source: trunk/server/source4/rpc_server/drsuapi/updaterefs.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 7.2 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 implement the DRSUpdateRefs call
5
6 Copyright (C) Andrew Tridgell 2009
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20*/
21
22#include "includes.h"
23#include "rpc_server/dcerpc_server.h"
24#include "dsdb/samdb/samdb.h"
25#include "libcli/security/security.h"
26#include "libcli/security/session.h"
27#include "rpc_server/drsuapi/dcesrv_drsuapi.h"
28#include "auth/session.h"
29#include "librpc/gen_ndr/ndr_drsuapi.h"
30
31struct repsTo {
32 uint32_t count;
33 struct repsFromToBlob *r;
34};
35
36/*
37 add a replication destination for a given partition GUID
38 */
39static WERROR uref_add_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
40 struct ldb_dn *dn, struct repsFromTo1 *dest,
41 uint32_t options)
42{
43 struct repsTo reps;
44 WERROR werr;
45 unsigned int i;
46
47 werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
48 if (!W_ERROR_IS_OK(werr)) {
49 return werr;
50 }
51
52 for (i=0; i<reps.count; i++) {
53 if (GUID_compare(&dest->source_dsa_obj_guid,
54 &reps.r[i].ctr.ctr1.source_dsa_obj_guid) == 0) {
55 if (options & DRSUAPI_DRS_GETCHG_CHECK) {
56 return WERR_OK;
57 } else {
58 return WERR_DS_DRA_REF_ALREADY_EXISTS;
59 }
60 }
61 }
62
63 reps.r = talloc_realloc(mem_ctx, reps.r, struct repsFromToBlob, reps.count+1);
64 if (reps.r == NULL) {
65 return WERR_DS_DRA_INTERNAL_ERROR;
66 }
67 ZERO_STRUCT(reps.r[reps.count]);
68 reps.r[reps.count].version = 1;
69 reps.r[reps.count].ctr.ctr1 = *dest;
70 /* add the GCSPN flag if the client asked for it */
71 reps.r[reps.count].ctr.ctr1.replica_flags |= (options & DRSUAPI_DRS_REF_GCSPN);
72 reps.count++;
73
74 werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
75 if (!W_ERROR_IS_OK(werr)) {
76 return werr;
77 }
78
79 return WERR_OK;
80}
81
82/*
83 delete a replication destination for a given partition GUID
84 */
85static WERROR uref_del_dest(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
86 struct ldb_dn *dn, struct GUID *dest_guid,
87 uint32_t options)
88{
89 struct repsTo reps;
90 WERROR werr;
91 unsigned int i;
92 bool found = false;
93
94 werr = dsdb_loadreps(sam_ctx, mem_ctx, dn, "repsTo", &reps.r, &reps.count);
95 if (!W_ERROR_IS_OK(werr)) {
96 return werr;
97 }
98
99 for (i=0; i<reps.count; i++) {
100 if (GUID_compare(dest_guid, &reps.r[i].ctr.ctr1.source_dsa_obj_guid) == 0) {
101 if (i+1 < reps.count) {
102 memmove(&reps.r[i], &reps.r[i+1], sizeof(reps.r[i])*(reps.count-(i+1)));
103 }
104 reps.count--;
105 found = true;
106 }
107 }
108
109 werr = dsdb_savereps(sam_ctx, mem_ctx, dn, "repsTo", reps.r, reps.count);
110 if (!W_ERROR_IS_OK(werr)) {
111 return werr;
112 }
113
114 if (!found &&
115 !(options & DRSUAPI_DRS_GETCHG_CHECK) &&
116 !(options & DRSUAPI_DRS_ADD_REF)) {
117 return WERR_DS_DRA_REF_NOT_FOUND;
118 }
119
120 return WERR_OK;
121}
122
123/*
124 drsuapi_DsReplicaUpdateRefs - a non RPC version callable from getncchanges
125*/
126WERROR drsuapi_UpdateRefs(struct drsuapi_bind_state *b_state, TALLOC_CTX *mem_ctx,
127 struct drsuapi_DsReplicaUpdateRefsRequest1 *req)
128{
129 WERROR werr;
130 struct ldb_dn *dn;
131 struct ldb_context *sam_ctx = b_state->sam_ctx_system?b_state->sam_ctx_system:b_state->sam_ctx;
132
133 DEBUG(4,("DsReplicaUpdateRefs for host '%s' with GUID %s options 0x%08x nc=%s\n",
134 req->dest_dsa_dns_name, GUID_string(mem_ctx, &req->dest_dsa_guid),
