2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Matthias Dieter Wallnöfer 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "ldap_server/ldap_server.h"
23 #include "../lib/util/dlinklist.h"
24 #include "auth/credentials/credentials.h"
25 #include "auth/gensec/gensec.h"
26 #include "param/param.h"
27 #include "smbd/service_stream.h"
28 #include "dsdb/samdb/samdb.h"
29 #include <ldb_errors.h>
30 #include <ldb_module.h>
33 #define VALID_DN_SYNTAX(dn) do {\
35 return NT_STATUS_NO_MEMORY;\
36 } else if ( ! ldb_dn_validate(dn)) {\
37 result = LDAP_INVALID_DN_SYNTAX;\
38 map_ldb_error(local_ctx, LDB_ERR_INVALID_DN_SYNTAX, NULL,\
44 static int map_ldb_error(TALLOC_CTX
*mem_ctx
, int ldb_err
,
45 const char *add_err_string
, const char **errstring
)
49 /* Certain LDB modules need to return very special WERROR codes. Proof
50 * for them here and if they exist skip the rest of the mapping. */
51 if (add_err_string
!= NULL
) {
53 strtol(add_err_string
, &endptr
, 16);
54 if (endptr
!= add_err_string
) {
55 *errstring
= add_err_string
;
60 /* Otherwise we calculate here a generic, but appropriate WERROR. */
66 case LDB_ERR_OPERATIONS_ERROR
:
67 err
= WERR_DS_OPERATIONS_ERROR
;
69 case LDB_ERR_PROTOCOL_ERROR
:
70 err
= WERR_DS_PROTOCOL_ERROR
;
72 case LDB_ERR_TIME_LIMIT_EXCEEDED
:
73 err
= WERR_DS_TIMELIMIT_EXCEEDED
;
75 case LDB_ERR_SIZE_LIMIT_EXCEEDED
:
76 err
= WERR_DS_SIZELIMIT_EXCEEDED
;
78 case LDB_ERR_COMPARE_FALSE
:
79 err
= WERR_DS_COMPARE_FALSE
;
81 case LDB_ERR_COMPARE_TRUE
:
82 err
= WERR_DS_COMPARE_TRUE
;
84 case LDB_ERR_AUTH_METHOD_NOT_SUPPORTED
:
85 err
= WERR_DS_AUTH_METHOD_NOT_SUPPORTED
;
87 case LDB_ERR_STRONG_AUTH_REQUIRED
:
88 err
= WERR_DS_STRONG_AUTH_REQUIRED
;
90 case LDB_ERR_REFERRAL
:
91 err
= WERR_DS_REFERRAL
;
93 case LDB_ERR_ADMIN_LIMIT_EXCEEDED
:
94 err
= WERR_DS_ADMIN_LIMIT_EXCEEDED
;
96 case LDB_ERR_UNSUPPORTED_CRITICAL_EXTENSION
:
97 err
= WERR_DS_UNAVAILABLE_CRIT_EXTENSION
;
99 case LDB_ERR_CONFIDENTIALITY_REQUIRED
:
100 err
= WERR_DS_CONFIDENTIALITY_REQUIRED
;
102 case LDB_ERR_SASL_BIND_IN_PROGRESS
:
105 case LDB_ERR_NO_SUCH_ATTRIBUTE
:
106 err
= WERR_DS_NO_ATTRIBUTE_OR_VALUE
;
108 case LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE
:
109 err
= WERR_DS_ATTRIBUTE_TYPE_UNDEFINED
;
111 case LDB_ERR_INAPPROPRIATE_MATCHING
:
112 err
= WERR_DS_INAPPROPRIATE_MATCHING
;
114 case LDB_ERR_CONSTRAINT_VIOLATION
:
115 err
= WERR_DS_CONSTRAINT_VIOLATION
;
117 case LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
:
118 err
= WERR_DS_ATTRIBUTE_OR_VALUE_EXISTS
;
120 case LDB_ERR_INVALID_ATTRIBUTE_SYNTAX
:
121 err
= WERR_DS_INVALID_ATTRIBUTE_SYNTAX
;
123 case LDB_ERR_NO_SUCH_OBJECT
:
124 err
= WERR_DS_NO_SUCH_OBJECT
;
126 case LDB_ERR_ALIAS_PROBLEM
:
127 err
= WERR_DS_ALIAS_PROBLEM
;
129 case LDB_ERR_INVALID_DN_SYNTAX
:
130 err
= WERR_DS_INVALID_DN_SYNTAX
;
132 case LDB_ERR_ALIAS_DEREFERENCING_PROBLEM
:
133 err
= WERR_DS_ALIAS_DEREF_PROBLEM
;
135 case LDB_ERR_INAPPROPRIATE_AUTHENTICATION
:
136 err
= WERR_DS_INAPPROPRIATE_AUTH
;
138 case LDB_ERR_INVALID_CREDENTIALS
:
139 err
= WERR_ACCESS_DENIED
;
141 case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
:
142 err
= WERR_DS_INSUFF_ACCESS_RIGHTS
;
147 case LDB_ERR_UNAVAILABLE
:
148 err
= WERR_DS_UNAVAILABLE
;
150 case LDB_ERR_UNWILLING_TO_PERFORM
:
151 err
= WERR_DS_UNWILLING_TO_PERFORM
;
153 case LDB_ERR_LOOP_DETECT
:
154 err
= WERR_DS_LOOP_DETECT
;
156 case LDB_ERR_NAMING_VIOLATION
:
157 err
= WERR_DS_NAMING_VIOLATION
;
159 case LDB_ERR_OBJECT_CLASS_VIOLATION
:
160 err
= WERR_DS_OBJ_CLASS_VIOLATION
;
162 case LDB_ERR_NOT_ALLOWED_ON_NON_LEAF
:
163 err
= WERR_DS_CANT_ON_NON_LEAF
;
165 case LDB_ERR_NOT_ALLOWED_ON_RDN
:
166 err
= WERR_DS_CANT_ON_RDN
;
168 case LDB_ERR_ENTRY_ALREADY_EXISTS
:
169 err
= WERR_DS_OBJ_STRING_NAME_EXISTS
;
171 case LDB_ERR_OBJECT_CLASS_MODS_PROHIBITED
:
172 err
= WERR_DS_CANT_MOD_OBJ_CLASS
;
174 case LDB_ERR_AFFECTS_MULTIPLE_DSAS
:
175 err
