s4-drs: added domain_sid to DRS security checks
[nivanova/samba-autobuild/.git] / source4 / rpc_server / drsuapi / updaterefs.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    implement the DRSUpdateRefs call
5
6    Copyright (C) Andrew Tridgell 2009
7    
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12    
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17    
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "rpc_server/dcerpc_server.h"
24 #include "dsdb/samdb/samdb.h"
25 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
26 #include "libcli/security/security.h"
27 #include "auth/session.h"
28
29 struct repsTo {
30         uint32_t count;
31         struct repsFromToBlob *r;
32 };
33
34 /*
35   add a replication destination for a given partition GUID
36  */
37 static WERROR uref_add_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, 
38                             struct ldb_dn *dn, struct repsFromTo1 *dest, 
39                             uint32_t options)
40 {
41         struct repsTo reps;
42         WERROR werr;
43         unsigned int i;
44
45         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
46         if (!W_ERROR_IS_OK(werr)) {
47                 return werr;
48         }
49
50         for (i=0; i<reps.count; i++) {
51                 if (GUID_compare(&dest->source_dsa_obj_guid, 
52                                  &reps.r[i].ctr.ctr1.source_dsa_obj_guid) == 0) {
53                         if (options & DRSUAPI_DRS_GETCHG_CHECK) {
54                                 return WERR_OK;
55                         } else {
56                                 return WERR_DS_DRA_REF_ALREADY_EXISTS;
57                         }
58                 }
59         }
60
61         reps.r = talloc_realloc(mem_ctx, reps.r, struct repsFromToBlob, reps.count+1);
62         if (reps.r == NULL) {
63                 return WERR_DS_DRA_INTERNAL_ERROR;
64         }
65         ZERO_STRUCT(reps.r[reps.count]);
66         reps.r[reps.count].version = 1;
67         reps.r[reps.count].ctr.ctr1 = *dest;
68         reps.count++;
69
70         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
71         if (!W_ERROR_IS_OK(werr)) {
72                 return werr;
73         }
74
75         return WERR_OK; 
76 }
77
78 /*
79   delete a replication destination for a given partition GUID
80  */
81 static WERROR uref_del_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, 
82                             struct ldb_dn *dn, struct GUID *dest_guid, 
83                             uint32_t options)
84 {
85         struct repsTo reps;
86         WERROR werr;
87         unsigned int i;
88         bool found = false;
89
90         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
91         if (!W_ERROR_IS_OK(werr)) {
92                 return werr;
93         }
94
95         for (i=0; i<reps.count; i++) {
96                 if (GUID_compare(dest_guid, &reps.r[i].ctr.ctr1.source_dsa_obj_guid) == 0) {
97                         if (i+1 < reps.count) {
98                                 memmove(&reps.r[i], &reps.r[i+1], sizeof(reps.r[i])*(reps.count-(i+1)));
99                         }
100                         reps.count--;
101                         found = true;
102                 }
103         }
104
105         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
106         if (!W_ERROR_IS_OK(werr)) {
107                 return werr;
108         }
109
110         if (!found &&
111             !(options & DRSUAPI_DRS_GETCHG_CHECK) &&
112             !(options & DRSUAPI_DRS_ADD_REF)) {
113                 return WERR_DS_DRA_REF_NOT_FOUND;
114         }
115
116         return WERR_OK; 
117 }
118
119 /* 
120   drsuapi_DsReplicaUpdateRefs - a non RPC version callable from getncchanges
121 */
122 WERROR drsuapi_UpdateRefs(struct drsuapi_bind_state *b_state, TALLOC_CTX *mem_ctx,
123                           struct drsuapi_DsReplicaUpdateRefsRequest1 *req)
124 {
125         WERROR werr;
126         struct ldb_dn *dn;
127
128         DEBUG(4,("DsReplicaUpdateRefs for host '%s' with GUID %s options 0x%08x nc=%s\n",
129                  req->dest_dsa_dns_name, GUID_string(mem_ctx, &req->dest_dsa_guid),
130                  req->options,
131                  drs_ObjectIdentifier_to_string(mem_ctx, req->naming_context)));
