source: trunk/server/source4/rpc_server/drsuapi/writespn.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 6.6 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 implement the DsWriteAccountSpn call
5
6 Copyright (C) Stefan Metzmacher 2009
7 Copyright (C) Andrew Tridgell 2010
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23#include "includes.h"
24#include "rpc_server/dcerpc_server.h"
25#include "dsdb/samdb/samdb.h"
26#include "dsdb/common/util.h"
27#include "system/kerberos.h"
28#include "auth/kerberos/kerberos.h"
29#include "libcli/security/security.h"
30#include "libcli/security/session.h"
31#include "rpc_server/drsuapi/dcesrv_drsuapi.h"
32#include "auth/session.h"
33
34/*
35 check that the SPN update should be allowed as an override
36 via sam_ctx_system
37
38 This is only called if the client is not a domain controller or
39 administrator
40 */
41static bool writespn_check_spn(struct drsuapi_bind_state *b_state,
42 struct dcesrv_call_state *dce_call,
43 struct ldb_dn *dn,
44 const char *spn)
45{
46 /*
47 * we only allow SPN updates if:
48 *
49 * 1) they are on the clients own account object
50 * 2) they are of the form SERVICE/dnshostname
51 */
52 struct dom_sid *user_sid, *sid;
53 TALLOC_CTX *tmp_ctx = talloc_new(dce_call);
54 struct ldb_result *res;
55 const char *attrs[] = { "objectSID", "dNSHostName", NULL };
56 int ret;
57 krb5_context krb_ctx;
58 krb5_error_code kerr;
59 krb5_principal principal;
60 const char *dns_name, *dnsHostName;
61
62 /* The service principal name shouldn't be NULL */
63 if (spn == NULL) {
64 talloc_free(tmp_ctx);
65 return false;
66 }
67
68 /*
69 get the objectSid of the DN that is being modified, and
70 check it matches the user_sid in their token
71 */
72
73 ret = dsdb_search_dn(b_state->sam_ctx, tmp_ctx, &res, dn, attrs,
74 DSDB_SEARCH_ONE_ONLY);
75 if (ret != LDB_SUCCESS) {
76 talloc_free(tmp_ctx);
77 return false;
78 }
79
80 user_sid = &dce_call->conn->auth_state.session_info->security_token->sids[PRIMARY_USER_SID_INDEX];
81 sid = samdb_result_dom_sid(tmp_ctx, res->msgs[0], "objectSid");
82 if (sid == NULL) {
83 talloc_free(tmp_ctx);
84 return false;
85 }
86
87 dnsHostName = ldb_msg_find_attr_as_string(res->msgs[0], "dNSHostName",
88 NULL);
89 if (dnsHostName == NULL) {
90 talloc_free(tmp_ctx);
91 return false;
92 }
93
94 if (!dom_sid_equal(sid, user_sid)) {
95 talloc_free(tmp_ctx);
96 return false;
97 }
98
99 kerr = smb_krb5_init_context_basic(tmp_ctx,
100 dce_call->conn->dce_ctx->lp_ctx,
101 &krb_ctx);
102 if (kerr != 0) {
103 talloc_free(tmp_ctx);
104 return false;
105 }
106
107 ret = krb5_parse_name_flags(krb_ctx, spn, KRB5_PRINCIPAL_PARSE_NO_REALM,
108 &principal);
109 if (kerr != 0) {
110 krb5_free_context(krb_ctx);
111 talloc_free(tmp_ctx);
112 return false;
113 }
114
115 if (principal->name.name_string.len != 2) {
116 krb5_free_principal(krb_ctx, principal);
117 krb5_free_context(krb_ctx);
118 talloc_free(tmp_ctx);
119 return false;
120 }
121
122 dns_name = principal->name.name_string.val[1];
123
124 if (strcasecmp(dns_name, dnsHostName) != 0) {
125 krb5_free_principal(krb_ctx, principal);
126 krb5_free_context(krb_ctx);