= WERR_DS_AFFECTS_MULTIPLE_DSAS
;
178 err
= WERR_DS_GENERIC_ERROR
;
182 *errstring
= talloc_asprintf(mem_ctx
, "%08X: %s", W_ERROR_V(err
),
183 ldb_strerror(ldb_err
));
184 if (add_err_string
!= NULL
) {
185 *errstring
= talloc_asprintf(mem_ctx
, "%s - %s", *errstring
,
189 /* result is 1:1 for now */
194 connect to the sam database
196 NTSTATUS
ldapsrv_backend_Init(struct ldapsrv_connection
*conn
)
198 conn
->ldb
= samdb_connect(conn
,
199 conn
->connection
->event
.ctx
,
202 conn
->global_catalog
? LDB_FLG_RDONLY
: 0);
203 if (conn
->ldb
== NULL
) {
204 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
207 if (conn
->server_credentials
) {
208 char **sasl_mechs
= NULL
;
209 struct gensec_security_ops
**backends
= gensec_security_all();
210 struct gensec_security_ops
**ops
211 = gensec_use_kerberos_mechs(conn
, backends
, conn
->server_credentials
);
212 unsigned int i
, j
= 0;
213 for (i
= 0; ops
&& ops
[i
]; i
++) {
214 if (!lpcfg_parm_bool(conn
->lp_ctx
, NULL
, "gensec", ops
[i
]->name
, ops
[i
]->enabled
))
217 if (ops
[i
]->sasl_name
&& ops
[i
]->server_start
) {
218 char *sasl_name
= talloc_strdup(conn
, ops
[i
]->sasl_name
);
221 return NT_STATUS_NO_MEMORY
;
223 sasl_mechs
= talloc_realloc(conn
, sasl_mechs
, char *, j
+ 2);
225 return NT_STATUS_NO_MEMORY
;
227 sasl_mechs
[j
] = sasl_name
;
228 talloc_steal(sasl_mechs
, sasl_name
);
229 sasl_mechs
[j
+1] = NULL
;
233 talloc_unlink(conn
, ops
);
235 /* ldb can have a different lifetime to conn, so we
236 need to ensure that sasl_mechs lives as long as the
238 talloc_steal(conn
->ldb
, sasl_mechs
);
240 ldb_set_opaque(conn
->ldb
, "supportedSASLMechanisms", sasl_mechs
);
246 struct ldapsrv_reply
*ldapsrv_init_reply(struct ldapsrv_call
*call
, uint8_t type
)
248 struct ldapsrv_reply
*reply
;
250 reply
= talloc(call
, struct ldapsrv_reply
);
254 reply
->msg
= talloc(reply
, struct ldap_message
);
255 if (reply
->msg
== NULL
) {
260 reply
->msg
->messageid
= call
->request
->messageid
;
261 reply
->msg
->type
= type
;
262 reply
->msg
->controls
= NULL
;
267 void ldapsrv_queue_reply(struct ldapsrv_call
*call
, struct ldapsrv_reply
*reply
)
269 DLIST_ADD_END(call
->replies
, reply
, struct ldapsrv_reply
*);
272 static NTSTATUS
ldapsrv_unwilling(struct ldapsrv_call
*call
, int error
)
274 struct ldapsrv_reply
*reply
;
275 struct ldap_ExtendedResponse
*r
;
277 DEBUG(10,("Unwilling type[%d] id[%d]\n", call
->request
->type
, call
->request
->messageid
));
279 reply
= ldapsrv_init_reply(call
, LDAP_TAG_ExtendedResponse
);
281 return NT_STATUS_NO_MEMORY
;
284 r
= &reply
->msg
->r
.ExtendedResponse
;
285 r
->response
.resultcode
= error
;
286 r
->response
.dn
= NULL
;
287 r
->response
.errormessage
= NULL
;
288 r
->response
.referral
= NULL
;
292 ldapsrv_queue_reply(call
, reply
);
296 static int ldapsrv_add_with_controls(struct ldapsrv_call
*call
,
297 const struct ldb_message
*message
,
298 struct ldb_control
**controls
,
301 struct ldb_context
*ldb
= call
->conn
->ldb
;
302 struct ldb_request
*req
;
305 ret
= ldb_msg_sanity_check(ldb
, message
);
306 if (ret
!= LDB_SUCCESS
) {
310 ret
= ldb_build_add_req(&req
, ldb
, ldb
,
314 ldb_modify_default_callback
,
317 if (ret
!= LDB_SUCCESS
) return ret
;
319 ret
= ldb_transaction_start(ldb
);
320 if (ret
!= LDB_SUCCESS
) {
324 if (!call
->conn
->is_privileged
) {
325 ldb_req_mark_untrusted(req
);
328 LDB_REQ_SET_LOCATION(req
);
330 ret
= ldb_request(ldb
, req
);
331 if (ret
== LDB_SUCCESS
) {
332 ret
= ldb_wait(req
->handle
, LDB_WAIT_ALL
);
335 if (ret
== LDB_SUCCESS
) {
336 ret
= ldb_transaction_commit(ldb
);
339 ldb_transaction_cancel(ldb
);
346 /* create and execute a modify request */
347 static int ldapsrv_mod_with_controls(struct ldapsrv_call
*call
,
348 const struct ldb_message
*message
,
349 struct ldb_control
**controls
,
352 struct ldb_context
*ldb
= call
->conn
->ldb
;
353 struct ldb_request
*req
;
356 ret
= ldb_msg_sanity_check(ldb
