source4/ldap_server/ldap_bind.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    LDAP server
   4    Copyright (C) Stefan Metzmacher 2004
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "ldap_server/ldap_server.h"
  22 #include "auth/auth.h"
  23 #include "smbd/service.h"
  24 #include <ldb.h>
  25 #include <ldb_errors.h>
  26 #include "../lib/util/dlinklist.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "auth/gensec/gensec.h"
  29 #include "auth/gensec/gensec_tstream.h"
  30 #include "param/param.h"
  31 #include "../lib/util/tevent_ntstatus.h"
  32
  33 static char *ldapsrv_bind_error_msg(TALLOC_CTX *mem_ctx,
  34                                     HRESULT hresult,
  35                                     uint32_t DSID,
  36                                     NTSTATUS status)
  37 {
  38         WERROR werr;
  39         char *msg = NULL;
  40
  41         status = nt_status_squash(status);
  42         werr = ntstatus_to_werror(status);
  43
  44         /*
  45          * There are 4 lower case hex digits following 'v' at the end,
  46          * but different Windows Versions return different values:
  47          *
  48          * Windows 2008R2 uses 'v1db1'
  49          * Windows 2012R2 uses 'v2580'
  50          *
  51          * We just match Windows 2008R2 as that's what was referenced
  52          * in https://bugzilla.samba.org/show_bug.cgi?id=9048
  53          */
  54         msg = talloc_asprintf(mem_ctx, "%08X: LdapErr: DSID-%08X, comment: "
  55                               "AcceptSecurityContext error, data %x, v1db1",
  56                               (unsigned)HRES_ERROR_V(hresult),
  57                               (unsigned)DSID,
  58                               (unsigned)W_ERROR_V(werr));
  59
  60         return msg;
  61 }
  62
  63 struct ldapsrv_bind_wait_context {
  64         struct ldapsrv_reply *reply;
  65         struct tevent_req *req;
  66         NTSTATUS status;
  67         bool done;
  68 };
  69
  70 struct ldapsrv_bind_wait_state {
  71         uint8_t dummy;
  72 };
  73
  74 static struct tevent_req *ldapsrv_bind_wait_send(TALLOC_CTX *mem_ctx,
  75                                                  struct tevent_context *ev,
  76                                                  void *private_data)
  77 {
  78         struct ldapsrv_bind_wait_context *bind_wait =
  79                 talloc_get_type_abort(private_data,
  80                 struct ldapsrv_bind_wait_context);
  81         struct tevent_req *req;
  82         struct ldapsrv_bind_wait_state *state;
  83
  84         req = tevent_req_create(mem_ctx, &state,
  85                                 struct ldapsrv_bind_wait_state);
  86         if (req == NULL) {
  87                 return NULL;
  88         }
  89         bind_wait->req = req;
  90
  91         tevent_req_defer_callback(req, ev);
  92
  93         if (!bind_wait->done) {
  94                 return req;
  95         }
  96
  97         if (tevent_req_nterror(req, bind_wait->status)) {
  98                 return tevent_req_post(req, ev);
  99         }
 100
 101         tevent_req_done(req);
 102         return tevent_req_post(req, ev);
 103 }
 104
 105 static NTSTATUS ldapsrv_bind_wait_recv(struct tevent_req *req)
 106 {
 107         return tevent_req_simple_recv_ntstatus(req);
 108 }
 109
 110 static NTSTATUS ldapsrv_bind_wait_setup(struct ldapsrv_call *call,
 111                                         struct ldapsrv_reply *reply)
 112 {
 113         struct ldapsrv_bind_wait_context *bind_wait = NULL;
 114
 115         if (call->wait_private != NULL) {
 116                 return NT_STATUS_INTERNAL_ERROR;
 117         }
 118
 119         bind_wait = talloc_zero(call, struct ldapsrv_bind_wait_context);
 120         if (bind_wait == NULL) {
 121                 return NT_STATUS_NO_MEMORY;
 122         }
 123         bind_wait->reply = reply;
 124
 125         call->wait_private = bind_wait;
 126         call->wait_send = ldapsrv_bind_wait_send;
 127         call->wait_recv = ldapsrv_bind_wait_recv;
 128         return NT_STATUS_OK;
 129 }
 130
 131 static void ldapsrv_bind_wait_finished(struct ldapsrv_call *call,
 132                                        NTSTATUS status)
 133 {
 134         struct ldapsrv_bind_wait_context *bind_wait =
 135                 talloc_get_type_abort(call->wait_private,
 136                 struct ldapsrv_bind_wait_context);
 137
 138         bind_wait->done = true;
 139         bind_wait->status = status;
 140
 141         if (bind_wait->req == NULL) {
 142                 return;
 143         }
 144
 145         if (tevent_req_nterror(bind_wait->req, status)) {
 146                 return;
 147         }
 148
 149         tevent_req_done(bind_wait->req);
 150 }
 151
 152 static void ldapsrv_BindSimple_done(struct tevent_req *subreq);
 153
 154 static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
 155 {
