LCOV - code coverage report
Current view: top level - source4/dsdb/samdb/ldb_modules - unique_object_sids.c (source / functions) Hit Total Coverage
Test: coverage report for abartlet/fix-coverage dd10fb34 Lines: 67 79 84.8 %
Date: 2021-09-23 10:06:22 Functions: 6 7 85.7 %

          Line data    Source code
       1             : /*
       2             :    ldb database module to enforce unique local objectSIDs
       3             : 
       4             :    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2017
       5             : 
       6             :    This program is free software; you can redistribute it and/or modify
       7             :    it under the terms of the GNU General Public License as published by
       8             :    the Free Software Foundation; either version 3 of the License, or
       9             :    (at your option) any later version.
      10             : 
      11             :    This program is distributed in the hope that it will be useful,
      12             :    but WITHOUT ANY WARRANTY; without even the implied warranty of
      13             :    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      14             :    GNU General Public License for more details.
      15             : 
      16             :    You should have received a copy of the GNU General Public License
      17             :    along with this program.  If not, see <http://www.gnu.org/licenses/>.
      18             : */
      19             : 
      20             : /*
      21             : 
      22             :    Duplicate ObjectSIDs are possible on foreign security principals and
      23             :    replication conflict records.  However a duplicate objectSID within
      24             :    the local domainSID is an error.
      25             : 
      26             :    As the uniqueness requirement depends on the source domain it is not possible
      27             :    to enforce this with a unique index.
      28             : 
      29             :    This module sets the LDB_FLAG_FORCE_UNIQUE_INDEX for objectSIDs in the
      30             :    local domain.
      31             : */
      32             : 
      33             : #include "includes.h"
      34             : #include "ldb_module.h"
      35             : #include "dsdb/samdb/samdb.h"
      36             : #include "libcli/security/dom_sid.h"
      37             : #include "dsdb/samdb/ldb_modules/util.h"
      38             : 
      39             : struct private_data {
      40             :         const struct dom_sid *domain_sid;
      41             : };
      42             : 
      43             : 
      44             : /*
      45             :  * Does the add request contain a local objectSID
      46             :  */
      47     1718389 : static bool message_contains_local_objectSID(
      48             :         struct ldb_module *module,
      49             :         const struct ldb_message *msg)
      50             : {
      51     1718389 :         struct dom_sid *objectSID       = NULL;
      52             : 
      53     1428113 :         struct private_data *data =
      54     1718389 :                 talloc_get_type(
      55             :                         ldb_module_get_private(module),
      56             :                         struct private_data);
      57             : 
      58     1718389 :         TALLOC_CTX *frame = talloc_stackframe();
      59             : 
      60     1718389 :         objectSID = samdb_result_dom_sid(frame, msg, "objectSID");
      61     1718389 :         if (objectSID == NULL) {
      62     1634619 :                 TALLOC_FREE(frame);
      63     1532439 :                 return false;
      64             :         }
      65             : 
      66             :         /*
      67             :          * data->domain_sid can be NULL but dom_sid_in_domain handles this
      68             :          * case correctly. See unique_object_sids_init for more details.
      69             :          */
      70       83770 :         if (!dom_sid_in_domain(data->domain_sid, objectSID)) {
      71       48306 :                 TALLOC_FREE(frame);
      72       46770 :                 return false;
      73             :         }
      74       35464 :         TALLOC_FREE(frame);
      75       35326 :         return true;
      76             : }
      77             : 
      78       35463 : static int flag_objectSID(
      79             :         struct ldb_module *module,
      80             :         struct ldb_request *req,
      81             :         const struct ldb_message *msg,
      82             :         struct ldb_message **new_msg)
      83             : {
      84       35463 :         struct ldb_message_element *el  = NULL;
      85             : 
      86       35463 :         *new_msg = ldb_msg_copy_shallow(req, msg);
      87       35463 :         if (!*new_msg) {
      88           0 :                 return ldb_module_oom(module);
      89             :         }
      90             : 
      91       35463 :         el = ldb_msg_find_element(*new_msg, "objectSID");
      92       35463 :         if (el == NULL) {
      93           0 :                 struct ldb_context *ldb = NULL;
      94           0 :                 ldb = ldb_module_get_ctx(module);
      95           0 :                 ldb_asprintf_errstring(
      96             :                         ldb,
      97             :                         "Unable to locate objectSID in copied request\n");
      98           0 :                 return LDB_ERR_OPERATIONS_ERROR;
      99             :         }
     100       35463 :         el->flags |= LDB_FLAG_INTERNAL_FORCE_UNIQUE_INDEX;
     101       35463 :         return LDB_SUCCESS;
     102             : }
     103             : 
     104             : /* add */
     105      822094 : static int unique_object_sids_add(
     106             :         struct ldb_module *module,
     107             :         struct ldb_request *req)
     108             : {
     109      822094 :         const struct ldb_message *msg = req->op.add.message;
     110      822094 :         struct ldb_message *new_msg     = NULL;
     111      822094 :         struct ldb_request *new_req     = NULL;
     112      822094 :         struct ldb_context *ldb         = NULL;
     113             :         int rc;
     114             : 
     115      822094 :         if (!message_contains_local_objectSID(module, msg)) {
     116             :                 /*
     117             :                  * Request does not contain a local objectSID so chain the
     118             :                  * next module
     119             :                  */
     120      794734 :                 return ldb_next_request(module, req);
     121             :         }
     122             : 
     123             :         /*
     124             :          * The add request contains an objectSID for the local domain
     125             :          */
     126             : 