, message
);
357 if (ret
!= LDB_SUCCESS
) {
361 ret
= ldb_build_mod_req(&req
, ldb
, ldb
,
365 ldb_modify_default_callback
,
368 if (ret
!= LDB_SUCCESS
) {
372 ret
= ldb_transaction_start(ldb
);
373 if (ret
!= LDB_SUCCESS
) {
377 if (!call
->conn
->is_privileged
) {
378 ldb_req_mark_untrusted(req
);
381 LDB_REQ_SET_LOCATION(req
);
383 ret
= ldb_request(ldb
, req
);
384 if (ret
== LDB_SUCCESS
) {
385 ret
= ldb_wait(req
->handle
, LDB_WAIT_ALL
);
388 if (ret
== LDB_SUCCESS
) {
389 ret
= ldb_transaction_commit(ldb
);
392 ldb_transaction_cancel(ldb
);
399 /* create and execute a delete request */
400 static int ldapsrv_del_with_controls(struct ldapsrv_call
*call
,
402 struct ldb_control
**controls
,
405 struct ldb_context
*ldb
= call
->conn
->ldb
;
406 struct ldb_request
*req
;
409 ret
= ldb_build_del_req(&req
, ldb
, ldb
,
413 ldb_modify_default_callback
,
416 if (ret
!= LDB_SUCCESS
) return ret
;
418 ret
= ldb_transaction_start(ldb
);
419 if (ret
!= LDB_SUCCESS
) {
423 if (!call
->conn
->is_privileged
) {
424 ldb_req_mark_untrusted(req
);
427 LDB_REQ_SET_LOCATION(req
);
429 ret
= ldb_request(ldb
, req
);
430 if (ret
== LDB_SUCCESS
) {
431 ret
= ldb_wait(req
->handle
, LDB_WAIT_ALL
);
434 if (ret
== LDB_SUCCESS
) {
435 ret
= ldb_transaction_commit(ldb
);
438 ldb_transaction_cancel(ldb
);
445 static int ldapsrv_rename_with_controls(struct ldapsrv_call
*call
,
446 struct ldb_dn
*olddn
,
447 struct ldb_dn
*newdn
,
448 struct ldb_control
**controls
,
451 struct ldb_context
*ldb
= call
->conn
->ldb
;
452 struct ldb_request
*req
;
455 ret
= ldb_build_rename_req(&req
, ldb
, ldb
,
460 ldb_modify_default_callback
,
463 if (ret
!= LDB_SUCCESS
) return ret
;
465 ret
= ldb_transaction_start(ldb
);
466 if (ret
!= LDB_SUCCESS
) {
470 if (!call
->conn
->is_privileged
) {
471 ldb_req_mark_untrusted(req
);
474 LDB_REQ_SET_LOCATION(req
);
476 ret
= ldb_request(ldb
, req
);
477 if (ret
== LDB_SUCCESS
) {
478 ret
= ldb_wait(req
->handle
, LDB_WAIT_ALL
);
481 if (ret
== LDB_SUCCESS
) {
482 ret
= ldb_transaction_commit(ldb
);
485 ldb_transaction_cancel(ldb
);
492 static NTSTATUS
ldapsrv_SearchRequest(struct ldapsrv_call
*call
)
494 struct ldap_SearchRequest
*req
= &call
->request
->r
.SearchRequest
;
495 struct ldap_SearchResEntry
*ent
;
496 struct ldap_Result
*done
;
497 struct ldapsrv_reply
*ent_r
, *done_r
;
498 TALLOC_CTX
*local_ctx
;
499 struct ldb_context
*samdb
= talloc_get_type(call
->conn
->ldb
, struct ldb_context
);
500 struct ldb_dn
*basedn
;
501 struct ldb_result
*res
= NULL
;
502 struct ldb_request
*lreq
;
503 struct ldb_control
*search_control
;
504 struct ldb_search_options_control
*search_options
;
505 struct ldb_control
*extended_dn_control
;
506 struct ldb_extended_dn_control
*extended_dn_decoded
= NULL
;
507 enum ldb_scope scope
= LDB_SCOPE_DEFAULT
;
508 const char **attrs
= NULL
;
509 const char *scope_str
, *errstr
= NULL
;
510 int success_limit
= 1;
514 int extended_type
= 1;
516 DEBUG(10, ("SearchRequest"));
517 DEBUGADD(10, (" basedn: %s", req
->basedn
));
518 DEBUGADD(10, (" filter: %s\n", ldb_filter_from_tree(call
, req
->tree
)));
520 local_ctx
= talloc_new(call
);
521 NT_STATUS_HAVE_NO_MEMORY(local_ctx
);
523 basedn
= ldb_dn_new(local_ctx
, samdb
, req
->basedn
);
524 VALID_DN_SYNTAX(basedn
);
526 DEBUG(10, ("SearchRequest: basedn: [%s]\n", req
->basedn
));
527 DEBUG(10, ("SearchRequest: filter: [%s]\n", ldb_filter_from_tree(call
, req
->tree
)));
529 switch (req
->scope
) {
530 case LDAP_SEARCH_SCOPE_BASE
:
532 scope
= LDB_SCOPE_BASE
;
535 case LDAP_SEARCH_SCOPE_SINGLE
:
537 scope
= LDB_SCOPE_ONELEVEL
;
540 case LDAP_SEARCH_SCOPE_SUB
:
542 scope
= LDB_SCOPE_SUBTREE
;
546 result
= LDAP_PROTOCOL_ERROR
;
547 map_ldb_error(local_ctx
, LDB_ERR_PROTOCOL_ERROR
, NULL
,
549 errstr
= talloc_asprintf(local_ctx
,
550 "%s. Invalid scope", errstr
);
553 DEBUG(10,("SearchRequest: scope: [%s]\n", scope_str
));
555 if (req
->num_attributes
>= 1) {