 156         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 157         struct ldapsrv_reply *reply = NULL;
 158         struct ldap_BindResponse *resp = NULL;
 159         int result;
 160         const char *errstr = NULL;
 161         NTSTATUS status;
 162         bool using_tls = call->conn->sockets.active == call->conn->sockets.tls;
 163         struct tevent_req *subreq = NULL;
 164
 165         DEBUG(10, ("BindSimple dn: %s\n",req->dn));
 166
 167         reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 168         if (!reply) {
 169                 return NT_STATUS_NO_MEMORY;
 170         }
 171
 172         if (req->dn != NULL &&
 173             strlen(req->dn) != 0 &&
 174             call->conn->require_strong_auth > LDAP_SERVER_REQUIRE_STRONG_AUTH_NO &&
 175             !using_tls)
 176         {
 177                 status = NT_STATUS_NETWORK_ACCESS_DENIED;
 178                 result = LDAP_STRONG_AUTH_REQUIRED;
 179                 errstr = talloc_asprintf(reply,
 180                                          "BindSimple: Transport encryption required.");
 181                 goto do_reply;
 182         }
 183
 184         subreq = authenticate_ldap_simple_bind_send(call,
 185                                         call->conn->connection->event.ctx,
 186                                         call->conn->connection->msg_ctx,
 187                                         call->conn->lp_ctx,
 188                                         call->conn->connection->remote_address,
 189                                         call->conn->connection->local_address,
 190                                         using_tls,
 191                                         req->dn,
 192                                         req->creds.password);
 193         if (subreq == NULL) {
 194                 return NT_STATUS_NO_MEMORY;
 195         }
 196         tevent_req_set_callback(subreq, ldapsrv_BindSimple_done, call);
 197
 198         status = ldapsrv_bind_wait_setup(call, reply);
 199         if (!NT_STATUS_IS_OK(status)) {
 200                 TALLOC_FREE(subreq);
 201                 return status;
 202         }
 203
 204         /*
 205          * The rest will be async.
 206          */
 207         return NT_STATUS_OK;
 208
 209 do_reply:
 210         resp = &reply->msg->r.BindResponse;
 211         resp->response.resultcode = result;
 212         resp->response.errormessage = errstr;
 213         resp->response.dn = NULL;
 214         resp->response.referral = NULL;
 215         resp->SASL.secblob = NULL;
 216
 217         ldapsrv_queue_reply(call, reply);
 218         return NT_STATUS_OK;
 219 }
 220
 221 static void ldapsrv_BindSimple_done(struct tevent_req *subreq)
 222 {
 223         struct ldapsrv_call *call =
 224                 tevent_req_callback_data(subreq,
 225                 struct ldapsrv_call);
 226         struct ldapsrv_bind_wait_context *bind_wait =
 227                 talloc_get_type_abort(call->wait_private,
 228                 struct ldapsrv_bind_wait_context);
 229         struct ldapsrv_reply *reply = bind_wait->reply;
 230         struct auth_session_info *session_info = NULL;
 231         NTSTATUS status;
 232         struct ldap_BindResponse *resp = NULL;
 233         int result;
 234         const char *errstr = NULL;
 235
 236         status = authenticate_ldap_simple_bind_recv(subreq,
 237                                                     call,
 238                                                     &session_info);
 239         if (NT_STATUS_IS_OK(status)) {
 240                 result = LDAP_SUCCESS;
 241                 errstr = NULL;
 242
 243                 talloc_unlink(call->conn, call->conn->session_info);
 244                 call->conn->session_info = talloc_steal(call->conn, session_info);
 245
 246                 call->conn->authz_logged = true;
 247
 248                 /* don't leak the old LDB */
 249                 talloc_unlink(call->conn, call->conn->ldb);
 250
 251                 status = ldapsrv_backend_Init(call->conn);
 252
 253                 if (!NT_STATUS_IS_OK(status)) {
 254                         result = LDAP_OPERATIONS_ERROR;
 255                         errstr = talloc_asprintf(reply, "Simple Bind: Failed to advise ldb new credentials: %s", nt_errstr(status));
 256                 }
 257         } else {
 258                 status = nt_status_squash(status);
 259
 260                 result = LDAP_INVALID_CREDENTIALS;
 261                 errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_INVALID_TOKEN,
 262                                                 0x0C0903A9, status);
 263         }
 264
 265         resp = &reply->msg->r.BindResponse;
 266         resp->response.resultcode = result;
 267         resp->response.errormessage = errstr;
 268         resp->response.dn = NULL;
 269         resp->response.referral = NULL;
 270         resp->SASL.secblob = NULL;
 271
 272         ldapsrv_queue_reply(call, reply);