     127       27360 :         rc = flag_objectSID(module, req, msg, &new_msg);
     128       27360 :         if (rc != LDB_SUCCESS) {
     129           0 :                 return rc;
     130             :         }
     131             : 
     132       27360 :         ldb = ldb_module_get_ctx(module);
     133       27360 :         rc = ldb_build_add_req(
     134             :                 &new_req,
     135             :                 ldb,
     136             :                 req,
     137             :                 new_msg,
     138             :                 req->controls,
     139             :                 req,
     140             :                 dsdb_next_callback,
     141             :                 req);
     142       27360 :         if (rc != LDB_SUCCESS) {
     143           0 :                 return rc;
     144             :         }
     145             : 
     146       27360 :         return ldb_next_request(module, new_req);
     147             : }
     148             : 
     149             : /* modify */
     150      896295 : static int unique_object_sids_modify(
     151             :         struct ldb_module *module,
     152             :         struct ldb_request *req)
     153             : {
     154             : 
     155      896295 :         const struct ldb_message *msg   = req->op.mod.message;
     156      896295 :         struct ldb_message *new_msg     = NULL;
     157      896295 :         struct ldb_request *new_req     = NULL;
     158      896295 :         struct ldb_context *ldb         = NULL;
     159             :         int rc;
     160             : 
     161      896295 :         if (!message_contains_local_objectSID(module, msg)) {
     162             :                 /*
     163             :                  * Request does not contain a local objectSID so chain the
     164             :                  * next module
     165             :                  */
     166      888191 :                 return ldb_next_request(module, req);
     167             :         }
     168             : 
     169        8104 :         ldb = ldb_module_get_ctx(module);
     170             : 
     171             :         /*
     172             :          * If DSDB_CONTROL_REPLICATED_UPDATE_OID replicated is set we know
     173             :          * that the modify request is well formed and objectSID only appears
     174             :          * once.
     175             :          *
     176             :          * Enforcing this assumption simplifies the subsequent code.
     177             :          *
     178             :          */
     179        8104 :         if(!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
     180           1 :                 ldb_asprintf_errstring(
     181             :                         ldb,
     182             :                         "Modify of %s rejected, "
     183             :                         "as it is modifying an objectSID\n",
     184           0 :                         ldb_dn_get_linearized(msg->dn));
     185           1 :                 return LDB_ERR_UNWILLING_TO_PERFORM;
     186             :         }
     187             : 
     188             : 
     189        8103 :         rc = flag_objectSID(module, req, msg, &new_msg);
     190        8103 :         if (rc != LDB_SUCCESS) {
     191           0 :                 return rc;
     192             :         }
     193             : 
     194        8103 :         ldb = ldb_module_get_ctx(module);
     195        8103 :         rc = ldb_build_mod_req(
     196             :                 &new_req,
     197             :                 ldb,
     198             :                 req,
     199             :                 new_msg,
     200             :                 req->controls,
     201             :                 req,
     202             :                 dsdb_next_callback,
     203             :                 req);
     204        8103 :         if (rc != LDB_SUCCESS) {
     205           0 :                 return rc;
     206             :         }
     207             : 
     208        8103 :         return ldb_next_request(module, new_req);
     209             : }
     210             : 
     211             : /* init */
     212      132459 : static int unique_object_sids_init(
     213             :         struct ldb_module *module)
     214             : {
     215      132459 :         struct ldb_context *ldb = ldb_module_get_ctx(module);
     216      132459 :         struct private_data *data = NULL;
     217             :         int ret;
     218             : 
     219      132459 :         ret = ldb_next_init(module);
     220             : 
     221      132459 :         if (ret != LDB_SUCCESS) {
     222           0 :                 return ret;
     223             :         }
     224             : 
     225      132459 :         data = talloc_zero(module, struct private_data);
     226      132459 :         if (!data) {
     227           0 :                 return ldb_module_oom(module);
     228             :         }
     229             : 
     230      132459 :         data->domain_sid = samdb_domain_sid(ldb);
     231      132459 :         if (data->domain_sid == NULL) {
     232             :                 /*
     233             :                  * Unable to determine the domainSID, this normally occurs
     234             :                  * when provisioning. As there is no easy way to detect
     235             :                  * that we are provisioning.  We currently just log this as a
     236             :                  * warning.
     237             :                  */
     238         193 :                 ldb_debug(
     239             :                         ldb,
     240             :                         LDB_DEBUG_WARNING,
     241             :                         "Unable to determine the DomainSID, "
     242             :                         "can not enforce uniqueness constraint on local "
     243             :                         "domainSIDs\n");
     244             :         }
     245             : 
     246      132459 :         ldb_module_set_private(module, data);
     247             : 
     248      132459 :         return LDB_SUCCESS;
     249             : }
     250             : 
     251             : static const struct ldb_module_ops ldb_unique_object_sids_module_ops = {
     252             :         .name              = "unique_object_sids",
     253             :         .init_context      = unique_object_sids_init,
     254             :         .add               = unique_object_sids_add,
     255             :         .modify            = unique_object_sids_modify,
     256             : };
     257             : 
     258        5536 : int ldb_unique_object_sids_init(const char *version)
     259             : {
     260        5536 :         LDB_MODULE_CHECK_VERSION(version);
     261        5536 :         return ldb_register_module(&ldb_unique_object_sids_module_ops);
     262             : }

Generated by: LCOV version 1.13