4 Copyright (C) Simo Sorce 2005-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2007-2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * Component: ldb extended dn control module
26 * Description: this module builds a special dn for returned search
27 * results, and fixes some other aspects of the result (returned case issues)
36 #include <ldb_errors.h>
37 #include <ldb_module.h>
38 #include "libcli/security/security.h"
39 #include "librpc/gen_ndr/ndr_misc.h"
40 #include "librpc/gen_ndr/ndr_security.h"
41 #include "librpc/ndr/libndr.h"
42 #include "dsdb/samdb/samdb.h"
43 #include "dsdb/samdb/ldb_modules/util.h"
45 struct extended_dn_out_private
{
48 struct dsdb_openldap_dereference_control
*dereference_control
;
52 /* Do the lazy init of the derererence control */
54 static int extended_dn_out_dereference_setup_control(struct ldb_context
*ldb
, struct extended_dn_out_private
*p
)
56 const struct dsdb_schema
*schema
;
57 struct dsdb_openldap_dereference_control
*dereference_control
;
58 struct dsdb_attribute
*cur
;
61 if (p
->dereference_control
) {
65 schema
= dsdb_get_schema(ldb
, p
);
67 /* No schema on this DB (yet) */
71 p
->dereference_control
= dereference_control
72 = talloc_zero(p
, struct dsdb_openldap_dereference_control
);
74 if (!p
->dereference_control
) {
78 for (cur
= schema
->attributes
; cur
; cur
= cur
->next
) {
79 if (cur
->dn_format
!= DSDB_NORMAL_DN
) {
82 dereference_control
->dereference
83 = talloc_realloc(p
, dereference_control
->dereference
,
84 struct dsdb_openldap_dereference
*, i
+ 2);
85 if (!dereference_control
->dereference
) {
88 dereference_control
->dereference
[i
] = talloc(dereference_control
->dereference
,
89 struct dsdb_openldap_dereference
);
90 if (!dereference_control
->dereference
[i
]) {
93 dereference_control
->dereference
[i
]->source_attribute
= cur
->lDAPDisplayName
;
94 dereference_control
->dereference
[i
]->dereference_attribute
= p
->attrs
;
96 dereference_control
->dereference
[i
] = NULL
;
101 static char **copy_attrs(void *mem_ctx
, const char * const * attrs
)
106 for (num
= 0; attrs
[num
]; num
++);
108 nattrs
= talloc_array(mem_ctx
, char *, num
+ 1);
109 if (!nattrs
) return NULL
;
111 for(i
= 0; i
< num
; i
++) {
112 nattrs
[i
] = talloc_strdup(nattrs
, attrs
[i
]);
123 static bool add_attrs(void *mem_ctx
, char ***attrs
, const char *attr
)
128 for (num
= 0; (*attrs
)[num
]; num
++);
130 nattrs
= talloc_realloc(mem_ctx
, *attrs
, char *, num
+ 2);
131 if (!nattrs
) return false;
135 nattrs
[num
] = talloc_strdup(nattrs
, attr
);
136 if (!nattrs
[num
]) return false;
138 nattrs
[num
+ 1] = NULL
;
143 /* Inject the extended DN components, so the DN cn=Adminstrator,cn=users,dc=samba,dc=example,dc=com becomes
144 <GUID=541203ae-f7d6-47ef-8390-bfcf019f9583>;<SID=S-1-5-21-4177067393-1453636373-93818737-500>;cn=Adminstrator,cn=users,dc=samba,dc=example,dc=com */
146 static int inject_extended_dn_out(struct ldb_reply