 273         ldapsrv_bind_wait_finished(call, NT_STATUS_OK);
 274 }
 275
 276 struct ldapsrv_sasl_postprocess_context {
 277         struct ldapsrv_connection *conn;
 278         struct tstream_context *sasl;
 279 };
 280
 281 struct ldapsrv_sasl_postprocess_state {
 282         uint8_t dummy;
 283 };
 284
 285 static struct tevent_req *ldapsrv_sasl_postprocess_send(TALLOC_CTX *mem_ctx,
 286                                                 struct tevent_context *ev,
 287                                                 void *private_data)
 288 {
 289         struct ldapsrv_sasl_postprocess_context *context =
 290                 talloc_get_type_abort(private_data,
 291                 struct ldapsrv_sasl_postprocess_context);
 292         struct tevent_req *req;
 293         struct ldapsrv_sasl_postprocess_state *state;
 294
 295         req = tevent_req_create(mem_ctx, &state,
 296                                 struct ldapsrv_sasl_postprocess_state);
 297         if (req == NULL) {
 298                 return NULL;
 299         }
 300
 301         TALLOC_FREE(context->conn->sockets.sasl);
 302         context->conn->sockets.sasl = talloc_move(context->conn, &context->sasl);
 303         context->conn->sockets.active = context->conn->sockets.sasl;
 304
 305         tevent_req_done(req);
 306         return tevent_req_post(req, ev);
 307 }
 308
 309 static NTSTATUS ldapsrv_sasl_postprocess_recv(struct tevent_req *req)
 310 {
 311         return tevent_req_simple_recv_ntstatus(req);
 312 }
 313
 314 static NTSTATUS ldapsrv_setup_gensec(struct ldapsrv_connection *conn,
 315                                      const char *sasl_mech,
 316                                      struct gensec_security **_gensec_security)
 317 {
 318         NTSTATUS status;
 319
 320         struct gensec_security *gensec_security;
 321
 322         status = samba_server_gensec_start(conn,
 323                                            conn->connection->event.ctx,
 324                                            conn->connection->msg_ctx,
 325                                            conn->lp_ctx,
 326                                            conn->server_credentials,
 327                                            "ldap",
 328                                            &gensec_security);
 329         if (!NT_STATUS_IS_OK(status)) {
 330                 return status;
 331         }
 332
 333         status = gensec_set_target_service_description(gensec_security,
 334                                                        "LDAP");
 335         if (!NT_STATUS_IS_OK(status)) {
 336                 return status;
 337         }
 338
 339         status = gensec_set_remote_address(gensec_security,
 340                                            conn->connection->remote_address);
 341         if (!NT_STATUS_IS_OK(status)) {
 342                 return status;
 343         }
 344
 345         status = gensec_set_local_address(gensec_security,
 346                                           conn->connection->local_address);
 347         if (!NT_STATUS_IS_OK(status)) {
 348                 return status;
 349         }
 350
 351         gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES);
 352         gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAP_STYLE);
 353
 354         if (conn->sockets.active == conn->sockets.tls) {
 355                 gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAPS_TRANSPORT);
 356         }
 357
 358         status = gensec_start_mech_by_sasl_name(gensec_security, sasl_mech);
 359
 360         if (!NT_STATUS_IS_OK(status)) {
 361                 return status;
 362         }
 363
 364         *_gensec_security = gensec_security;
 365         return status;
 366 }
 367
 368 static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
 369 {
 370         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 371         struct ldapsrv_reply *reply;
 372         struct ldap_BindResponse *resp;
 373         struct ldapsrv_connection *conn;
 374         int result = 0;
 375         const char *errstr=NULL;
 376         NTSTATUS status = NT_STATUS_OK;
 377         DATA_BLOB input = data_blob_null;
 378         DATA_BLOB output = data_blob_null;
 379
 380         DEBUG(10, ("BindSASL dn: %s\n",req->dn));
 381
 382         reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 383         if (!reply) {
 384                 return NT_STATUS_NO_MEMORY;
 385         }
 386         resp = &reply->msg->r.BindResponse;
 387         /* Windows 2000 mmc doesn't like secblob == NULL and reports a decoding error */
 388         resp->SASL.secblob = talloc_zero(reply, DATA_BLOB);
 389         if (resp->SASL.secblob == NULL) {
 390                 return NT_STATUS_NO_MEMORY;
 391         }
 392
 393         conn = call->conn;
 394
 395         /*
 396          * TODO: a SASL bind with a different mechanism
 397          *       should cancel an inprogress SASL bind.