556 attrs
= talloc_array(local_ctx
, const char *, req
->num_attributes
+1);
557 NT_STATUS_HAVE_NO_MEMORY(attrs
);
559 for (i
=0; i
< req
->num_attributes
; i
++) {
560 DEBUG(10,("SearchRequest: attrs: [%s]\n",req
->attributes
[i
]));
561 attrs
[i
] = req
->attributes
[i
];
566 DEBUG(5,("ldb_request %s dn=%s filter=%s\n",
567 scope_str
, req
->basedn
, ldb_filter_from_tree(call
, req
->tree
)));
569 res
= talloc_zero(local_ctx
, struct ldb_result
);
570 NT_STATUS_HAVE_NO_MEMORY(res
);
572 ldb_ret
= ldb_build_search_req_ex(&lreq
, samdb
, local_ctx
,
575 call
->request
->controls
,
576 res
, ldb_search_default_callback
,
579 if (ldb_ret
!= LDB_SUCCESS
) {
583 if (call
->conn
->global_catalog
) {
584 search_control
= ldb_request_get_control(lreq
, LDB_CONTROL_SEARCH_OPTIONS_OID
);
586 search_options
= NULL
;
587 if (search_control
) {
588 search_options
= talloc_get_type(search_control
->data
, struct ldb_search_options_control
);
589 search_options
->search_options
|= LDB_SEARCH_OPTION_PHANTOM_ROOT
;
591 search_options
= talloc(lreq
, struct ldb_search_options_control
);
592 NT_STATUS_HAVE_NO_MEMORY(search_options
);
593 search_options
->search_options
= LDB_SEARCH_OPTION_PHANTOM_ROOT
;
594 ldb_request_add_control(lreq
, LDB_CONTROL_SEARCH_OPTIONS_OID
, false, search_options
);
598 extended_dn_control
= ldb_request_get_control(lreq
, LDB_CONTROL_EXTENDED_DN_OID
);
600 if (extended_dn_control
) {
601 if (extended_dn_control
->data
) {
602 extended_dn_decoded
= talloc_get_type(extended_dn_control
->data
, struct ldb_extended_dn_control
);
603 extended_type
= extended_dn_decoded
->type
;
609 ldb_set_timeout(samdb
, lreq
, req
->timelimit
);
611 if (!call
->conn
->is_privileged
) {
612 ldb_req_mark_untrusted(lreq
);
615 LDB_REQ_SET_LOCATION(lreq
);
617 ldb_ret
= ldb_request(samdb
, lreq
);
619 if (ldb_ret
!= LDB_SUCCESS
) {
623 ldb_ret
= ldb_wait(lreq
->handle
, LDB_WAIT_ALL
);
625 if (ldb_ret
== LDB_SUCCESS
) {
626 for (i
= 0; i
< res
->count
; i
++) {
627 ent_r
= ldapsrv_init_reply(call
, LDAP_TAG_SearchResultEntry
);
628 NT_STATUS_HAVE_NO_MEMORY(ent_r
);
630 /* Better to have the whole message kept here,
631 * than to find someone further up didn't put
632 * a value in the right spot in the talloc tree */
633 talloc_steal(ent_r
, res
->msgs
[i
]);
635 ent
= &ent_r
->msg
->r
.SearchResultEntry
;
636 ent
->dn
= ldb_dn_get_extended_linearized(ent_r
, res
->msgs
[i
]->dn
, extended_type
);
637 ent
->num_attributes
= 0;
638 ent
->attributes
= NULL
;
639 if (res
->msgs
[i
]->num_elements
== 0) {
642 ent
->num_attributes
= res
->msgs
[i
]->num_elements
;
643 ent
->attributes
= talloc_array(ent_r
, struct ldb_message_element
, ent
->num_attributes
);
644 NT_STATUS_HAVE_NO_MEMORY(ent
->attributes
);
645 for (j
=0; j
< ent
->num_attributes
; j
++) {
646 ent
->attributes
[j
].name
= res
->msgs
[i
]->elements
[j
].name
;
647 ent
->attributes
[j
].num_values
= 0;
648 ent
->attributes
[j
].values
= NULL
;
649 if (req
->attributesonly
&& (res
->msgs
[i
]->elements
[j
].num_values
== 0)) {
652 ent
->attributes
[j
].num_values
= res
->msgs
[i
]->elements
[j
].num_values
;
653 ent
->attributes
[j
].values
= res
->msgs
[i
]->elements
[j
].values
;
656 ldapsrv_queue_reply(call
, ent_r
);
659 /* Send back referrals if they do exist (search operations) */
660 if (res
->refs
!= NULL
) {
662 struct ldap_SearchResRef
*ent_ref
;
664 for (ref
= res
->refs
; *ref
!= NULL
; ++ref
) {
665 ent_r
= ldapsrv_init_reply(call
, LDAP_TAG_SearchResultReference
);
666 NT_STATUS_HAVE_NO_MEMORY(ent_r
);
668 /* Better to have the whole referrals kept here,
669 * than to find someone further up didn't put
670 * a value in the right spot in the talloc tree
672 talloc_steal(ent_r
, *ref
);
674 ent_ref
= &ent_r
->msg
->r
.SearchResultReference
;
675 ent_ref
->referral
= *ref
;
677 ldapsrv_queue_reply(call
, ent_r
);
683 done_r
= ldapsrv_init_reply(call
, LDAP_TAG_SearchResultDone
);