*ares
,
147 struct ldb_context
*ldb
,
153 const DATA_BLOB
*guid_blob
;
154 const DATA_BLOB
*sid_blob
;
156 guid_blob
= ldb_msg_find_ldb_val(ares
->message
, "objectGUID");
157 sid_blob
= ldb_msg_find_ldb_val(ares
->message
, "objectSid");
160 ldb_set_errstring(ldb
, "Did not find objectGUID to inject into extended DN");
161 return LDB_ERR_OPERATIONS_ERROR
;
164 ret
= ldb_dn_set_extended_component(ares
->message
->dn
, "GUID", guid_blob
);
165 if (ret
!= LDB_SUCCESS
) {
169 ret
= ldb_dn_set_extended_component(ares
->message
->dn
, "SID", sid_blob
);
170 if (ret
!= LDB_SUCCESS
) {
176 ldb_msg_remove_attr(ares
->message
, "objectGUID");
179 if (sid_blob
&& remove_sid
) {
180 ldb_msg_remove_attr(ares
->message
, "objectSid");
186 static int handle_dereference_openldap(struct ldb_dn
*dn
,
187 struct dsdb_openldap_dereference_result
**dereference_attrs
,
188 const char *attr
, const DATA_BLOB
*val
)
190 const struct ldb_val
*entryUUIDblob
, *sid_blob
;
191 struct ldb_message fake_msg
; /* easier to use routines that expect an ldb_message */
194 fake_msg
.num_elements
= 0;
196 /* Look for this attribute in the returned control */
197 for (j
= 0; dereference_attrs
&& dereference_attrs
[j
]; j
++) {
198 struct ldb_val source_dn
= data_blob_string_const(dereference_attrs
[j
]->dereferenced_dn
);
199 if (ldb_attr_cmp(dereference_attrs
[j
]->source_attribute
, attr
) == 0
200 && data_blob_cmp(&source_dn
, val
) == 0) {
201 fake_msg
.num_elements
= dereference_attrs
[j
]->num_attributes
;
202 fake_msg
.elements
= dereference_attrs
[j
]->attributes
;
206 if (!fake_msg
.num_elements
) {
209 /* Look for an OpenLDAP entryUUID */
211 entryUUIDblob
= ldb_msg_find_ldb_val(&fake_msg
, "entryUUID");
214 struct ldb_val guid_blob
;
217 status
= GUID_from_data_blob(entryUUIDblob
, &guid
);
219 if (!NT_STATUS_IS_OK(status
)) {
220 return LDB_ERR_INVALID_DN_SYNTAX
;
222 status
= GUID_to_ndr_blob(&guid
, dn
, &guid_blob
);
223 if (!NT_STATUS_IS_OK(status
)) {
224 return LDB_ERR_INVALID_DN_SYNTAX
;
227 ldb_dn_set_extended_component(dn
, "GUID", &guid_blob
);
230 sid_blob
= ldb_msg_find_ldb_val(&fake_msg
, "objectSid");
232 /* Look for the objectSid */
234 ldb_dn_set_extended_component(dn
, "SID", sid_blob
);
239 static int handle_dereference_fds(struct ldb_dn
*dn
,
240 struct dsdb_openldap_dereference_result
**dereference_attrs
,
241 const char *attr
, const DATA_BLOB
*val
)
243 const struct ldb_val
*nsUniqueIdBlob
, *sidBlob
;
244 struct ldb_message fake_msg
; /* easier to use routines that expect an ldb_message */
247 fake_msg
.num_elements
= 0;
249 /* Look for this attribute in the returned control */
250 for (j
= 0; dereference_attrs
&& dereference_attrs
[j
]; j
++) {
251 struct ldb_val source_dn
= data_blob_string_const(dereference_attrs
[j
]->dereferenced_dn
);
252 if (ldb_attr_cmp(dereference_attrs
[j
]->source_attribute
, attr
) == 0
253 && data_blob_cmp(&source_dn
, val
) == 0) {