 398          *       (see RFC 4513)
 399          */
 400
 401         if (!conn->gensec) {
 402                 status = ldapsrv_setup_gensec(conn, req->creds.SASL.mechanism,
 403                                               &conn->gensec);
 404                 if (!NT_STATUS_IS_OK(status)) {
 405                         DEBUG(1, ("Failed to start GENSEC server for [%s] code: %s\n",
 406                                   ldb_binary_encode_string(call, req->creds.SASL.mechanism),
 407                                   nt_errstr(status)));
 408                         result = LDAP_OPERATIONS_ERROR;
 409                         errstr = talloc_asprintf(reply, "SASL: Failed to start authentication system: %s",
 410                                                  nt_errstr(status));
 411                         goto do_reply;
 412                 }
 413         }
 414
 415         if (req->creds.SASL.secblob) {
 416                 input = *req->creds.SASL.secblob;
 417         }
 418
 419         status = gensec_update_ev(conn->gensec, reply, conn->connection->event.ctx,
 420                                   input, &output);
 421         *resp->SASL.secblob = output;
 422
 423         if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED, status)) {
 424                 result = LDAP_SASL_BIND_IN_PROGRESS;
 425                 errstr = NULL;
 426                 goto do_reply;
 427         }
 428
 429         if (!NT_STATUS_IS_OK(status)) {
 430                 status = nt_status_squash(status);
 431                 result = LDAP_INVALID_CREDENTIALS;
 432                 errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_LOGON_DENIED,
 433                                                 0x0C0904DC, status);
 434                 talloc_unlink(conn, conn->gensec);
 435                 conn->gensec = NULL;
 436                 goto do_reply;
 437         }
 438
 439         {
 440                 struct ldapsrv_sasl_postprocess_context *context = NULL;
 441
 442                 result = LDAP_SUCCESS;
 443                 errstr = NULL;
 444
 445                 if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
 446                     gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
 447
 448                         context = talloc(call, struct ldapsrv_sasl_postprocess_context);
 449
 450                         if (!context) {
 451                                 status = NT_STATUS_NO_MEMORY;
 452                         }
 453                 }
 454
 455                 if (context && conn->sockets.tls) {
 456                         TALLOC_FREE(context);
 457                         status = NT_STATUS_NOT_SUPPORTED;
 458                         result = LDAP_UNWILLING_TO_PERFORM;
 459                         errstr = talloc_asprintf(reply,
 460                                                  "SASL:[%s]: Sign or Seal are not allowed if TLS is used",
 461                                                  req->creds.SASL.mechanism);
 462                         goto do_reply;
 463                 }
 464
 465                 if (context && conn->sockets.sasl) {
 466                         TALLOC_FREE(context);
 467                         status = NT_STATUS_NOT_SUPPORTED;
 468                         result = LDAP_UNWILLING_TO_PERFORM;
 469                         errstr = talloc_asprintf(reply,
 470                                                  "SASL:[%s]: Sign or Seal are not allowed if SASL encryption has already been set up",
 471                                                  req->creds.SASL.mechanism);
 472                         goto do_reply;
 473                 }
 474
 475                 if (context) {
 476                         context->conn = conn;
 477                         status = gensec_create_tstream(context,
 478                                                        context->conn->gensec,
 479                                                        context->conn->sockets.raw,
 480                                                        &context->sasl);
 481                         if (NT_STATUS_IS_OK(status)) {
 482                                 if (!talloc_reference(context->sasl, conn->gensec)) {
 483                                         status = NT_STATUS_NO_MEMORY;
 484                                 }
 485                         }
 486                 } else {
 487                         switch (call->conn->require_strong_auth) {
 488                         case LDAP_SERVER_REQUIRE_STRONG_AUTH_NO:
 489                                 break;
 490                         case LDAP_SERVER_REQUIRE_STRONG_AUTH_ALLOW_SASL_OVER_TLS:
 491                                 if (call->conn->sockets.active == call->conn->sockets.tls) {
 492                                         break;
 493                                 }
 494                                 status = NT_STATUS_NETWORK_ACCESS_DENIED;
 495                                 result = LDAP_STRONG_AUTH_REQUIRED;
 496                                 errstr = talloc_asprintf(reply,