684 NT_STATUS_HAVE_NO_MEMORY(done_r
);
686 done
= &done_r
->msg
->r
.SearchResultDone
;
688 done
->referral
= NULL
;
691 } else if (ldb_ret
== LDB_SUCCESS
) {
692 if (res
->count
>= success_limit
) {
693 DEBUG(10,("SearchRequest: results: [%d]\n", res
->count
));
694 result
= LDAP_SUCCESS
;
698 done_r
->msg
->controls
= res
->controls
;
699 talloc_steal(done_r
, res
->controls
);
702 DEBUG(10,("SearchRequest: error\n"));
703 result
= map_ldb_error(local_ctx
, ldb_ret
, ldb_errstring(samdb
),
707 done
->resultcode
= result
;
708 done
->errormessage
= (errstr
?talloc_strdup(done_r
, errstr
):NULL
);
710 talloc_free(local_ctx
);
712 ldapsrv_queue_reply(call
, done_r
);
716 static NTSTATUS
ldapsrv_ModifyRequest(struct ldapsrv_call
*call
)
718 struct ldap_ModifyRequest
*req
= &call
->request
->r
.ModifyRequest
;
719 struct ldap_Result
*modify_result
;
720 struct ldapsrv_reply
*modify_reply
;
721 TALLOC_CTX
*local_ctx
;
722 struct ldb_context
*samdb
= call
->conn
->ldb
;
723 struct ldb_message
*msg
= NULL
;
725 const char *errstr
= NULL
;
726 int result
= LDAP_SUCCESS
;
729 struct ldb_result
*res
= NULL
;
731 DEBUG(10, ("ModifyRequest"));
732 DEBUGADD(10, (" dn: %s\n", req
->dn
));
734 local_ctx
= talloc_named(call
, 0, "ModifyRequest local memory context");
735 NT_STATUS_HAVE_NO_MEMORY(local_ctx
);
737 dn
= ldb_dn_new(local_ctx
, samdb
, req
->dn
);
740 DEBUG(10, ("ModifyRequest: dn: [%s]\n", req
->dn
));
742 msg
= talloc(local_ctx
, struct ldb_message
);
743 NT_STATUS_HAVE_NO_MEMORY(msg
);
746 msg
->num_elements
= 0;
747 msg
->elements
= NULL
;
749 if (req
->num_mods
> 0) {
750 msg
->num_elements
= req
->num_mods
;
751 msg
->elements
= talloc_array(msg
, struct ldb_message_element
, req
->num_mods
);
752 NT_STATUS_HAVE_NO_MEMORY(msg
->elements
);
754 for (i
=0; i
< msg
->num_elements
; i
++) {
755 msg
->elements
[i
].name
= discard_const_p(char, req
->mods
[i
].attrib
.name
);
756 msg
->elements
[i
].num_values
= 0;
757 msg
->elements
[i
].values
= NULL
;
759 switch (req
->mods
[i
].type
) {
761 result
= LDAP_PROTOCOL_ERROR
;
762 map_ldb_error(local_ctx
,
763 LDB_ERR_PROTOCOL_ERROR
, NULL
, &errstr
);
764 errstr
= talloc_asprintf(local_ctx
,
765 "%s. Invalid LDAP_MODIFY_* type", errstr
);
767 case LDAP_MODIFY_ADD
:
768 msg
->elements
[i
].flags
= LDB_FLAG_MOD_ADD
;
770 case LDAP_MODIFY_DELETE
:
771 msg
->elements
[i
].flags
= LDB_FLAG_MOD_DELETE
;
773 case LDAP_MODIFY_REPLACE
:
774 msg
->elements
[i
].flags
= LDB_FLAG_MOD_REPLACE
;
778 msg
->elements
[i
].num_values
= req
->mods
[i
].attrib
.num_values
;
779 if (msg
->elements
[i
].num_values
> 0) {
780 msg
->elements
[i
].values
= talloc_array(msg
->elements
, struct ldb_val
,
781 msg
->elements
[i
].num_values
);
782 NT_STATUS_HAVE_NO_MEMORY(msg
->elements
[i
].values
);
784 for (j
=0; j
< msg
->elements
[i
].num_values
; j
++) {
785 msg
->elements
[i
].values
[j
].length
= req
->mods
[i
].attrib
.values
[j
].length
;
786 msg
->elements
[i
].values
[j
].data
= req
->mods
[i
].attrib
.values
[j
].data
;
793 modify_reply
= ldapsrv_init_reply(call
, LDAP_TAG_ModifyResponse
);
794 NT_STATUS_HAVE_NO_MEMORY(modify_reply
);
796 if (result
== LDAP_SUCCESS
) {
797 res
= talloc_zero(local_ctx
, struct ldb_result
);
798 NT_STATUS_HAVE_NO_MEMORY(res
);
799 ldb_ret
= ldapsrv_mod_with_controls(call
, msg
, call
->request
->controls
, res
);
800 result
= map_ldb_error(local_ctx
, ldb_ret
, ldb_errstring(samdb
),
804 modify_result
= &modify_reply
->msg
->r
.ModifyResponse
;
805 modify_result
->dn
= NULL
;
806 if ((res
!= NULL
) && (res
->refs
!= NULL
)) {
807 modify_result
->resultcode
= map_ldb_error(local_ctx
,
810 modify_result
->errormessage
= (errstr
?talloc_strdup(modify_reply
, errstr
):NULL
);
811 modify_result
->referral
= talloc_strdup(call
, *res
->refs
);
813 modify_result
->resultcode
= result
;
814 modify_result
->errormessage
= (errstr
?talloc_strdup(modify_reply
, errstr
):NULL
);
815 modify_result
