source: trunk/server/source4/rpc_server/drsuapi/addentry.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 6.9 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 implement the DsAddEntry call
5
6 Copyright (C) Stefan Metzmacher 2009
7 Copyright (C) Andrew Tridgell 2009
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23#include "includes.h"
24#include "rpc_server/dcerpc_server.h"
25#include "dsdb/samdb/samdb.h"
26#include "dsdb/common/util.h"
27#include "param/param.h"
28#include "libcli/security/security.h"
29#include "libcli/security/session.h"
30#include "rpc_server/drsuapi/dcesrv_drsuapi.h"
31#include "librpc/gen_ndr/ndr_drsuapi.h"
32
33/*
34 add special SPNs needed for DRS replication to machine accounts when
35 an AddEntry is done to create a nTDSDSA object
36 */
37static WERROR drsuapi_add_SPNs(struct drsuapi_bind_state *b_state,
38 struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
39 const struct drsuapi_DsReplicaObjectListItem *first_object)
40{
41 int ret;
42 const struct drsuapi_DsReplicaObjectListItem *obj;
43 const char *attrs[] = { "serverReference", "objectGUID", NULL };
44
45 for (obj = first_object; obj; obj=obj->next_object) {
46 const char *dn_string = obj->object.identifier->dn;
47 struct ldb_dn *dn = ldb_dn_new(mem_ctx, b_state->sam_ctx, dn_string);
48 struct ldb_result *res, *res2;
49 struct ldb_dn *ref_dn;
50 struct GUID ntds_guid;
51 struct ldb_message *msg;
52 struct ldb_message_element *el;
53 const char *ntds_guid_str;
54 const char *dom_string;
55 const char *attrs2[] = { "dNSHostName", "cn", NULL };
56 const char *dNSHostName, *cn;
57
58 DEBUG(6,(__location__ ": Adding SPNs for %s\n",
59 ldb_dn_get_linearized(dn)));
60
61 ret = ldb_search(b_state->sam_ctx, mem_ctx, &res,
62 dn, LDB_SCOPE_BASE, attrs,
63 "(objectClass=ntDSDSA)");
64 if (ret != LDB_SUCCESS || res->count < 1) {
65 DEBUG(0,(__location__ ": Failed to find dn '%s'\n", dn_string));
66 return WERR_DS_DRA_INTERNAL_ERROR;
67 }
68
69 ref_dn = samdb_result_dn(b_state->sam_ctx, mem_ctx, res->msgs[0], "serverReference", NULL);
70 if (ref_dn == NULL) {
71 /* we only add SPNs for objects with a
72 serverReference */
73 continue;
74 }
75
76 DEBUG(6,(__location__ ": serverReference %s\n",
77 ldb_dn_get_linearized(ref_dn)));
78
79 ntds_guid = samdb_result_guid(res->msgs[0], "objectGUID");
80
81 ntds_guid_str = GUID_string(res, &ntds_guid);
82
83 dom_string = lpcfg_dnsdomain(dce_call->conn->dce_ctx->lp_ctx);
84
85 /* get the dNSHostName and cn */
86 ret = ldb_search(b_state->sam_ctx, mem_ctx, &res2,
87 ref_dn, LDB_SCOPE_BASE, attrs2, NULL);
88 if (ret != LDB_SUCCESS) {
89 DEBUG(0,(__location__ ": Failed to find ref_dn '%s'\n",
90 ldb_dn_get_linearized(ref_dn)));
91 return WERR_DS_DRA_INTERNAL_ERROR;
92 }
93
94 dNSHostName = ldb_msg_find_attr_as_string(res2->msgs[0], "dNSHostName", NULL);
95 cn = ldb_msg_find_attr_as_string(res2->msgs[0], "cn", NULL);
96
97 /*
98 * construct a modify request to add the new SPNs to
99 * the machine account
100 */
101 msg = ldb_msg_new(mem_ctx);
102 if (msg == NULL) {
103 return WERR_NOMEM;
104 }
105
106 msg->dn = ref_dn;
107 ret = ldb_msg_add_empty(msg, "servicePrincipalName",
108 LDB_FLAG_MOD_ADD, &el);
109 if (ret != LDB_SUCCESS) {
110 return WERR_NOMEM;
111 }
112
113
114 ldb_msg_add_steal_string(msg, "servicePrincipalName",
115 talloc_asprintf(el->values,