 497                                                 "SASL:[%s]: not allowed if TLS is used.",
 498                                                  req->creds.SASL.mechanism);
 499                                 goto do_reply;
 500
 501                         case LDAP_SERVER_REQUIRE_STRONG_AUTH_YES:
 502                                 status = NT_STATUS_NETWORK_ACCESS_DENIED;
 503                                 result = LDAP_STRONG_AUTH_REQUIRED;
 504                                 errstr = talloc_asprintf(reply,
 505                                                  "SASL:[%s]: Sign or Seal are required.",
 506                                                  req->creds.SASL.mechanism);
 507                                 goto do_reply;
 508                         }
 509                 }
 510
 511                 if (result != LDAP_SUCCESS) {
 512                 } else if (!NT_STATUS_IS_OK(status)) {
 513                         result = LDAP_OPERATIONS_ERROR;
 514                         errstr = talloc_asprintf(reply,
 515                                                  "SASL:[%s]: Failed to setup SASL socket: %s",
 516                                                  req->creds.SASL.mechanism, nt_errstr(status));
 517                         goto do_reply;
 518                 } else {
 519                         struct auth_session_info *old_session_info=NULL;
 520
 521                         old_session_info = conn->session_info;
 522                         conn->session_info = NULL;
 523                         status = gensec_session_info(conn->gensec, conn, &conn->session_info);
 524                         if (!NT_STATUS_IS_OK(status)) {
 525                                 conn->session_info = old_session_info;
 526                                 result = LDAP_OPERATIONS_ERROR;
 527                                 errstr = talloc_asprintf(reply,
 528                                                          "SASL:[%s]: Failed to get session info: %s",
 529                                                          req->creds.SASL.mechanism, nt_errstr(status));
 530                                 goto do_reply;
 531                         } else {
 532                                 talloc_unlink(conn, old_session_info);
 533
 534                                 /* don't leak the old LDB */
 535                                 talloc_unlink(conn, conn->ldb);
 536
 537                                 call->conn->authz_logged = true;
 538
 539                                 status = ldapsrv_backend_Init(conn);
 540
 541                                 if (!NT_STATUS_IS_OK(status)) {
 542                                         result = LDAP_OPERATIONS_ERROR;
 543                                         errstr = talloc_asprintf(reply,
 544                                                                  "SASL:[%s]: Failed to advise samdb of new credentials: %s",
 545                                                                  req->creds.SASL.mechanism,
 546                                                                  nt_errstr(status));
 547                                         goto do_reply;
 548                                 }
 549                         }
 550                 }
 551
 552                 if (NT_STATUS_IS_OK(status) && context) {
 553                         call->postprocess_send = ldapsrv_sasl_postprocess_send;
 554                         call->postprocess_recv = ldapsrv_sasl_postprocess_recv;
 555                         call->postprocess_private = context;
 556                 }
 557                 talloc_unlink(conn, conn->gensec);
 558                 conn->gensec = NULL;
 559         }
 560
 561 do_reply:
 562         resp->response.resultcode = result;
 563         resp->response.dn = NULL;
 564         resp->response.errormessage = errstr;
 565         resp->response.referral = NULL;
 566
 567         ldapsrv_queue_reply(call, reply);
 568         return NT_STATUS_OK;
 569 }
 570
 571 NTSTATUS ldapsrv_BindRequest(struct ldapsrv_call *call)
 572 {
 573         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 574         struct ldapsrv_reply *reply;
 575         struct ldap_BindResponse *resp;
 576
 577         if (call->conn->pending_calls != NULL) {
 578                 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 579                 if (!reply) {
 580                         return NT_STATUS_NO_MEMORY;
 581                 }
 582
 583                 resp = &reply->msg->r.BindResponse;
 584                 resp->response.resultcode = LDAP_BUSY;
 585                 resp->response.dn = NULL;
 586                 resp->response.errormessage = talloc_asprintf(reply, "Pending requests on this LDAP session");
 587                 resp->response.referral = NULL;
 588                 resp->SASL.secblob = NULL;
 589
 590                 ldapsrv_queue_reply(call, reply);
 591                 return NT_STATUS_OK;
 592         }
 593
 594         /*
 595          * TODO: a simple bind should cancel an
 596          *       inprogress SASL bind.