135 req->options,
136 drs_ObjectIdentifier_to_string(mem_ctx, req->naming_context)));
137
138 dn = ldb_dn_new(mem_ctx, sam_ctx, req->naming_context->dn);
139 if (dn == NULL) {
140 return WERR_DS_INVALID_DN_SYNTAX;
141 }
142
143 if (ldb_transaction_start(sam_ctx) != LDB_SUCCESS) {
144 DEBUG(0,(__location__ ": Failed to start transaction on samdb: %s\n",
145 ldb_errstring(sam_ctx)));
146 return WERR_DS_DRA_INTERNAL_ERROR;
147 }
148
149 if (req->options & DRSUAPI_DRS_DEL_REF) {
150 werr = uref_del_dest(sam_ctx, mem_ctx, dn, &req->dest_dsa_guid, req->options);
151 if (!W_ERROR_IS_OK(werr)) {
152 DEBUG(0,("Failed to delete repsTo for %s: %s\n",
153 GUID_string(mem_ctx, &req->dest_dsa_guid),
154 win_errstr(werr)));
155 goto failed;
156 }
157 }
158
159 if (req->options & DRSUAPI_DRS_ADD_REF) {
160 struct repsFromTo1 dest;
161 struct repsFromTo1OtherInfo oi;
162
163 ZERO_STRUCT(dest);
164 ZERO_STRUCT(oi);
165
166 oi.dns_name = req->dest_dsa_dns_name;
167 dest.other_info = &oi;
168 dest.source_dsa_obj_guid = req->dest_dsa_guid;
169 dest.replica_flags = req->options;
170
171 werr = uref_add_dest(sam_ctx, mem_ctx, dn, &dest, req->options);
172 if (!W_ERROR_IS_OK(werr)) {
173 DEBUG(0,("Failed to add repsTo for %s: %s\n",
174 GUID_string(mem_ctx, &dest.source_dsa_obj_guid),
175 win_errstr(werr)));
176 goto failed;
177 }
178 }
179
180 if (ldb_transaction_commit(sam_ctx) != LDB_SUCCESS) {
181 DEBUG(0,(__location__ ": Failed to commit transaction on samdb: %s\n",
182 ldb_errstring(sam_ctx)));
183 return WERR_DS_DRA_INTERNAL_ERROR;
184 }
185
186 return WERR_OK;
187
188failed:
189 ldb_transaction_cancel(sam_ctx);
190 return werr;
191}
192
193/*
194 drsuapi_DsReplicaUpdateRefs
195*/
196WERROR dcesrv_drsuapi_DsReplicaUpdateRefs(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
197 struct drsuapi_DsReplicaUpdateRefs *r)
198{
199 struct dcesrv_handle *h;
200 struct drsuapi_bind_state *b_state;
201 struct drsuapi_DsReplicaUpdateRefsRequest1 *req;
202 WERROR werr;
203 int ret;
204 enum security_user_level security_level;
205
206 DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
207 b_state = h->data;
208
209 if (r->in.level != 1) {
210 DEBUG(0,("DrReplicUpdateRefs - unsupported level %u\n", r->in.level));
211 return WERR_DS_DRA_INVALID_PARAMETER;
212 }
213 req = &r->in.req.req1;
214 werr = drs_security_access_check(b_state->sam_ctx,
215 mem_ctx,
216 dce_call->conn->auth_state.session_info->security_token,
217 req->naming_context,
218 GUID_DRS_MANAGE_TOPOLOGY);
219
220 if (!W_ERROR_IS_OK(werr)) {
221 return werr;
222 }
223
224 security_level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
225 if (security_level < SECURITY_ADMINISTRATOR) {
226 /* check that they are using an DSA objectGUID that they own */
227 ret = dsdb_validate_dsa_guid(b_state->sam_ctx,
228 &req->dest_dsa_guid,
229 &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]);
230 if (ret != LDB_SUCCESS) {
231 DEBUG(0,(__location__ ": Refusing DsReplicaUpdateRefs for sid %s with GUID %s\n",
232 dom_sid_string(mem_ctx,
233 &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX]),
234 GUID_string(mem_ctx, &req->dest_dsa_guid)));
235 return WERR_DS_DRA_ACCESS_DENIED;
236 }
237 }
238
239 werr = drsuapi_UpdateRefs(b_state, mem_ctx, req);
240
241#if 0
242 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsReplicaUpdateRefs, NDR_BOTH, r);
243#endif
244
245 return werr;
246}
Note: See TracBrowser for help on using the repository browser.