werr;
340         int ret;
341         enum security_user_level security_level;
342
343         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
344         b_state = h->data;
345
346         if (r->in.level != 1) {
347                 DEBUG(0,("DrReplicUpdateRefs - unsupported level %u\n", r->in.level));
348                 return WERR_DS_DRA_INVALID_PARAMETER;
349         }
350         req = &r->in.req.req1;
351         werr = drs_security_access_check(b_state->sam_ctx,
352                                          mem_ctx,
353                                          dce_call->conn->auth_state.session_info->security_token,
354                                          req->naming_context,
355                                          GUID_DRS_MANAGE_TOPOLOGY);
356
357         if (!W_ERROR_IS_OK(werr)) {
358                 return werr;
359         }
360
361         security_level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
362         if (security_level < SECURITY_ADMINISTRATOR) {
363                 /* check that they are using an DSA objectGUID that they own */
364                 ret = dsdb_validate_dsa_guid(b_state->sam_ctx,
365                                              &req->dest_dsa_guid,
366                                              &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]);
367                 if (ret != LDB_SUCCESS) {
368                         DEBUG(0,(__location__ ": Refusing DsReplicaUpdateRefs for sid %s with GUID %s\n",
369                                  dom_sid_string(mem_ctx,
370                                                 &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]),
371                                  GUID_string(mem_ctx, &req->dest_dsa_guid)));
372                         return WERR_DS_DRA_ACCESS_DENIED;
373                 }
374         }
375
376         werr = drsuapi_UpdateRefs(dce_call->msg_ctx, dce_call->event_ctx,
377                                   b_state, mem_ctx, req);
378
379 #if 0
380         NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsReplicaUpdateRefs, NDR_BOTH, r);
381 #endif
382
383         return werr;
384 }