 597          *       (see RFC 4513)
 598          */
 599         switch (req->mechanism) {
 600                 case LDAP_AUTH_MECH_SIMPLE:
 601                         return ldapsrv_BindSimple(call);
 602                 case LDAP_AUTH_MECH_SASL:
 603                         return ldapsrv_BindSASL(call);
 604         }
 605
 606         reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 607         if (!reply) {
 608                 return NT_STATUS_NO_MEMORY;
 609         }
 610
 611         resp = &reply->msg->r.BindResponse;
 612         resp->response.resultcode = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 613         resp->response.dn = NULL;
 614         resp->response.errormessage = talloc_asprintf(reply, "Bad AuthenticationChoice [%d]", req->mechanism);
 615         resp->response.referral = NULL;
 616         resp->SASL.secblob = NULL;
 617
 618         ldapsrv_queue_reply(call, reply);
 619         return NT_STATUS_OK;
 620 }
 621
 622 struct ldapsrv_unbind_wait_context {
 623         uint8_t dummy;
 624 };
 625
 626 struct ldapsrv_unbind_wait_state {
 627         uint8_t dummy;
 628 };
 629
 630 static struct tevent_req *ldapsrv_unbind_wait_send(TALLOC_CTX *mem_ctx,
 631                                                  struct tevent_context *ev,
 632                                                  void *private_data)
 633 {
 634         struct ldapsrv_unbind_wait_context *unbind_wait =
 635                 talloc_get_type_abort(private_data,
 636                 struct ldapsrv_unbind_wait_context);
 637         struct tevent_req *req;
 638         struct ldapsrv_unbind_wait_state *state;
 639
 640         req = tevent_req_create(mem_ctx, &state,
 641                                 struct ldapsrv_unbind_wait_state);
 642         if (req == NULL) {
 643                 return NULL;
 644         }
 645
 646         (void)unbind_wait;
 647
 648         tevent_req_nterror(req, NT_STATUS_LOCAL_DISCONNECT);
 649         return tevent_req_post(req, ev);
 650 }
 651
 652 static NTSTATUS ldapsrv_unbind_wait_recv(struct tevent_req *req)
 653 {
 654         return tevent_req_simple_recv_ntstatus(req);
 655 }
 656
 657 static NTSTATUS ldapsrv_unbind_wait_setup(struct ldapsrv_call *call)
 658 {
 659         struct ldapsrv_unbind_wait_context *unbind_wait = NULL;
 660
 661         if (call->wait_private != NULL) {
 662                 return NT_STATUS_INTERNAL_ERROR;
 663         }
 664
 665         unbind_wait = talloc_zero(call, struct ldapsrv_unbind_wait_context);
 666         if (unbind_wait == NULL) {
 667                 return NT_STATUS_NO_MEMORY;
 668         }
 669
 670         call->wait_private = unbind_wait;
 671         call->wait_send = ldapsrv_unbind_wait_send;
 672         call->wait_recv = ldapsrv_unbind_wait_recv;
 673         return NT_STATUS_OK;
 674 }
 675
 676 NTSTATUS ldapsrv_UnbindRequest(struct ldapsrv_call *call)
 677 {
 678         struct ldapsrv_call *c = NULL;
 679         struct ldapsrv_call *n = NULL;
 680
 681         DEBUG(10, ("UnbindRequest\n"));
 682
 683         for (c = call->conn->pending_calls; c != NULL; c = n) {
 684                 n = c->next;
 685
 686                 DLIST_REMOVE(call->conn->pending_calls, c);
 687                 TALLOC_FREE(c);
 688         }
 689
 690         return ldapsrv_unbind_wait_setup(call);
 691 }