gensec: Refactor gensec_security_mechs()

[samba4-gss.git] / source4 / dsdb / kcc / scavenge_dns_records.c

/*
   Unix SMB/CIFS implementation.

   DNS tombstoning routines

   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2018

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program.  If not, see <http://www.gnu.org/licenses/>.

*/

#include "includes.h"
#include <ldb_errors.h>
#include "../lib/util/dlinklist.h"
#include "librpc/gen_ndr/ndr_misc.h"
#include "librpc/gen_ndr/ndr_drsuapi.h"
#include "librpc/gen_ndr/ndr_drsblobs.h"
#include "param/param.h"
#include "lib/util/dlinklist.h"
#include "ldb.h"
#include "dsdb/kcc/scavenge_dns_records.h"
#include "lib/ldb-samba/ldb_matching_rules.h"
#include "lib/util/time.h"
#include "dns_server/dnsserver_common.h"
#include "librpc/gen_ndr/ndr_dnsp.h"
#include "param/param.h"

#include "librpc/gen_ndr/ndr_misc.h"
#include "librpc/gen_ndr/ndr_drsuapi.h"
#include "librpc/gen_ndr/ndr_drsblobs.h"

/*
 * Copy only non-expired dns records from one message element to another.
 */
static NTSTATUS copy_current_records(TALLOC_CTX *mem_ctx,
                                     struct ldb_message_element *old_el,
                                     struct ldb_message_element *el,
                                     uint32_t dns_timestamp)
{
        unsigned int i;
        struct dnsp_DnssrvRpcRecord rec;
        enum ndr_err_code ndr_err;

        el->values = talloc_zero_array(mem_ctx, struct ldb_val,
                                       old_el->num_values);
        if (el->values == NULL) {
                return NT_STATUS_NO_MEMORY;
        }

        for (i = 0; i < old_el->num_values; i++) {
                ndr_err = ndr_pull_struct_blob(
                    &(old_el->values[i]),
                    mem_ctx,
                    &rec,
                    (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                        DBG_ERR("Failed to pull dns rec blob.\n");
                        return NT_STATUS_INTERNAL_ERROR;
                }
                if (rec.dwTimeStamp > dns_timestamp ||
                    rec.dwTimeStamp == 0) {
                        el->values[el->num_values] = old_el->values[i];
                        el->num_values++;
                }
        }

        return NT_STATUS_OK;
}

/*
 * Check all records in a zone and tombstone them if they're expired.
 */
static NTSTATUS dns_tombstone_records_zone(TALLOC_CTX *mem_ctx,
                                           struct ldb_context *samdb,
                                           struct dns_server_zone *zone,
                                           uint32_t dns_timestamp,
                                           NTTIME entombed_time,
                                           char **error_string)
{
        WERROR werr;
        NTSTATUS status;
        unsigned int i;
        struct dnsserver_zoneinfo *zi = NULL;
        struct ldb_result *res = NULL;
        struct ldb_message_element *el = NULL;
        struct ldb_message_element *tombstone_el = NULL;
        struct ldb_message_element *old_el = NULL;
        struct ldb_message *new_msg = NULL;
        enum ndr_err_code ndr_err;
        int ret;
        struct GUID guid;
        struct GUID_txt_buf buf_guid;
        const char *attrs[] = {"dnsRecord",
                               "dNSTombstoned",
                               "objectGUID",
                               NULL};

        struct ldb_val true_val = {
                .data = discard_const_p(uint8_t, "TRUE"),
                .length = 4
        };

        struct ldb_val tombstone_blob;
        struct dnsp_DnssrvRpcRecord tombstone_struct = {
                .wType = DNS_TYPE_TOMBSTONE,
                .data = {.EntombedTime = entombed_time}
        };

        ndr_err = ndr_push_struct_blob(
            &tombstone_blob,
            mem_ctx,
            &tombstone_struct,
            (ndr_push_flags_fn_t)ndr_push_dnsp_DnssrvRpcRecord);
        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                *error_string = discard_const_p(char,
                                                "Failed to push TOMBSTONE"
                                                "dnsp_DnssrvRpcRecord\n");
                return NT_STATUS_INTERNAL_ERROR;
        }

        *error_string = NULL;

        /* Get NoRefreshInterval and RefreshInterval from zone properties.*/
        zi = talloc(mem_ctx, struct dnsserver_zoneinfo);
        if (zi == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
        werr = dns_get_zone_properties(samdb, mem_ctx, zone->dn, zi);
        if (W_ERROR_EQUAL(DNS_ERR(NOTZONE), werr)) {
                return NT_STATUS_PROPSET_NOT_FOUND;
        } else if (!W_ERROR_IS_OK(werr)) {
                return NT_STATUS_INTERNAL_ERROR;
        }

