source4/rpc_server/drsuapi/updaterefs.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    implement the DRSUpdateRefs call
   5
   6    Copyright (C) Andrew Tridgell 2009
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "rpc_server/dcerpc_server.h"
  24 #include "dsdb/samdb/samdb.h"
  25 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
  26 #include "libcli/security/security.h"
  27 #include "auth/session.h"
  28
  29 struct repsTo {
  30         uint32_t count;
  31         struct repsFromToBlob *r;
  32 };
  33
  34 /*
  35   add a replication destination for a given partition GUID
  36  */
  37 static WERROR uref_add_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
  38                             struct ldb_dn *dn, struct repsFromTo1 *dest,
  39                             uint32_t options)
  40 {
  41         struct repsTo reps;
  42         WERROR werr;
  43         unsigned int i;
  44
  45         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
  46         if (!W_ERROR_IS_OK(werr)) {
  47                 return werr;
  48         }
  49
  50         for (i=0; i<reps.count; i++) {
  51                 if (GUID_compare(&dest->source_dsa_obj_guid,
  52                                  &reps.r[i].ctr.ctr1.source_dsa_obj_guid) == 0) {
  53                         if (options & DRSUAPI_DRS_GETCHG_CHECK) {
  54                                 return WERR_OK;
  55                         } else {
  56                                 return WERR_DS_DRA_REF_ALREADY_EXISTS;
  57                         }
  58                 }
  59         }
  60
  61         reps.r = talloc_realloc(mem_ctx, reps.r, struct repsFromToBlob, reps.count+1);
  62         if (reps.r == NULL) {
  63                 return WERR_DS_DRA_INTERNAL_ERROR;
  64         }
  65         ZERO_STRUCT(reps.r[reps.count]);
  66         reps.r[reps.count].version = 1;
  67         reps.r[reps.count].ctr.ctr1 = *dest;
  68         reps.count++;
  69
  70         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
  71         if (!W_ERROR_IS_OK(werr)) {
  72                 return werr;
  73         }
  74
  75         return WERR_OK;
  76 }
  77
  78 /*
  79   delete a replication destination for a given partition GUID
  80  */
  81 static WERROR uref_del_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
  82                             struct ldb_dn *dn, struct GUID *dest_guid,
  83                             uint32_t options)
  84 {
  85         struct repsTo reps;
  86         WERROR werr;
  87         unsigned int i;
  88         bool found = false;
  89
  90         werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
  91         if (!W_ERROR_IS_OK(werr)) {
  92                 return werr;
  93         }
  94
  95         for (i=0; i<reps.count; i++) {
  96                 if (GUID_compare(dest_guid, &reps.r[i].ctr.ctr1.source_dsa_obj_guid) == 0) {
  97                         if (i+1 < reps.count) {
  98                                 memmove(&reps.r[i], &reps.r[i+1], sizeof(reps.r[i])*(reps.count-(i+1)));
  99                         }
 100                         reps.count--;
 101                         found = true;
 102                 }
 103         }
 104
 105         werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
 106         if (!W_ERROR_IS_OK(werr)) {
 107                 return werr;
 108         }
 109
 110         if (!found &&
 111             !(options & DRSUAPI_DRS_GETCHG_CHECK) &&
 112             !(options & DRSUAPI_DRS_ADD_REF)) {
 113                 return WERR_DS_DRA_REF_NOT_FOUND;
 114         }
 115
 116         return WERR_OK;
 117 }
 118
 119 /*
 120   drsuapi_DsReplicaUpdateRefs - a non RPC version callable from getncchanges
 121 */
 122 WERROR drsuapi_UpdateRefs(struct drsuapi_bind_state *b_state, TALLOC_CTX *mem_ctx,
 123                           struct drsuapi_DsReplicaUpdateRefsRequest1 *req)
 124 {
 125         WERROR werr;
 126         struct ldb_dn *dn;
 127
 128         DEBUG(4,("DsReplicaUpdateRefs for host '%s' with GUID %s options 0x%08x nc=%s\n",
 129                  req->dest_dsa_dns_name, GUID_string(mem_ctx, &req->dest_dsa_guid),
 130                  req->options,
 131                  drs_ObjectIdentifier_to_string(mem_ctx, req->naming_context)));
