Attachment 8056 Details for Bug 9256 – Proposed patch to fix part 1

[patch] Proposed patch to fix part 1

0007-s4-drs-EXOP_REPL_SECRETS-can-be-called-by-RW-DC-as-w.patch (text/plain), 3.67 KB, created by Matthieu Patou on 2012-10-13 07:22:05 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Matthieu Patou

Created: 2012-10-13 07:22:05 UTC

Size: 3.67 KB

patch

obsolete

>From 8dbba524bfc2bbf8117f51f3dffd2a08835d485d Mon Sep 17 00:00:00 2001
>From: Matthieu Patou <mat@matws.net>
>Date: Wed, 26 Sep 2012 11:44:58 -0700
>Subject: [PATCH 07/20] s4-drs: EXOP_REPL_SECRETS can be called by RW DC as
> well
>
>---
> source4/rpc_server/drsuapi/getncchanges.c |   22 +++++++++++++++-------
> 1 file changed, 15 insertions(+), 7 deletions(-)
>
>diff --git a/source4/rpc_server/drsuapi/getncchanges.c b/source4/rpc_server/drsuapi/getncchanges.c
>index f65fa2c..871fc68 100644
>--- a/source4/rpc_server/drsuapi/getncchanges.c
>+++ b/source4/rpc_server/drsuapi/getncchanges.c
>@@ -882,7 +882,8 @@ static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
> 				       TALLOC_CTX *mem_ctx,
> 				       struct drsuapi_DsGetNCChangesRequest10 *req10,
> 				       struct dom_sid *user_sid,
>-				       struct drsuapi_DsGetNCChangesCtr6 *ctr6)
>+				       struct drsuapi_DsGetNCChangesCtr6 *ctr6,
>+				       bool has_get_all_changes)
> {
> 	struct drsuapi_DsReplicaObjectIdentifier *ncRoot = req10->naming_context;
> 	struct ldb_dn *obj_dn, *rodc_dn, *krbtgt_link_dn;
>@@ -897,7 +898,7 @@ static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
> 		 drs_ObjectIdentifier_to_string(mem_ctx, ncRoot)));
> 
> 	/*
>-	 * we need to work out if we will allow this RODC to
>+	 * we need to work out if we will allow this DC to
> 	 * replicate the secrets for this object
> 	 *
> 	 * see 4.1.10.5.14 GetRevealSecretsPolicyForUser for details
>@@ -981,20 +982,21 @@ static WERROR getncchanges_repl_secret(struct drsuapi_bind_state *b_state,
> 
> 	/* default deny */
> denied:
>-	DEBUG(2,(__location__ ": Denied RODC secret replication for %s by RODC %s\n",
>+	DEBUG(2,(__location__ ": Denied single object with secret replication for %s by RODC %s\n",
> 		 ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
> 	ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
> 	return WERR_DS_DRA_ACCESS_DENIED;
> 
> allowed:
>-	DEBUG(2,(__location__ ": Allowed RODC secret replication for %s by RODC %s\n",
>-		 ldb_dn_get_linearized(obj_dn), ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
>+	DEBUG(2,(__location__ ": Allowed single object with secret replication for %s by %s %s\n",
>+		 ldb_dn_get_linearized(obj_dn), has_get_all_changes?"RWDC":"RODC",
>+		 ldb_dn_get_linearized(rodc_res->msgs[0]->dn)));
> 	ctr6->extended_ret = DRSUAPI_EXOP_ERR_SUCCESS;
> 	req10->highwatermark.highest_usn = 0;
> 	return WERR_OK;
> 
> failed:
>-	DEBUG(2,(__location__ ": Failed RODC secret replication for %s by RODC %s\n",
>+	DEBUG(2,(__location__ ": Failed single secret replication for %s by RODC %s\n",
> 		 ldb_dn_get_linearized(obj_dn), dom_sid_string(mem_ctx, user_sid)));
> 	ctr6->extended_ret = DRSUAPI_EXOP_ERR_NONE;
> 	return WERR_DS_DRA_BAD_DN;
>@@ -1437,6 +1439,7 @@ WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_
> 	time_t max_wait;
> 	time_t start = time(NULL);
> 	bool max_wait_reached = false;
>+	bool has_get_all_changes = false;
> 
> 	DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
> 	b_state = h->data;
>@@ -1538,6 +1541,8 @@ WERROR dcesrv_drsuapi_DsGetNCChanges(struct dcesrv_call_state *dce_call, TALLOC_
> 							 GUID_DRS_GET_ALL_CHANGES);
> 		if (!W_ERROR_IS_OK(werr)) {
> 			return werr;
>+		} else {
>+			has_get_all_changes = true;
> 		}
> 	}
> 
>@@ -1605,7 +1610,10 @@ allowed:
> 			search_dn = ldb_get_default_basedn(sam_ctx);
> 			break;
> 		case DRSUAPI_EXOP_REPL_SECRET:
>-			werr = getncchanges_repl_secret(b_state, mem_ctx, req10, user_sid, &r->out.ctr->ctr6);
>+			werr = getncchanges_repl_secret(b_state, mem_ctx, req10,
>+						        user_sid,
>+						        &r->out.ctr->ctr6,
>+						        has_get_all_changes);
> 			r->out.result = werr;
> 			W_ERROR_NOT_OK_RETURN(werr);
> 			break;
>-- 
>1.7.9.5
>

Flags:

abartlet: review+

Actions: View

Attachments on bug 9256: 8056 | 8057