        /* Subtract them from current time to get the earliest possible.
         * timestamp allowed for a non-expired DNS record. */
        dns_timestamp -= zi->dwNoRefreshInterval + zi->dwRefreshInterval;

        /* Custom match gets dns records in the zone with dwTimeStamp < t. */
        ret = ldb_search(samdb,
                         mem_ctx,
                         &res,
                         zone->dn,
                         LDB_SCOPE_SUBTREE,
                         attrs,
                         "(&(objectClass=dnsNode)"
                         "(&(!(dnsTombstoned=TRUE))"
                         "(dnsRecord:" DSDB_MATCH_FOR_DNS_TO_TOMBSTONE_TIME
                         ":=%"PRIu32")))",
                         dns_timestamp);
        if (ret != LDB_SUCCESS) {
                *error_string = talloc_asprintf(mem_ctx,
                                                "Failed to search for dns "
                                                "objects in zone %s: %s",
                                                ldb_dn_get_linearized(zone->dn),
                                                ldb_errstring(samdb));
                return NT_STATUS_INTERNAL_ERROR;
        }

        /*
         * Do a constrained update on each expired DNS node. To do a constrained
         * update we leave the dnsRecord element as is, and just change the flag
         * to MOD_DELETE, then add a new element with the changes we want.  LDB
         * will run the deletion first, and bail out if a binary comparison
         * between the attribute we pass and the one in the database shows a
         * change.  This prevents race conditions.
         */
        for (i = 0; i < res->count; i++) {
                new_msg = ldb_msg_copy(mem_ctx, res->msgs[i]);
                if (new_msg == NULL) {
                        return NT_STATUS_INTERNAL_ERROR;
                }

                old_el = ldb_msg_find_element(new_msg, "dnsRecord");
                if (old_el == NULL) {
                        TALLOC_FREE(new_msg);
                        return NT_STATUS_INTERNAL_ERROR;
                }
                old_el->flags = LDB_FLAG_MOD_DELETE;

                ret = ldb_msg_add_empty(
                    new_msg, "dnsRecord", LDB_FLAG_MOD_ADD, &el);
                if (ret != LDB_SUCCESS) {
                        TALLOC_FREE(new_msg);
                        return NT_STATUS_INTERNAL_ERROR;
                }

                status = copy_current_records(new_msg, old_el, el, dns_timestamp);

                if (!NT_STATUS_IS_OK(status)) {
                        TALLOC_FREE(new_msg);
                        return NT_STATUS_INTERNAL_ERROR;
                }

                /* If nothing was expired, do nothing. */
                if (el->num_values == old_el->num_values &&
                    el->num_values != 0) {
                        TALLOC_FREE(new_msg);
                        continue;
                }

                /*
                 * If everything was expired, we tombstone the node, which
                 * involves adding a tombstone dnsRecord and a 'dnsTombstoned:
                 * TRUE' attribute. That is, we want to end up with this:
                 *
                 *  objectClass: dnsNode
                 *  dnsRecord:  { .wType = DNSTYPE_TOMBSTONE,
                 *                .data.EntombedTime = <now> }
                 *  dnsTombstoned: TRUE
                 *
                 * and no other dnsRecords.
                 */
                if (el->num_values == 0) {
                        struct ldb_val *vals = talloc_realloc(new_msg->elements,
                                                              el->values,
                                                              struct ldb_val,
                                                              1);
                        if (!vals) {
                                TALLOC_FREE(new_msg);
                                return NT_STATUS_INTERNAL_ERROR;
                        }
                        el->values = vals;
                        el->values[0] = tombstone_blob;
                        el->num_values = 1;

                        tombstone_el = ldb_msg_find_element(new_msg,
                                                  "dnsTombstoned");

                        if (tombstone_el == NULL) {
                                ret = ldb_msg_add_value(new_msg,
                                                        "dnsTombstoned",
                                                        &true_val,
                                                        &tombstone_el);
                                if (ret != LDB_SUCCESS) {
                                        TALLOC_FREE(new_msg);
                                        return NT_STATUS_INTERNAL_ERROR;
                                }
                                tombstone_el->flags = LDB_FLAG_MOD_ADD;
                        } else {
                                if (tombstone_el->num_values != 1) {
                                        vals = talloc_realloc(
                                                new_msg->elements,
                                                tombstone_el->values,
                                                struct ldb_val,
                                                1);
                                        if (!vals) {
                                                TALLOC_FREE(new_msg);
                                                return NT_STATUS_INTERNAL_ERROR;
                                        }
                                        tombstone_el->values = vals;
                                        tombstone_el->num_values = 1;
                                }
                                tombstone_el->flags = LDB_FLAG_MOD_REPLACE;
                                tombstone_el->values[0] = true_val;
                        }
                } else {
                        /*
                         * Do not change the status of dnsTombstoned if we
                         * found any live records. If it exists, its value
                         * will be the harmless "FALSE", which is what we end
                         * up with when a tombstoned record is untombstoned.
                         * (in dns_common_replace).
                         */
                        ldb_msg_remove_attr(new_msg,
                                            "dnsTombstoned");
                }