254 fake_msg
.num_elements
= dereference_attrs
[j
]->num_attributes
;
255 fake_msg
.elements
= dereference_attrs
[j
]->attributes
;
259 if (!fake_msg
.num_elements
) {
263 /* Look for the nsUniqueId */
265 nsUniqueIdBlob
= ldb_msg_find_ldb_val(&fake_msg
, "nsUniqueId");
266 if (nsUniqueIdBlob
) {
268 struct ldb_val guid_blob
;
271 status
= NS_GUID_from_string((char *)nsUniqueIdBlob
->data
, &guid
);
273 if (!NT_STATUS_IS_OK(status
)) {
274 return LDB_ERR_INVALID_DN_SYNTAX
;
276 status
= GUID_to_ndr_blob(&guid
, dn
, &guid_blob
);
277 if (!NT_STATUS_IS_OK(status
)) {
278 return LDB_ERR_INVALID_DN_SYNTAX
;
281 ldb_dn_set_extended_component(dn
, "GUID", &guid_blob
);
284 /* Look for the objectSid */
286 sidBlob
= ldb_msg_find_ldb_val(&fake_msg
, "sambaSID");
288 enum ndr_err_code ndr_err
;
290 struct ldb_val sid_blob
;
293 sid
= dom_sid_parse_length(NULL
, sidBlob
);
296 return LDB_ERR_INVALID_DN_SYNTAX
;
299 ndr_err
= ndr_push_struct_blob(&sid_blob
, NULL
, sid
,
300 (ndr_push_flags_fn_t
)ndr_push_dom_sid
);
302 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
303 return LDB_ERR_INVALID_DN_SYNTAX
;
306 ldb_dn_set_extended_component(dn
, "SID", &sid_blob
);
312 struct extended_search_context
{
313 struct ldb_module
*module
;
314 const struct dsdb_schema
*schema
;
315 struct ldb_request
*req
;
324 fix one-way links to have the right string DN, to cope with
325 renames of the target
327 static int fix_one_way_link(struct extended_search_context
*ac
, struct ldb_dn
*dn
,
328 bool is_deleted_objects
, bool *remove_value
,
334 struct ldb_dn
*real_dn
;
335 uint32_t search_flags
;
336 TALLOC_CTX
*tmp_ctx
= talloc_new(ac
);
337 const char *attrs
[] = { NULL
};
338 struct ldb_result
*res
;
340 (*remove_value
) = false;
342 status
= dsdb_get_extended_dn_guid(dn
, &guid
, "GUID");
343 if (!NT_STATUS_IS_OK(status
)) {
344 /* this is a strange DN that doesn't have a GUID! just
345 return the current DN string?? */
346 talloc_free(tmp_ctx
);
350 search_flags
= DSDB_FLAG_NEXT_MODULE
| DSDB_SEARCH_SEARCH_ALL_PARTITIONS
| DSDB_SEARCH_ONE_ONLY
;
353 /* You must ALWAYS show one-way links regardless of the state of the target */
354 search_flags
|= (DSDB_SEARCH_SHOW_DELETED
| DSDB_SEARCH_SHOW_RECYCLED
);
357 ret
= dsdb_module_search(ac
->module
, tmp_ctx
, &res
, NULL
, LDB_SCOPE_SUBTREE
, attrs
,
358 search_flags
, ac
->req
, "objectguid=%s", GUID_string(tmp_ctx
, &guid
));
359 if (ret
!= LDB_SUCCESS
|| res
->count
!= 1) {
360 /* if we can't resolve this GUID, then we don't
361 display the link. This could be a link to a NC that we don't
362 have, or it could be a link to a deleted object
364 (*remove_value
) = true;
365 talloc_free(tmp_ctx
);
368 real_dn
= res
->msgs
[0]->dn
;
370 if (strcmp(ldb_dn_get_linearized(dn
), ldb_dn_get_linearized(real_dn
)) == 0) {
371 /* its already correct */
372 talloc_free(tmp_ctx
);
376 /* fix the DN by replacing its components with those from the