127 talloc_free(tmp_ctx);
128 return false;
129 }
130
131 /* its a simple update on their own account - allow it with
132 * permissions override */
133 krb5_free_principal(krb_ctx, principal);
134 krb5_free_context(krb_ctx);
135 talloc_free(tmp_ctx);
136
137 return true;
138}
139
140/*
141 drsuapi_DsWriteAccountSpn
142*/
143WERROR dcesrv_drsuapi_DsWriteAccountSpn(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
144 struct drsuapi_DsWriteAccountSpn *r)
145{
146 struct drsuapi_bind_state *b_state;
147 struct dcesrv_handle *h;
148 enum security_user_level level;
149
150 *r->out.level_out = r->in.level;
151
152 DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
153 b_state = h->data;
154
155 r->out.res = talloc(mem_ctx, union drsuapi_DsWriteAccountSpnResult);
156 W_ERROR_HAVE_NO_MEMORY(r->out.res);
157
158 level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
159
160 switch (r->in.level) {
161 case 1: {
162 struct drsuapi_DsWriteAccountSpnRequest1 *req;
163 struct ldb_message *msg;
164 uint32_t count;
165 unsigned int i;
166 int ret;
167 unsigned spn_count=0;
168 bool passed_checks = true;
169 struct ldb_context *sam_ctx;
170
171 req = &r->in.req->req1;
172 count = req->count;
173
174 msg = ldb_msg_new(mem_ctx);
175 if (msg == NULL) {
176 return WERR_NOMEM;
177 }
178
179 msg->dn = ldb_dn_new(msg, b_state->sam_ctx,
180 req->object_dn);
181 if ( ! ldb_dn_validate(msg->dn)) {
182 r->out.res->res1.status = WERR_OK;
183 return WERR_OK;
184 }
185
186 /* construct mods */
187 for (i = 0; i < count; i++) {
188 if (!writespn_check_spn(b_state,
189 dce_call,
190 msg->dn,
191 req->spn_names[i].str)) {
192 passed_checks = false;
193 }
194 ret = ldb_msg_add_string(msg,
195 "servicePrincipalName",
196 req->spn_names[i].str);
197 if (ret != LDB_SUCCESS) {
198 return WERR_NOMEM;
199 }
200 spn_count++;
201 }
202
203 if (msg->num_elements == 0) {
204 DEBUG(2,("No SPNs need changing on %s\n",
205 ldb_dn_get_linearized(msg->dn)));
206 r->out.res->res1.status = WERR_OK;
207 return WERR_OK;
208 }
209
210 for (i=0;i<msg->num_elements;i++) {
211 switch (req->operation) {
212 case DRSUAPI_DS_SPN_OPERATION_ADD:
213 msg->elements[i].flags = LDB_FLAG_MOD_ADD;
214 break;
215 case DRSUAPI_DS_SPN_OPERATION_REPLACE:
216 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
217 break;
218 case DRSUAPI_DS_SPN_OPERATION_DELETE:
219 msg->elements[i].flags = LDB_FLAG_MOD_DELETE;
220 break;
221 }
222 }
223
224 if (passed_checks && b_state->sam_ctx_system) {
225 sam_ctx = b_state->sam_ctx_system;
226 } else {
227 sam_ctx = b_state->sam_ctx;
228 }
229
230 /* Apply to database */
231 ret = dsdb_modify(sam_ctx, msg, DSDB_MODIFY_PERMISSIVE);
232 if (ret != LDB_SUCCESS) {
233 DEBUG(0,("Failed to modify SPNs on %s: %s\n",
234 ldb_dn_get_linearized(msg->dn),
235 ldb_errstring(b_state->sam_ctx)));
236 r->out.res->res1.status = WERR_ACCESS_DENIED;
237 } else {
238 DEBUG(2,("Modified %u SPNs on %s\n", spn_count,
239 ldb_dn_get_linearized(msg->dn)));
240 r->out.res->res1.status = WERR_OK;
241 }
242
243 return WERR_OK;
244 }
245 }
246
247 return WERR_UNKNOWN_LEVEL;
248}
Note: See TracBrowser for help on using the repository browser.