                /* Set DN to the GUID in case the object was moved. */
                el = ldb_msg_find_element(new_msg, "objectGUID");
                if (el == NULL) {
                        TALLOC_FREE(new_msg);
                        *error_string =
                            talloc_asprintf(mem_ctx,
                                            "record has no objectGUID "
                                            "in zone %s",
                                            ldb_dn_get_linearized(zone->dn));
                        return NT_STATUS_INTERNAL_ERROR;
                }

                status = GUID_from_ndr_blob(el->values, &guid);
                if (!NT_STATUS_IS_OK(status)) {
                        TALLOC_FREE(new_msg);
                        *error_string =
                            discard_const_p(char, "Error: Invalid GUID.\n");
                        return NT_STATUS_INTERNAL_ERROR;
                }

                GUID_buf_string(&guid, &buf_guid);
                new_msg->dn =
                    ldb_dn_new_fmt(mem_ctx, samdb, "<GUID=%s>", buf_guid.buf);

                /* Remove the GUID so we're not trying to modify it. */
                ldb_msg_remove_attr(new_msg, "objectGUID");

                ret = ldb_modify(samdb, new_msg);
                if (ret != LDB_SUCCESS) {
                        TALLOC_FREE(new_msg);
                        *error_string =
                            talloc_asprintf(mem_ctx,
                                            "Failed to modify dns record "
                                            "in zone %s: %s",
                                            ldb_dn_get_linearized(zone->dn),
                                            ldb_errstring(samdb));
                        return NT_STATUS_INTERNAL_ERROR;
                }
                TALLOC_FREE(new_msg);
        }

        return NT_STATUS_OK;
}

/*
 * Tombstone all expired DNS records.
 */
NTSTATUS dns_tombstone_records(TALLOC_CTX *mem_ctx,
                               struct ldb_context *samdb,
                               char **error_string)
{
        struct dns_server_zone *zones = NULL;
        struct dns_server_zone *z = NULL;
        NTSTATUS ret;
        uint32_t dns_timestamp;
        NTTIME entombed_time;
        TALLOC_CTX *tmp_ctx = NULL;
        time_t unix_now = time(NULL);

        unix_to_nt_time(&entombed_time, unix_now);
        dns_timestamp = unix_to_dns_timestamp(unix_now);

        tmp_ctx = talloc_new(mem_ctx);
        if (tmp_ctx == NULL) {
                return NT_STATUS_NO_MEMORY;
        }

        ret = dns_common_zones(samdb, tmp_ctx, NULL, &zones);
        if (!NT_STATUS_IS_OK(ret)) {
                TALLOC_FREE(tmp_ctx);
                return ret;
        }

        for (z = zones; z; z = z->next) {
                ret = dns_tombstone_records_zone(tmp_ctx,
                                                 samdb,
                                                 z,
                                                 dns_timestamp,
                                                 entombed_time,
                                                 error_string);
                if (NT_STATUS_EQUAL(ret, NT_STATUS_PROPSET_NOT_FOUND)) {
                        continue;
                } else if (!NT_STATUS_IS_OK(ret)) {
                        TALLOC_FREE(tmp_ctx);
                        return ret;
                }
        }
        TALLOC_FREE(tmp_ctx);
        return NT_STATUS_OK;
}

/*
 * Delete all DNS tombstones that have been around for longer than the server
 * property 'dns_tombstone_interval' which we store in smb.conf, which
 * corresponds to DsTombstoneInterval in [MS-DNSP] 3.1.1.1.1 "DNS Server
 * Integer Properties".
 */
NTSTATUS dns_delete_tombstones(TALLOC_CTX *mem_ctx,
                               struct ldb_context *samdb,
                               char **error_string)
{
        struct dns_server_zone *zones = NULL;
        struct dns_server_zone *z = NULL;
        int ret, i;
        NTSTATUS status;
        uint32_t current_time;
        uint32_t tombstone_interval;
        uint32_t tombstone_hours;
        NTTIME tombstone_nttime;
        enum ndr_err_code ndr_err;
        struct ldb_result *res = NULL;
        TALLOC_CTX *tmp_ctx = NULL;
        struct loadparm_context *lp_ctx = NULL;
        struct ldb_message_element *el = NULL;
        struct dnsp_DnssrvRpcRecord rec = {0};
        const char *attrs[] = {"dnsRecord", "dNSTombstoned", NULL};

        current_time = unix_to_dns_timestamp(time(NULL));