379 if (!ldb_dn_replace_components(dn
, real_dn
)) {
380 talloc_free(tmp_ctx
);
381 return ldb_operr(ldb_module_get_ctx(ac
->module
));
383 talloc_free(tmp_ctx
);
390 this is called to post-process the results from the search
392 static int extended_callback(struct ldb_request
*req
, struct ldb_reply
*ares
,
393 int (*handle_dereference
)(struct ldb_dn
*dn
,
394 struct dsdb_openldap_dereference_result
**dereference_attrs
,
395 const char *attr
, const DATA_BLOB
*val
))
397 struct extended_search_context
*ac
;
398 struct ldb_control
*control
;
399 struct dsdb_openldap_dereference_result_control
*dereference_control
= NULL
;
402 struct ldb_message
*msg
;
403 struct extended_dn_out_private
*p
;
404 struct ldb_context
*ldb
;
405 bool have_reveal_control
=false, checked_reveal_control
=false;
407 ac
= talloc_get_type(req
->context
, struct extended_search_context
);
408 p
= talloc_get_type(ldb_module_get_private(ac
->module
), struct extended_dn_out_private
);
409 ldb
= ldb_module_get_ctx(ac
->module
);
411 return ldb_module_done(ac
->req
, NULL
, NULL
,
412 LDB_ERR_OPERATIONS_ERROR
);
414 if (ares
->error
!= LDB_SUCCESS
) {
415 return ldb_module_done(ac
->req
, ares
->controls
,
416 ares
->response
, ares
->error
);
421 switch (ares
->type
) {
422 case LDB_REPLY_REFERRAL
:
423 return ldb_module_send_referral(ac
->req
, ares
->referral
);
426 return ldb_module_done(ac
->req
, ares
->controls
,
427 ares
->response
, LDB_SUCCESS
);
428 case LDB_REPLY_ENTRY
:
432 if (p
&& p
->normalise
) {
433 ret
= dsdb_fix_dn_rdncase(ldb
, ares
->message
->dn
);
434 if (ret
!= LDB_SUCCESS
) {
435 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
440 /* for each record returned post-process to add any derived
441 attributes that have been asked for */
442 ret
= inject_extended_dn_out(ares
, ldb
,
443 ac
->extended_type
, ac
->remove_guid
,
445 if (ret
!= LDB_SUCCESS
) {
446 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
450 if ((p
&& p
->normalise
) || ac
->inject
) {
451 const struct ldb_val
*val
= ldb_msg_find_ldb_val(ares
->message
, "distinguishedName");
453 ldb_msg_remove_attr(ares
->message
, "distinguishedName");
455 ret
= ldb_msg_add_steal_string(ares
->message
, "distinguishedName",
456 ldb_dn_get_extended_linearized(ares
->message
, ares
->message
->dn
, ac
->extended_type
));
458 ret
= ldb_msg_add_linearized_dn(ares
->message
,
462 if (ret
!= LDB_SUCCESS
) {
468 if (p
&& p
->dereference
) {
469 control
= ldb_reply_get_control(ares
, DSDB_OPENLDAP_DEREFERENCE_CONTROL
);
471 if (control
&& control
->data
) {
472 dereference_control
= talloc_get_type(control
->data
, struct dsdb_openldap_dereference_result_control
);
476 if (!checked_reveal_control
) {
477 have_reveal_control
=
478 ldb_request_get_control(req
, LDB_CONTROL_REVEAL_INTERNALS
) != NULL
;
479 checked_reveal_control
= true;
483 * Shortcut for repl_meta_data. We asked for the data
484 * 'as-is', so stop processing here!