132
133         dn = ldb_dn_new(mem_ctx, b_state->sam_ctx, req->naming_context->dn);
134         if (dn == NULL) {
135                 return WERR_DS_INVALID_DN_SYNTAX;
136         }
137
138         if (ldb_transaction_start(b_state->sam_ctx) != LDB_SUCCESS) {
139                 DEBUG(0,(__location__ ": Failed to start transaction on samdb\n"));
140                 return WERR_DS_DRA_INTERNAL_ERROR;              
141         }
142
143         if (req->options & DRSUAPI_DRS_DEL_REF) {
144                 werr = uref_del_dest(b_state->sam_ctx, mem_ctx, dn, &req->dest_dsa_guid, req->options);
145                 if (!W_ERROR_IS_OK(werr)) {
146                         DEBUG(0,("Failed to delete repsTo for %s\n",
147                                  GUID_string(mem_ctx, &req->dest_dsa_guid)));
148                         goto failed;
149                 }
150         }
151
152         if (req->options & DRSUAPI_DRS_ADD_REF) {
153                 struct repsFromTo1 dest;
154                 struct repsFromTo1OtherInfo oi;
155                 
156                 ZERO_STRUCT(dest);
157                 ZERO_STRUCT(oi);
158
159                 oi.dns_name = req->dest_dsa_dns_name;
160                 dest.other_info          = &oi;
161                 dest.source_dsa_obj_guid = req->dest_dsa_guid;
162                 dest.replica_flags       = req->options;
163
164                 werr = uref_add_dest(b_state->sam_ctx, mem_ctx, dn, &dest, req->options);
165                 if (!W_ERROR_IS_OK(werr)) {
166                         DEBUG(0,("Failed to add repsTo for %s\n",
167                                  GUID_string(mem_ctx, &dest.source_dsa_obj_guid)));
168                         goto failed;
169                 }
170         }
171
172         if (ldb_transaction_commit(b_state->sam_ctx) != LDB_SUCCESS) {
173                 DEBUG(0,(__location__ ": Failed to commit transaction on samdb\n"));
174                 return WERR_DS_DRA_INTERNAL_ERROR;              
175         }
176
177         return WERR_OK;
178
179 failed:
180         ldb_transaction_cancel(b_state->sam_ctx);
181         return werr;
182 }
183
184 /* 
185   drsuapi_DsReplicaUpdateRefs
186 */
187 WERROR dcesrv_drsuapi_DsReplicaUpdateRefs(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
188                                           struct drsuapi_DsReplicaUpdateRefs *r)
189 {
190         struct dcesrv_handle *h;
191         struct drsuapi_bind_state *b_state;
192         struct drsuapi_DsReplicaUpdateRefsRequest1 *req;
193         WERROR werr;
194         int ret;
195         enum security_user_level security_level;
196
197         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
198         b_state = h->data;
199
200         werr = drs_security_level_check(dce_call, "DsReplicaUpdateRefs", SECURITY_RO_DOMAIN_CONTROLLER,
201                                         samdb_domain_sid(b_state->sam_ctx));
202         if (!W_ERROR_IS_OK(werr)) {
203                 return werr;
204         }
205
206         if (r->in.level != 1) {
207                 DEBUG(0,("DrReplicUpdateRefs - unsupported level %u\n", r->in.level));
208                 return WERR_DS_DRA_INVALID_PARAMETER;
209         }
210
211         req = &r->in.req.req1;
212
213         security_level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
214         if (security_level < SECURITY_ADMINISTRATOR) {
215                 /* check that they are using an DSA objectGUID that they own */
216                 ret = dsdb_validate_dsa_guid(b_state->sam_ctx,
217                                              &req->dest_dsa_guid,
218                                              dce_call->conn->auth_state.session_info->security_token->user_sid);
219                 if (ret != LDB_SUCCESS) {
220                         DEBUG(0,(__location__ ": Refusing DsReplicaUpdateRefs for sid %s with GUID %s\n",
221                                  dom_sid_string(mem_ctx,
222                                                 dce_call->conn->auth_state.session_info->security_token->user_sid),
223                                  GUID_string(mem_ctx, &req->dest_dsa_guid)));
224                         return WERR_DS_DRA_ACCESS_DENIED;
225                 }
226         }
227
228         return drsuapi_UpdateRefs(b_state, mem_ctx, req);
229 }