2 Unix SMB/CIFS implementation.
4 implement the DRSUpdateRefs call
6 Copyright (C) Andrew Tridgell 2009
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "rpc_server/dcerpc_server.h"
24 #include "dsdb/samdb/samdb.h"
25 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
26 #include "libcli/security/security.h"
27 #include "auth/session.h"
28 #include "librpc/gen_ndr/ndr_drsuapi.h"
32 struct repsFromToBlob *r;
36 add a replication destination for a given partition GUID
38 static WERROR uref_add_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
39 struct ldb_dn *dn, struct repsFromTo1 *dest,
46 werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
47 if (!W_ERROR_IS_OK(werr)) {
51 for (i=0; i<reps.count; i++) {
52 if (GUID_compare(&dest->source_dsa_obj_guid,
53 &reps.r[i].ctr.ctr1.source_dsa_obj_guid) == 0) {
54 if (options & DRSUAPI_DRS_GETCHG_CHECK) {
57 return WERR_DS_DRA_REF_ALREADY_EXISTS;
62 reps.r = talloc_realloc(mem_ctx, reps.r, struct repsFromToBlob, reps.count+1);
64 return WERR_DS_DRA_INTERNAL_ERROR;
66 ZERO_STRUCT(reps.r[reps.count]);
67 reps.r[reps.count].version = 1;
68 reps.r[reps.count].ctr.ctr1 = *dest;
69 /* add the GCSPN flag if the client asked for it */
70 reps.r[reps.count].ctr.ctr1.replica_flags |= (options & DRSUAPI_DRS_REF_GCSPN);
73 werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
74 if (!W_ERROR_IS_OK(werr)) {
82 delete a replication destination for a given partition GUID
84 static WERROR uref_del_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
85 struct ldb_dn *dn, struct GUID *dest_guid,
93 werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
94 if (!W_ERROR_IS_OK(werr)) {
98 for (i=0; i<reps.count; i++) {
99 if (GUID_compare(dest_guid, &reps.r[i].ctr.ctr1.source_dsa_obj_guid) == 0) {
100 if (i+1 < reps.count) {
101 memmove(&reps.r[i], &reps.r[i+1], sizeof(reps.r[i])*(reps.count-(i+1)));
108 werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
109 if (!W_ERROR_IS_OK(werr)) {
114 !(options & DRSUAPI_DRS_GETCHG_CHECK) &&
115 !(options & DRSUAPI_DRS_ADD_REF)) {
116 return WERR_DS_DRA_REF_NOT_FOUND;
123 drsuapi_DsReplicaUpdateRefs - a non RPC version callable from getncchanges
125 WERROR drsuapi_UpdateRefs(struct drsuapi_bind_state *b_state, TALLOC_CTX *mem_ctx,
126 struct drsuapi_DsReplicaUpdateRefsRequest1 *req)
130 struct ldb_context *sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
132 DEBUG(4,("DsReplicaUpdateRefs for host '%s' with GUID %s options 0x%08x nc=%s\n",
133 req->dest_dsa_dns_name, GUID_string(mem_ctx, &req->dest_dsa_guid),
135 drs_ObjectIdentifier_to_string(mem_ctx, req->naming_context)));
137 dn = ldb_dn_new(mem_ctx, sam_ctx, req->naming_context->dn);
139 return WERR_DS_INVALID_DN_SYNTAX;
142 if (ldb_transaction_start(sam_ctx) != LDB_SUCCESS) {
143 DEBUG(0,(__location__ ": Failed to start transaction on samdb: %s\n",
144 ldb_errstring(sam_ctx)));
145 return WERR_DS_DRA_INTERNAL_ERROR;
148 if (req->options & DRSUAPI_DRS_DEL_REF) {
149 werr = uref_del_dest(sam_ctx, mem_ctx, dn, &req->dest_dsa_guid, req->options);
150 if (!W_ERROR_IS_OK(werr)) {
151 DEBUG(0,("Failed to delete repsTo for %s: %s\n",
152 GUID_string(mem_ctx, &req->dest_dsa_guid),
158 if (req->options & DRSUAPI_DRS_ADD_REF) {
159 struct repsFromTo1 dest;
160 struct repsFromTo1OtherInfo oi;
165 oi.dns_name = req->dest_dsa_dns_name;
166 dest.other_info = &oi;
167 dest.source_dsa_obj_guid = req->dest_dsa_guid;
168 dest.replica_flags = req->options;
170 werr = uref_add_dest(sam_ctx, mem_ctx, dn, &dest, req->options);
171 if (!W_ERROR_IS_OK(werr)) {
172 DEBUG(0,("Failed to add repsTo for %s: %s\n",
173 GUID_string(mem_ctx, &dest.source_dsa_obj_guid),
179 if (ldb_transaction_commit(sam_ctx) != LDB_SUCCESS) {
180 DEBUG(0,(__location__ ": Failed to commit transaction on samdb: %s\n",
181 ldb_errstring(sam_ctx)));
182 return WERR_DS_DRA_INTERNAL_ERROR;
188 ldb_transaction_cancel(sam_ctx);
193 drsuapi_DsReplicaUpdateRefs
195 WERROR dcesrv_drsuapi_DsReplicaUpdateRefs(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
196 struct drsuapi_DsReplicaUpdateRefs *r)
198 struct dcesrv_handle *h;
199 struct drsuapi_bind_state *b_state;
200 struct drsuapi_DsReplicaUpdateRefsRequest1 *req;
203 enum security_user_level security_level;
205 DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
208 if (r->in.level != 1) {
209 DEBUG(0,("DrReplicUpdateRefs - unsupported level %u\n", r->in.level));
210 return WERR_DS_DRA_INVALID_PARAMETER;
212 req = &r->in.req.req1;
213 werr = drs_security_access_check(b_state->sam_ctx,
215 dce_call->conn->auth_state.session_info->security_token,
217 GUID_DRS_MANAGE_TOPOLOGY);
219 if (!W_ERROR_IS_OK(werr)) {
223 security_level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
224 if (security_level < SECURITY_ADMINISTRATOR) {
225 /* check that they are using an DSA objectGUID that they own */
226 ret = dsdb_validate_dsa_guid(b_state->sam_ctx,
228 &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]);
229 if (ret != LDB_SUCCESS) {
230 DEBUG(0,(__location__ ": Refusing DsReplicaUpdateRefs for sid %s with GUID %s\n",
231 dom_sid_string(mem_ctx,
232 &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]),
233 GUID_string(mem_ctx, &req->dest_dsa_guid)));
234 return WERR_DS_DRA_ACCESS_DENIED;
238 werr = drsuapi_UpdateRefs(b_state, mem_ctx, req);
241 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsReplicaUpdateRefs, NDR_BOTH, r);