486 if (have_reveal_control
&& p
->normalise
== false && ac
->inject
== true) {
487 return ldb_module_send_entry(ac
->req
, msg
, ares
->controls
);
490 /* Walk the returned elements (but only if we have a schema to
491 * interpret the list with) */
492 for (i
= 0; ac
->schema
&& i
< msg
->num_elements
; i
++) {
493 bool make_extended_dn
;
494 const struct dsdb_attribute
*attribute
;
496 attribute
= dsdb_attribute_by_lDAPDisplayName(ac
->schema
, msg
->elements
[i
].name
);
502 /* If we are also in 'normalise' mode, then
503 * fix the attribute names to be in the
505 msg
->elements
[i
].name
= talloc_strdup(msg
->elements
, attribute
->lDAPDisplayName
);
506 if (!msg
->elements
[i
].name
) {
508 return ldb_module_done(ac
->req
, NULL
, NULL
, LDB_ERR_OPERATIONS_ERROR
);
512 /* distinguishedName has been dealt with above */
513 if (ldb_attr_cmp(msg
->elements
[i
].name
, "distinguishedName") == 0) {
517 /* Look to see if this attributeSyntax is a DN */
518 if (attribute
->dn_format
== DSDB_INVALID_DN
) {
522 make_extended_dn
= ac
->inject
;
524 /* Always show plain DN in case of Object(OR-Name) syntax */
525 if (make_extended_dn
) {
526 make_extended_dn
= (strcmp(attribute
->syntax
->ldap_oid
, DSDB_SYNTAX_OR_NAME
) != 0);
529 for (j
= 0; j
< msg
->elements
[i
].num_values
; j
++) {
532 struct dsdb_dn
*dsdb_dn
= NULL
;
533 struct ldb_val
*plain_dn
= &msg
->elements
[i
].values
[j
];
534 bool is_deleted_objects
= false;
536 /* this is a fast method for detecting deleted
537 linked attributes, working on the unparsed
539 if (dsdb_dn_is_deleted_val(plain_dn
) && !have_reveal_control
) {
540 /* it's a deleted linked attribute,
541 and we don't have the reveal control */
542 memmove(&msg
->elements
[i
].values
[j
],
543 &msg
->elements
[i
].values
[j
+1],
544 (msg
->elements
[i
].num_values
-(j
+1))*sizeof(struct ldb_val
));
545 msg
->elements
[i
].num_values
--;
551 dsdb_dn
= dsdb_dn_parse_trusted(msg
, ldb
, plain_dn
, attribute
->syntax
->ldap_oid
);
554 ldb_asprintf_errstring(ldb
,
555 "could not parse %.*s in %s on %s as a %s DN",
556 (int)plain_dn
->length
, plain_dn
->data
,
557 msg
->elements
[i
].name
, ldb_dn_get_linearized(msg
->dn
),
558 attribute
->syntax
->ldap_oid
);
559 talloc_free(dsdb_dn
);
560 return ldb_module_done(ac
->req
, NULL
, NULL
, LDB_ERR_INVALID_DN_SYNTAX
);
564 /* we need to know if this is a link to the
565 deleted objects container for fixing one way
567 if (dsdb_dn
->extra_part
.length
== 16) {
568 char *hex_string
= data_blob_hex_string_upper(req
, &dsdb_dn
->extra_part
);
569 if (hex_string
&& strcmp(hex_string
, DS_GUID_DELETED_OBJECTS_CONTAINER
) == 0) {
570 is_deleted_objects
= true;
572 talloc_free(hex_string
);
576 ret
= dsdb_fix_dn_rdncase(ldb
, dn
);
577 if (ret
!= LDB_SUCCESS
) {
578 talloc_free(dsdb_dn
);
579 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
583 /* If we are running in dereference mode (such
584 * as against OpenLDAP) then the DN in the msg
585 * above does not contain the extended values,
586 * and we need to look in the dereference
589 /* Look for this value in the attribute */
591 if (dereference_control
) {
592 ret
= handle_dereference(dn
,
593 dereference_control
->attributes
,
594 msg
->elements
[i
].name
,
595 &msg
->elements
[i
].values
[j
]);
596 if (ret
!= LDB_SUCCESS
) {
597 talloc_free(dsdb_dn
);
598 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
602 /* note that we don't fixup objectCategory as
603 it should not be possible to move
604 objectCategory elements in the schema */
605 if (attribute