->referral
= NULL
;
817 talloc_free(local_ctx
);
819 ldapsrv_queue_reply(call
, modify_reply
);
824 static NTSTATUS
ldapsrv_AddRequest(struct ldapsrv_call
*call
)
826 struct ldap_AddRequest
*req
= &call
->request
->r
.AddRequest
;
827 struct ldap_Result
*add_result
;
828 struct ldapsrv_reply
*add_reply
;
829 TALLOC_CTX
*local_ctx
;
830 struct ldb_context
*samdb
= call
->conn
->ldb
;
831 struct ldb_message
*msg
= NULL
;
833 const char *errstr
= NULL
;
834 int result
= LDAP_SUCCESS
;
837 struct ldb_result
*res
= NULL
;
839 DEBUG(10, ("AddRequest"));
840 DEBUGADD(10, (" dn: %s\n", req
->dn
));
842 local_ctx
= talloc_named(call
, 0, "AddRequest local memory context");
843 NT_STATUS_HAVE_NO_MEMORY(local_ctx
);
845 dn
= ldb_dn_new(local_ctx
, samdb
, req
->dn
);
848 DEBUG(10, ("AddRequest: dn: [%s]\n", req
->dn
));
850 msg
= talloc(local_ctx
, struct ldb_message
);
851 NT_STATUS_HAVE_NO_MEMORY(msg
);
854 msg
->num_elements
= 0;
855 msg
->elements
= NULL
;
857 if (req
->num_attributes
> 0) {
858 msg
->num_elements
= req
->num_attributes
;
859 msg
->elements
= talloc_array(msg
, struct ldb_message_element
, msg
->num_elements
);
860 NT_STATUS_HAVE_NO_MEMORY(msg
->elements
);
862 for (i
=0; i
< msg
->num_elements
; i
++) {
863 msg
->elements
[i
].name
= discard_const_p(char, req
->attributes
[i
].name
);
864 msg
->elements
[i
].flags
= 0;
865 msg
->elements
[i
].num_values
= 0;
866 msg
->elements
[i
].values
= NULL
;
868 if (req
->attributes
[i
].num_values
> 0) {
869 msg
->elements
[i
].num_values
= req
->attributes
[i
].num_values
;
870 msg
->elements
[i
].values
= talloc_array(msg
->elements
, struct ldb_val
,
871 msg
->elements
[i
].num_values
);
872 NT_STATUS_HAVE_NO_MEMORY(msg
->elements
[i
].values
);
874 for (j
=0; j
< msg
->elements
[i
].num_values
; j
++) {
875 msg
->elements
[i
].values
[j
].length
= req
->attributes
[i
].values
[j
].length
;
876 msg
->elements
[i
].values
[j
].data
= req
->attributes
[i
].values
[j
].data
;
883 add_reply
= ldapsrv_init_reply(call
, LDAP_TAG_AddResponse
);
884 NT_STATUS_HAVE_NO_MEMORY(add_reply
);
886 if (result
== LDAP_SUCCESS
) {
887 res
= talloc_zero(local_ctx
, struct ldb_result
);
888 NT_STATUS_HAVE_NO_MEMORY(res
);
889 ldb_ret
= ldapsrv_add_with_controls(call
, msg
, call
->request
->controls
, res
);
890 result
= map_ldb_error(local_ctx
, ldb_ret
, ldb_errstring(samdb
),
894 add_result
= &add_reply
->msg
->r
.AddResponse
;
895 add_result
->dn
= NULL
;
896 if ((res
!= NULL
) && (res
->refs
!= NULL
)) {
897 add_result
->resultcode
= map_ldb_error(local_ctx
,
898 LDB_ERR_REFERRAL
, NULL
,
900 add_result
->errormessage
= (errstr
?talloc_strdup(add_reply
,errstr
):NULL
);
901 add_result
->referral
= talloc_strdup(call
, *res
->refs
);
903 add_result
->resultcode
= result
;
904 add_result
->errormessage
= (errstr
?talloc_strdup(add_reply
,errstr
):NULL
);
905 add_result
->referral
= NULL
;
907 talloc_free(local_ctx
);
909 ldapsrv_queue_reply(call
, add_reply
);
914 static NTSTATUS
ldapsrv_DelRequest(struct ldapsrv_call
*call
)
916 struct ldap_DelRequest
*req
= &call
->request
->r
.DelRequest
;
917 struct ldap_Result
*del_result
;
918 struct ldapsrv_reply
*del_reply
;
919 TALLOC_CTX
*local_ctx
;
920 struct ldb_context
*samdb
= call
->conn
->ldb
;
922 const char *errstr
= NULL
;
923 int result
= LDAP_SUCCESS
;
925 struct ldb_result
*res
= NULL
;
927 DEBUG(10, ("DelRequest"));
928 DEBUGADD(10, (" dn: %s\n", req
->dn
));
930 local_ctx
= talloc_named(call
, 0, "DelRequest local memory context");
931 NT_STATUS_HAVE_NO_MEMORY(local_ctx
);
933 dn
= ldb_dn_new(local_ctx
, samdb
, req
->dn
);
936 DEBUG(10, ("DelRequest: dn: [%s]\n", req
->dn
));
939 del_reply
= ldapsrv_init_reply(call
, LDAP_TAG_DelResponse
);
940 NT_STATUS_HAVE_NO_MEMORY(del_reply
);
942 if (result
== LDAP_SUCCESS
) {
943 res
= talloc_zero(local_ctx
, struct ldb_result
);
944 NT_STATUS_HAVE_NO_MEMORY(res
);
945 ldb_ret
= ldapsrv_del_with_controls(call