 132
 133         dn = ldb_dn_new(mem_ctx, b_state->sam_ctx, req->naming_context->dn);
 134         if (dn == NULL) {
 135                 return WERR_DS_INVALID_DN_SYNTAX;
 136         }
 137
 138         if (ldb_transaction_start(b_state->sam_ctx) != LDB_SUCCESS) {
 139                 DEBUG(0,(__location__ ": Failed to start transaction on samdb\n"));
 140                 return WERR_DS_DRA_INTERNAL_ERROR;
 141         }
 142
 143         if (req->options & DRSUAPI_DRS_DEL_REF) {
 144                 werr = uref_del_dest(b_state->sam_ctx, mem_ctx, dn, &req->dest_dsa_guid, req->options);
 145                 if (!W_ERROR_IS_OK(werr)) {
 146                         DEBUG(0,("Failed to delete repsTo for %s\n",
 147                                  GUID_string(mem_ctx, &req->dest_dsa_guid)));
 148                         goto failed;
 149                 }
 150         }
 151
 152         if (req->options & DRSUAPI_DRS_ADD_REF) {
 153                 struct repsFromTo1 dest;
 154                 struct repsFromTo1OtherInfo oi;
 155
 156                 ZERO_STRUCT(dest);
 157                 ZERO_STRUCT(oi);
 158
 159                 oi.dns_name = req->dest_dsa_dns_name;
 160                 dest.other_info          = &oi;
 161                 dest.source_dsa_obj_guid = req->dest_dsa_guid;
 162                 dest.replica_flags       = req->options;
 163
 164                 werr = uref_add_dest(b_state->sam_ctx, mem_ctx, dn, &dest, req->options);
 165                 if (!W_ERROR_IS_OK(werr)) {
 166                         DEBUG(0,("Failed to add repsTo for %s\n",
 167                                  GUID_string(mem_ctx, &dest.source_dsa_obj_guid)));
 168                         goto failed;
 169                 }
 170         }
 171
 172         if (ldb_transaction_commit(b_state->sam_ctx) != LDB_SUCCESS) {
 173                 DEBUG(0,(__location__ ": Failed to commit transaction on samdb\n"));
 174                 return WERR_DS_DRA_INTERNAL_ERROR;
 175         }
 176
 177         return WERR_OK;
 178
 179 failed:
 180         ldb_transaction_cancel(b_state->sam_ctx);
 181         return werr;
 182 }
 183
 184 /*
 185   drsuapi_DsReplicaUpdateRefs
 186 */
 187 WERROR dcesrv_drsuapi_DsReplicaUpdateRefs(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
 188                                           struct drsuapi_DsReplicaUpdateRefs *r)
 189 {
 190         struct dcesrv_handle *h;
 191         struct drsuapi_bind_state *b_state;
 192         struct drsuapi_DsReplicaUpdateRefsRequest1 *req;
 193         WERROR werr;
 194         int ret;
 195         enum security_user_level security_level;
 196
 197         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
 198         b_state = h->data;
 199
 200         werr = drs_security_level_check(dce_call, "DsReplicaUpdateRefs", SECURITY_RO_DOMAIN_CONTROLLER);
 201         if (!W_ERROR_IS_OK(werr)) {
 202                 return werr;
 203         }
 204
 205         if (r->in.level != 1) {
 206                 DEBUG(0,("DrReplicUpdateRefs - unsupported level %u\n", r->in.level));
 207                 return WERR_DS_DRA_INVALID_PARAMETER;
 208         }
 209
 210         req = &r->in.req.req1;
 211
 212         security_level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
 213         if (security_level < SECURITY_ADMINISTRATOR) {
 214                 /* check that they are using an DSA objectGUID that they own */
 215                 ret = dsdb_validate_dsa_guid(b_state->sam_ctx,
 216                                              &req->dest_dsa_guid,
 217                                              dce_call->conn->auth_state.session_info->security_token->user_sid);
 218                 if (ret != LDB_SUCCESS) {
 219                         DEBUG(0,(__location__ ": Refusing DsReplicaUpdateRefs for sid %s with GUID %s\n",
 220                                  dom_sid_string(mem_ctx,
 221                                                 dce_call->conn->auth_state.session_info->security_token->user_sid),
 222                                  GUID_string(mem_ctx, &req->dest_dsa_guid)));
 223                         return WERR_DS_DRA_ACCESS_DENIED;
 224                 }
 225         }
 226
 227         return drsuapi_UpdateRefs(b_state, mem_ctx, req);
 228 }