->one_way_link
&&
606 strcasecmp(attribute
->lDAPDisplayName
, "objectCategory") != 0) {
608 ret
= fix_one_way_link(ac
, dn
, is_deleted_objects
, &remove_value
,
610 if (ret
!= LDB_SUCCESS
) {
611 talloc_free(dsdb_dn
);
612 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
615 !ldb_request_get_control(req
, LDB_CONTROL_REVEAL_INTERNALS
)) {
616 /* we show these with REVEAL
617 to allow dbcheck to find and
618 cleanup these orphaned links */
619 memmove(&msg
->elements
[i
].values
[j
],
620 &msg
->elements
[i
].values
[j
+1],
621 (msg
->elements
[i
].num_values
-(j
+1))*sizeof(struct ldb_val
));
622 msg
->elements
[i
].num_values
--;
628 if (make_extended_dn
) {
629 if (!ldb_dn_validate(dsdb_dn
->dn
)) {
630 ldb_asprintf_errstring(ldb
,
631 "could not parse %.*s in %s on %s as a %s DN",
632 (int)plain_dn
->length
, plain_dn
->data
,
633 msg
->elements
[i
].name
, ldb_dn_get_linearized(msg
->dn
),
634 attribute
->syntax
->ldap_oid
);
635 talloc_free(dsdb_dn
);
636 return ldb_module_done(ac
->req
, NULL
, NULL
, LDB_ERR_INVALID_DN_SYNTAX
);
638 /* don't let users see the internal extended
640 if (!have_reveal_control
) {
641 const char *accept
[] = { "GUID", "SID", NULL
};
642 ldb_dn_extended_filter(dn
, accept
);
644 dn_str
= dsdb_dn_get_extended_linearized(msg
->elements
[i
].values
,
645 dsdb_dn
, ac
->extended_type
);
647 dn_str
= dsdb_dn_get_linearized(msg
->elements
[i
].values
,
653 talloc_free(dsdb_dn
);
654 return ldb_module_done(ac
->req
, NULL
, NULL
, LDB_ERR_OPERATIONS_ERROR
);
656 msg
->elements
[i
].values
[j
] = data_blob_string_const(dn_str
);
657 talloc_free(dsdb_dn
);
659 if (msg
->elements
[i
].num_values
== 0) {
660 /* we've deleted all of the values from this
661 * element - remove the element */
662 memmove(&msg
->elements
[i
],
664 (msg
->num_elements
-(i
+1))*sizeof(struct ldb_message_element
));
669 return ldb_module_send_entry(ac
->req
, msg
, ares
->controls
);
672 static int extended_callback_ldb(struct ldb_request
*req
, struct ldb_reply
*ares
)
674 return extended_callback(req
, ares
, NULL
);
677 static int extended_callback_openldap(struct ldb_request
*req
, struct ldb_reply
*ares
)
679 return extended_callback(req
, ares
, handle_dereference_openldap
);
682 static int extended_callback_fds(struct ldb_request
*req
, struct ldb_reply
*ares
)
684 return extended_callback(req
, ares
, handle_dereference_fds
);
687 static int extended_dn_out_search(struct ldb_module
*module
, struct ldb_request
*req
,
688 int (*callback
)(struct ldb_request
*req
, struct ldb_reply
*ares
))
690 struct ldb_control
*control
;
691 struct ldb_control
*storage_format_control
;
692 struct ldb_extended_dn_control
*extended_ctrl
= NULL
;
693 struct extended_search_context
*ac
;
694 struct ldb_request
*down_req
;
696 const char * const *const_attrs
;
697 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
700 struct extended_dn_out_private
*p
= talloc_get_type(ldb_module_get_private(module
), struct extended_dn_out_private
);
702 /* The schema manipulation does not apply to special DNs */
703 if (ldb_dn_is_special(req
->op
.search
.base
)) {
704 return ldb_next_request(module
, req
);
707 /* check if there's an extended dn control */
708 control
= ldb_request_get_control(req
, LDB_CONTROL_EXTENDED_DN_OID
);
709 if (control
&& control
->data
) {
710 extended_ctrl
= talloc_get_type(control
->data
, struct ldb_extended_dn_control
);
711 if (!extended_ctrl
) {
712 return LDB_ERR_PROTOCOL_ERROR
;
716 /* Look to see if, as we are in 'store DN+GUID+SID' mode, the