, dn
, call
->request
->controls
, res
);
946 result
= map_ldb_error(local_ctx
, ldb_ret
, ldb_errstring(samdb
),
950 del_result
= &del_reply
->msg
->r
.DelResponse
;
951 del_result
->dn
= NULL
;
952 if ((res
!= NULL
) && (res
->refs
!= NULL
)) {
953 del_result
->resultcode
= map_ldb_error(local_ctx
,
954 LDB_ERR_REFERRAL
, NULL
,
956 del_result
->errormessage
= (errstr
?talloc_strdup(del_reply
,errstr
):NULL
);
957 del_result
->referral
= talloc_strdup(call
, *res
->refs
);
959 del_result
->resultcode
= result
;
960 del_result
->errormessage
= (errstr
?talloc_strdup(del_reply
,errstr
):NULL
);
961 del_result
->referral
= NULL
;
964 talloc_free(local_ctx
);
966 ldapsrv_queue_reply(call
, del_reply
);
970 static NTSTATUS
ldapsrv_ModifyDNRequest(struct ldapsrv_call
*call
)
972 struct ldap_ModifyDNRequest
*req
= &call
->request
->r
.ModifyDNRequest
;
973 struct ldap_Result
*modifydn
;
974 struct ldapsrv_reply
*modifydn_r
;
975 TALLOC_CTX
*local_ctx
;
976 struct ldb_context
*samdb
= call
->conn
->ldb
;
977 struct ldb_dn
*olddn
, *newdn
=NULL
, *newrdn
;
978 struct ldb_dn
*parentdn
= NULL
;
979 const char *errstr
= NULL
;
980 int result
= LDAP_SUCCESS
;
982 struct ldb_result
*res
= NULL
;
984 DEBUG(10, ("ModifyDNRequest"));
985 DEBUGADD(10, (" dn: %s", req
->dn
));
986 DEBUGADD(10, (" newrdn: %s\n", req
->newrdn
));
988 local_ctx
= talloc_named(call
, 0, "ModifyDNRequest local memory context");
989 NT_STATUS_HAVE_NO_MEMORY(local_ctx
);
991 olddn
= ldb_dn_new(local_ctx
, samdb
, req
->dn
);
992 VALID_DN_SYNTAX(olddn
);
994 newrdn
= ldb_dn_new(local_ctx
, samdb
, req
->newrdn
);
995 VALID_DN_SYNTAX(newrdn
);
997 DEBUG(10, ("ModifyDNRequest: olddn: [%s]\n", req
->dn
));
998 DEBUG(10, ("ModifyDNRequest: newrdn: [%s]\n", req
->newrdn
));
1000 if (ldb_dn_get_comp_num(newrdn
) == 0) {
1001 result
= LDAP_PROTOCOL_ERROR
;
1002 map_ldb_error(local_ctx
, LDB_ERR_PROTOCOL_ERROR
, NULL
,
1007 if (ldb_dn_get_comp_num(newrdn
) > 1) {
1008 result
= LDAP_NAMING_VIOLATION
;
1009 map_ldb_error(local_ctx
, LDB_ERR_NAMING_VIOLATION
, NULL
,
1014 /* we can't handle the rename if we should not remove the old dn */
1015 if (!req
->deleteolddn
) {
1016 result
= LDAP_UNWILLING_TO_PERFORM
;
1017 map_ldb_error(local_ctx
, LDB_ERR_UNWILLING_TO_PERFORM
, NULL
,
1019 errstr
= talloc_asprintf(local_ctx
,
1020 "%s. Old RDN must be deleted", errstr
);
1024 if (req
->newsuperior
) {
1025 parentdn
= ldb_dn_new(local_ctx
, samdb
, req
->newsuperior
);
1026 VALID_DN_SYNTAX(parentdn
);
1027 DEBUG(10, ("ModifyDNRequest: newsuperior: [%s]\n", req
->newsuperior
));
1031 parentdn
= ldb_dn_get_parent(local_ctx
, olddn
);
1034 result
= LDAP_NO_SUCH_OBJECT
;
1035 map_ldb_error(local_ctx
, LDB_ERR_NO_SUCH_OBJECT
, NULL
, &errstr
);
1039 if ( ! ldb_dn_add_child(parentdn
, newrdn
)) {
1040 result
= LDAP_OTHER
;
1041 map_ldb_error(local_ctx
, LDB_ERR_OTHER
, NULL
, &errstr
);
1047 modifydn_r
= ldapsrv_init_reply(call
, LDAP_TAG_ModifyDNResponse
);
1048 NT_STATUS_HAVE_NO_MEMORY(modifydn_r
);
1050 if (result
== LDAP_SUCCESS
) {
1051 res
= talloc_zero(local_ctx
, struct ldb_result
);
1052 NT_STATUS_HAVE_NO_MEMORY(res
);
1053 ldb_ret
= ldapsrv_rename_with_controls(call
, olddn
, newdn
, call
->request
->controls
, res
);
1054 result
= map_ldb_error(local_ctx
, ldb_ret
, ldb_errstring(samdb
),
1058 modifydn
= &modifydn_r
->msg
->r
.ModifyDNResponse
;
1059 modifydn
->dn
= NULL
;
1060 if ((res
!= NULL
) && (res
->refs
!= NULL
)) {
1061 modifydn
->resultcode
= map_ldb_error(local_ctx
,
1062 LDB_ERR_REFERRAL
, NULL
,
1064 modifydn
->errormessage
= (errstr
?talloc_strdup(modifydn_r
,errstr
):NULL
);
1065 modifydn
->referral
= talloc_strdup(call
, *res
->refs
);
1067 modifydn
->resultcode
= result
;
1068 modifydn
->errormessage
= (errstr
?talloc_strdup(modifydn_r
,errstr
):NULL
);
1069 modifydn
->referral
= NULL
;
1072 talloc_free(local_ctx
);
1074 ldapsrv_queue_reply(call
, modifydn_r
);