        lp_ctx = (struct loadparm_context *)ldb_get_opaque(samdb, "loadparm");
        tombstone_interval = lpcfg_parm_ulong(lp_ctx, NULL,
                                              "dnsserver",
                                              "dns_tombstone_interval",
                                              24 * 14);

        tombstone_hours = current_time - tombstone_interval;
        status = dns_timestamp_to_nt_time(&tombstone_nttime,
                                          tombstone_hours);

        if (!NT_STATUS_IS_OK(status)) {
                DBG_ERR("DNS timestamp exceeds NTTIME epoch.\n");
                return NT_STATUS_INTERNAL_ERROR;
        }

        tmp_ctx = talloc_new(mem_ctx);
        if (tmp_ctx == NULL) {
                return NT_STATUS_NO_MEMORY;
        }
        status = dns_common_zones(samdb, tmp_ctx, NULL, &zones);
        if (!NT_STATUS_IS_OK(status)) {
                TALLOC_FREE(tmp_ctx);
                return status;
        }

        for (z = zones; z; z = z->next) {
                /*
                 * This can load a very large set, but on the
                 * assumption that the number of tombstones is
                 * relatively small compared with the number of active
                 * records, and that this is an indexed lookup, this
                 * should be OK.  We can make a match rule if
                 * returning the set of tombstones becomes an issue.
                 */

                ret = ldb_search(samdb,
                                 tmp_ctx,
                                 &res,
                                 z->dn,
                                 LDB_SCOPE_SUBTREE,
                                 attrs,
                                 "(&(objectClass=dnsNode)(dNSTombstoned=TRUE))");

                if (ret != LDB_SUCCESS) {
                        *error_string =
                            talloc_asprintf(mem_ctx,
                                            "Failed to "
                                            "search for tombstoned "
                                            "dns objects in zone %s: %s",
                                            ldb_dn_get_linearized(z->dn),
                                            ldb_errstring(samdb));
                        TALLOC_FREE(tmp_ctx);
                        return NT_STATUS_INTERNAL_ERROR;
                }

                for (i = 0; i < res->count; i++) {
                        struct ldb_message *msg = res->msgs[i];
                        el = ldb_msg_find_element(msg, "dnsRecord");
                        if (el == NULL) {
                                DBG_ERR("The tombstoned dns node %s has no dns "
                                        "records, which should not happen.\n",
                                        ldb_dn_get_linearized(msg->dn)
                                        );
                                continue;
                        }
                        /*
                         * Below we assume the element has one value, which we
                         * expect because when we tombstone a node we remove
                         * all the records except for the tombstone.
                         */
                        if (el->num_values != 1) {
                                DBG_ERR("The tombstoned dns node %s has %u "
                                        "dns records, expected one.\n",
                                        ldb_dn_get_linearized(msg->dn),
                                        el->num_values
                                        );
                                continue;
                        }

                        ndr_err = ndr_pull_struct_blob(
                            el->values,
                            tmp_ctx,
                            &rec,
                            (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord);
                        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                                TALLOC_FREE(tmp_ctx);
                                DBG_ERR("Failed to pull dns rec blob.\n");
                                return NT_STATUS_INTERNAL_ERROR;
                        }

                        if (rec.wType != DNS_TYPE_TOMBSTONE) {
                                DBG_ERR("A tombstoned dnsNode has non-tombstoned"
                                        " records, which should not happen.\n");
                                continue;
                        }

                        if (rec.data.EntombedTime > tombstone_nttime) {
                                continue;
                        }
                        /*
                         * Between 4.9 and 4.14 in some places we saved the
                         * tombstone time as hours since the start of 1601,
                         * not in NTTIME ten-millionths of a second units.
                         *
                         * We can accommodate these bad values by noting that
                         * all the realistic timestamps in that measurement
                         * fall within the first *second* of NTTIME, that is,
                         * before 1601-01-01 00:00:01; and that these
                         * timestamps are not realistic for NTTIME timestamps.
                         *
                         * Calculation: there are roughly 365.25 * 24 = 8766
                         * hours per year, and < 500 years since 1601, so
                         * 4383000 would be a fine threshold. We round up to
                         * the crore-second (c. 2741CE) in honour of NTTIME.
                         */
                        if ((rec.data.EntombedTime < 10000000) &&
                            (rec.data.EntombedTime > tombstone_hours)) {
                                continue;
                        }

                        ret = dsdb_delete(samdb, msg->dn, 0);
                        if (ret != LDB_ERR_NO_SUCH_OBJECT &&
                            ret != LDB_SUCCESS) {
                                TALLOC_FREE(tmp_ctx);
                                DBG_ERR("Failed to delete dns node \n");
                                return NT_STATUS_INTERNAL_ERROR;
                        }
                }

        }
        TALLOC_FREE(tmp_ctx);
        return NT_STATUS_OK;
}