717 * client is after the storage format (to fill in linked
719 storage_format_control
= ldb_request_get_control(req
, DSDB_CONTROL_DN_STORAGE_FORMAT_OID
);
720 if (!control
&& storage_format_control
&& storage_format_control
->data
) {
721 extended_ctrl
= talloc_get_type(storage_format_control
->data
, struct ldb_extended_dn_control
);
722 if (!extended_ctrl
) {
723 ldb_set_errstring(ldb
, "extended_dn_out: extended_ctrl was of the wrong data type");
724 return LDB_ERR_PROTOCOL_ERROR
;
728 ac
= talloc_zero(req
, struct extended_search_context
);
734 ac
->schema
= dsdb_get_schema(ldb
, ac
);
737 ac
->remove_guid
= false;
738 ac
->remove_sid
= false;
740 const_attrs
= req
->op
.search
.attrs
;
742 /* We only need to do special processing if we were asked for
743 * the extended DN, or we are 'store DN+GUID+SID'
744 * (!dereference) mode. (This is the normal mode for LDB on
746 if (control
|| (storage_format_control
&& p
&& !p
->dereference
)) {
749 ac
->extended_type
= extended_ctrl
->type
;
751 ac
->extended_type
= 0;
754 /* check if attrs only is specified, in that case check wether we need to modify them */
755 if (req
->op
.search
.attrs
&& !is_attr_in_list(req
->op
.search
.attrs
, "*")) {
756 if (! is_attr_in_list(req
->op
.search
.attrs
, "objectGUID")) {
757 ac
->remove_guid
= true;
759 if (! is_attr_in_list(req
->op
.search
.attrs
, "objectSid")) {
760 ac
->remove_sid
= true;
762 if (ac
->remove_guid
|| ac
->remove_sid
) {
763 new_attrs
= copy_attrs(ac
, req
->op
.search
.attrs
);
764 if (new_attrs
== NULL
) {
768 if (ac
->remove_guid
) {
769 if (!add_attrs(ac
, &new_attrs
, "objectGUID"))
770 return ldb_operr(ldb
);
772 if (ac
->remove_sid
) {
773 if (!add_attrs(ac
, &new_attrs
, "objectSid"))
774 return ldb_operr(ldb
);
776 const_attrs
= (const char * const *)new_attrs
;
781 ret
= ldb_build_search_req_ex(&down_req
,
784 req
->op
.search
.scope
,
790 LDB_REQ_SET_LOCATION(down_req
);
791 if (ret
!= LDB_SUCCESS
) {
795 /* mark extended DN and storage format controls as done */
797 control
->critical
= 0;
800 if (storage_format_control
) {
801 storage_format_control
->critical
= 0;
804 /* Add in dereference control, if we were asked to, we are
805 * using the 'dereference' mode (such as with an OpenLDAP
806 * backend) and have the control prepared */
807 if (control
&& p
&& p
->dereference
) {
808 ret
= extended_dn_out_dereference_setup_control(ldb
, p
);
809 if (ret
!= LDB_SUCCESS
) {
813 /* We should always have this, but before the schema
814 * is with us, things get tricky */
815 if (p
->dereference_control
) {
817 /* This control must *not* be critical,
818 * because if this particular request did not
819 * return any dereferencable attributes in the
820 * end, then OpenLDAP will reply with
821 * unavailableCriticalExtension, rather than
822 * just an empty return control */
823 ret
= ldb_request_add_control(down_req
,
824 DSDB_OPENLDAP_DEREFERENCE_CONTROL
,
825 false, p
->dereference_control
);
826 if (ret
!= LDB_SUCCESS
) {
832 /* perform the search */
833 return ldb_next_request(module
, down_req
);
836 static int extended_dn_out_ldb_search(struct ldb_module
*module
, struct ldb_request
*req
)
838 return extended_dn_out_search(module
, req
, extended_callback_ldb
);
841 static int extended_dn_out_openldap_search(struct ldb_module
*module
, struct ldb_request
*req
)
843 return extended_dn_out_search(module
, req
, extended_callback_openldap
);
846 static int extended_dn_out_fds_search(struct ldb_module
*module
, struct ldb_request
*req
)
848 return extended_dn_out_search(module