1075 return NT_STATUS_OK
;
1078 static NTSTATUS
ldapsrv_CompareRequest(struct ldapsrv_call
*call
)
1080 struct ldap_CompareRequest
*req
= &call
->request
->r
.CompareRequest
;
1081 struct ldap_Result
*compare
;
1082 struct ldapsrv_reply
*compare_r
;
1083 TALLOC_CTX
*local_ctx
;
1084 struct ldb_context
*samdb
= call
->conn
->ldb
;
1085 struct ldb_result
*res
= NULL
;
1087 const char *attrs
[1];
1088 const char *errstr
= NULL
;
1089 const char *filter
= NULL
;
1090 int result
= LDAP_SUCCESS
;
1093 DEBUG(10, ("CompareRequest"));
1094 DEBUGADD(10, (" dn: %s\n", req
->dn
));
1096 local_ctx
= talloc_named(call
, 0, "CompareRequest local_memory_context");
1097 NT_STATUS_HAVE_NO_MEMORY(local_ctx
);
1099 dn
= ldb_dn_new(local_ctx
, samdb
, req
->dn
);
1100 VALID_DN_SYNTAX(dn
);
1102 DEBUG(10, ("CompareRequest: dn: [%s]\n", req
->dn
));
1103 filter
= talloc_asprintf(local_ctx
, "(%s=%*s)", req
->attribute
,
1104 (int)req
->value
.length
, req
->value
.data
);
1105 NT_STATUS_HAVE_NO_MEMORY(filter
);
1107 DEBUGADD(10, ("CompareRequest: attribute: [%s]\n", filter
));
1112 compare_r
= ldapsrv_init_reply(call
, LDAP_TAG_CompareResponse
);
1113 NT_STATUS_HAVE_NO_MEMORY(compare_r
);
1115 if (result
== LDAP_SUCCESS
) {
1116 ldb_ret
= ldb_search(samdb
, local_ctx
, &res
,
1117 dn
, LDB_SCOPE_BASE
, attrs
, "%s", filter
);
1118 if (ldb_ret
!= LDB_SUCCESS
) {
1119 result
= map_ldb_error(local_ctx
, ldb_ret
,
1120 ldb_errstring(samdb
), &errstr
);
1121 DEBUG(10,("CompareRequest: error: %s\n", errstr
));
1122 } else if (res
->count
== 0) {
1123 DEBUG(10,("CompareRequest: doesn't matched\n"));
1124 result
= LDAP_COMPARE_FALSE
;
1126 } else if (res
->count
== 1) {
1127 DEBUG(10,("CompareRequest: matched\n"));
1128 result
= LDAP_COMPARE_TRUE
;
1130 } else if (res
->count
> 1) {
1131 result
= LDAP_OTHER
;
1132 map_ldb_error(local_ctx
, LDB_ERR_OTHER
, NULL
, &errstr
);
1133 errstr
= talloc_asprintf(local_ctx
,
1134 "%s. Too many objects match!", errstr
);
1135 DEBUG(10,("CompareRequest: %d results: %s\n", res
->count
, errstr
));
1139 compare
= &compare_r
->msg
->r
.CompareResponse
;
1141 compare
->resultcode
= result
;
1142 compare
->errormessage
= (errstr
?talloc_strdup(compare_r
,errstr
):NULL
);
1143 compare
->referral
= NULL
;
1145 talloc_free(local_ctx
);
1147 ldapsrv_queue_reply(call
, compare_r
);
1148 return NT_STATUS_OK
;
1151 static NTSTATUS
ldapsrv_AbandonRequest(struct ldapsrv_call
*call
)
1153 /* struct ldap_AbandonRequest *req = &call->request.r.AbandonRequest;*/
1154 DEBUG(10, ("AbandonRequest\n"));
1155 return NT_STATUS_OK
;
1158 NTSTATUS
ldapsrv_do_call(struct ldapsrv_call
*call
)
1161 struct ldap_message
*msg
= call
->request
;
1162 /* Check for undecoded critical extensions */
1163 for (i
=0; msg
->controls
&& msg
->controls
[i
]; i
++) {
1164 if (!msg
->controls_decoded
[i
] &&
1165 msg
->controls
[i
]->critical
) {
1166 DEBUG(3, ("ldapsrv_do_call: Critical extension %s is not known to this server\n",
1167 msg
->controls
[i
]->oid
));
1168 return ldapsrv_unwilling(call
, LDAP_UNAVAILABLE_CRITICAL_EXTENSION
);
1172 switch(call
->request
->type
) {
1173 case LDAP_TAG_BindRequest
:
1174 return ldapsrv_BindRequest(call
);
1175 case LDAP_TAG_UnbindRequest
:
1176 return ldapsrv_UnbindRequest(call
);
1177 case LDAP_TAG_SearchRequest
:
1178 return ldapsrv_SearchRequest(call
);
1179 case LDAP_TAG_ModifyRequest
:
1180 return ldapsrv_ModifyRequest(call
);
1181 case LDAP_TAG_AddRequest
:
1182 return ldapsrv_AddRequest(call
);
1183 case LDAP_TAG_DelRequest
:
1184 return ldapsrv_DelRequest(call
);
1185 case LDAP_TAG_ModifyDNRequest
:
1186 return ldapsrv_ModifyDNRequest(call
);
1187 case LDAP_TAG_CompareRequest
:
1188 return ldapsrv_CompareRequest(call
);
1189 case LDAP_TAG_AbandonRequest
:
1190 return ldapsrv_AbandonRequest(call
);
1191 case LDAP_TAG_ExtendedRequest
:
1192 return ldapsrv_ExtendedRequest(call
);
1194 return ldapsrv_unwilling(call
, LDAP_PROTOCOL_ERROR
);