116 "E3514235-4B06-11D1-AB04-00C04FC2DCD2/%s/%s",
117 ntds_guid_str, dom_string));
118 ldb_msg_add_steal_string(msg, "servicePrincipalName",
119 talloc_asprintf(el->values, "ldap/%s._msdcs.%s",
120 ntds_guid_str, dom_string));
121 if (cn) {
122 ldb_msg_add_steal_string(msg, "servicePrincipalName",
123 talloc_asprintf(el->values, "ldap/%s", cn));
124 }
125 if (dNSHostName) {
126 ldb_msg_add_steal_string(msg, "servicePrincipalName",
127 talloc_asprintf(el->values, "ldap/%s", dNSHostName));
128 }
129 if (el->num_values < 2) {
130 return WERR_NOMEM;
131 }
132
133 ret = dsdb_modify(b_state->sam_ctx, msg, DSDB_MODIFY_PERMISSIVE);
134 if (ret != LDB_SUCCESS) {
135 DEBUG(0,(__location__ ": Failed to add SPNs - %s\n",
136 ldb_errstring(b_state->sam_ctx)));
137 return WERR_DS_DRA_INTERNAL_ERROR;
138 }
139 }
140
141 return WERR_OK;
142}
143
144
145
146
147/*
148 drsuapi_DsAddEntry
149*/
150WERROR dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
151 struct drsuapi_DsAddEntry *r)
152{
153 WERROR status;
154 struct drsuapi_bind_state *b_state;
155 struct dcesrv_handle *h;
156 uint32_t num = 0;
157 struct drsuapi_DsReplicaObjectIdentifier2 *ids = NULL;
158 int ret;
159 const struct drsuapi_DsReplicaObjectListItem *first_object;
160
161 if (DEBUGLVL(4)) {
162 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsAddEntry, NDR_IN, r);
163 }
164
165 /* TODO: check which out level the client supports */
166
167 ZERO_STRUCTP(r->out.ctr);
168 *r->out.level_out = 3;
169 r->out.ctr->ctr3.err_ver = 1;
170 r->out.ctr->ctr3.err_data = talloc_zero(mem_ctx, union drsuapi_DsAddEntry_ErrData);
171
172 DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
173 b_state = h->data;
174
175 status = drs_security_level_check(dce_call, "DsAddEntry", SECURITY_DOMAIN_CONTROLLER, NULL);
176 if (!W_ERROR_IS_OK(status)) {
177 return status;
178 }
179
180 switch (r->in.level) {
181 case 2:
182 ret = ldb_transaction_start(b_state->sam_ctx);
183 if (ret != LDB_SUCCESS) {
184 return WERR_DS_DRA_INTERNAL_ERROR;
185 }
186
187
188 first_object = &r->in.req->req2.first_object;
189
190 status = dsdb_origin_objects_commit(b_state->sam_ctx,
191 mem_ctx,
192 first_object,
193 &num,
194 &ids);
195 if (!W_ERROR_IS_OK(status)) {
196 r->out.ctr->ctr3.err_data->v1.status = status;
197 ldb_transaction_cancel(b_state->sam_ctx);
198 DEBUG(0,(__location__ ": DsAddEntry failed - %s\n", win_errstr(status)));
199 return status;
200 }
201
202 r->out.ctr->ctr3.count = num;
203 r->out.ctr->ctr3.objects = ids;
204
205 break;
206 default:
207 return WERR_FOOBAR;
208 }
209
210 /* if any of the added entries are nTDSDSA objects then we
211 * need to add the SPNs to the machine account
212 */
213 status = drsuapi_add_SPNs(b_state, dce_call, mem_ctx, first_object);
214 if (!W_ERROR_IS_OK(status)) {
215 r->out.ctr->ctr3.err_data->v1.status = status;
216 ldb_transaction_cancel(b_state->sam_ctx);
217 DEBUG(0,(__location__ ": DsAddEntry add SPNs failed - %s\n", win_errstr(status)));
218 return status;
219 }
220
221 ret = ldb_transaction_commit(b_state->sam_ctx);
222 if (ret != LDB_SUCCESS) {
223 DEBUG(0,(__location__ ": DsAddEntry commit failed: %s\n",
224 ldb_errstring(b_state->sam_ctx)));
225 return WERR_DS_DRA_INTERNAL_ERROR;
226 }
227
228 return WERR_OK;
229}
Note: See TracBrowser for help on using the repository browser.