, req
, extended_callback_fds
);
851 static int extended_dn_out_ldb_init(struct ldb_module
*module
)
855 struct extended_dn_out_private
*p
= talloc(module
, struct extended_dn_out_private
);
856 struct dsdb_extended_dn_store_format
*dn_format
;
858 ldb_module_set_private(module
, p
);
861 return ldb_oom(ldb_module_get_ctx(module
));
864 dn_format
= talloc(p
, struct dsdb_extended_dn_store_format
);
867 return ldb_oom(ldb_module_get_ctx(module
));
870 dn_format
->store_extended_dn_in_ldb
= true;
871 ret
= ldb_set_opaque(ldb_module_get_ctx(module
), DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME
, dn_format
);
872 if (ret
!= LDB_SUCCESS
) {
877 p
->dereference
= false;
878 p
->normalise
= false;
880 ret
= ldb_mod_register_control(module
, LDB_CONTROL_EXTENDED_DN_OID
);
881 if (ret
!= LDB_SUCCESS
) {
882 ldb_debug(ldb_module_get_ctx(module
), LDB_DEBUG_ERROR
,
883 "extended_dn_out: Unable to register control with rootdse!\n");
884 return ldb_operr(ldb_module_get_ctx(module
));
887 return ldb_next_init(module
);
890 static int extended_dn_out_dereference_init(struct ldb_module
*module
, const char *attrs
[])
893 struct extended_dn_out_private
*p
= talloc_zero(module
, struct extended_dn_out_private
);
894 struct dsdb_extended_dn_store_format
*dn_format
;
896 ldb_module_set_private(module
, p
);
899 return ldb_module_oom(module
);
902 dn_format
= talloc(p
, struct dsdb_extended_dn_store_format
);
905 return ldb_module_oom(module
);
908 dn_format
->store_extended_dn_in_ldb
= false;
910 ret
= ldb_set_opaque(ldb_module_get_ctx(module
), DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME
, dn_format
);
911 if (ret
!= LDB_SUCCESS
) {
916 p
->dereference
= true;
919 /* At the moment, servers that need dereference also need the
920 * DN and attribute names to be normalised */
923 ret
= ldb_mod_register_control(module
, LDB_CONTROL_EXTENDED_DN_OID
);
924 if (ret
!= LDB_SUCCESS
) {
925 ldb_debug(ldb_module_get_ctx(module
), LDB_DEBUG_ERROR
,
926 "extended_dn_out: Unable to register control with rootdse!\n");
927 return ldb_operr(ldb_module_get_ctx(module
));
930 return ldb_next_init(module
);
933 static int extended_dn_out_openldap_init(struct ldb_module
*module
)
935 static const char *attrs
[] = {
941 return extended_dn_out_dereference_init(module
, attrs
);
944 static int extended_dn_out_fds_init(struct ldb_module
*module
)
946 static const char *attrs
[] = {
952 return extended_dn_out_dereference_init(module
, attrs
);
955 static const struct ldb_module_ops ldb_extended_dn_out_ldb_module_ops
= {
956 .name
= "extended_dn_out_ldb",
957 .search
= extended_dn_out_ldb_search
,
958 .init_context
= extended_dn_out_ldb_init
,
961 static const struct ldb_module_ops ldb_extended_dn_out_openldap_module_ops
= {
962 .name
= "extended_dn_out_openldap",
963 .search
= extended_dn_out_openldap_search
,
964 .init_context
= extended_dn_out_openldap_init
,
967 static const struct ldb_module_ops ldb_extended_dn_out_fds_module_ops
= {
968 .name
= "extended_dn_out_fds",
969 .search
= extended_dn_out_fds_search
,
970 .init_context
= extended_dn_out_fds_init
,
974 initialise the module
976 _PUBLIC_
int ldb_extended_dn_out_module_init(const char *version
)
979 LDB_MODULE_CHECK_VERSION(version
);
980 ret
= ldb_register_module(&ldb_extended_dn_out_ldb_module_ops
);
981 if (ret
!= LDB_SUCCESS
) {
984 ret
= ldb_register_module(&ldb_extended_dn_out_openldap_module_ops
);
985 if (ret
!= LDB_SUCCESS
) {
988 ret
= ldb_register_module(&ldb_extended_dn_out_fds_module_ops
);
989 if (ret
!= LDB_SUCCESS
) {