?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
wscript: separate embedded_heimdal from system_heimdal
[Samba.git] / libcli / cldap / cldap.c
blobdaba37a21d710490219664d6559f09b1bbf263d3
1 /*
2 Unix SMB/CIFS implementation.
3
4 cldap client library
5
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Stefan Metzmacher 2009
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 /*
24 see RFC1798 for details of CLDAP
25
26 basic properties
27 - carried over UDP on port 389
28 - request and response matched by message ID
29 - request consists of only a single searchRequest element
30 - response can be in one of two forms
31 - a single searchResponse, followed by a searchResult
32 - a single searchResult
33 */
34
35 #include "includes.h"
36 #include <tevent.h>
37 #include "../lib/util/dlinklist.h"
38 #include "../libcli/ldap/ldap_message.h"
39 #include "../libcli/ldap/ldap_ndr.h"
40 #include "../libcli/cldap/cldap.h"
41 #include "../lib/tsocket/tsocket.h"
42 #include "../libcli/security/dom_sid.h"
43 #include "../librpc/gen_ndr/ndr_nbt.h"
44 #include "../lib/util/asn1.h"
45 #include "../lib/util/tevent_ntstatus.h"
46
47 #undef strcasecmp
48
49 /*
50 context structure for operations on cldap packets
51 */
52 struct cldap_socket {
53 /* the low level socket */
54 struct tdgram_context *sock;
55
56 /*
57 * Are we in connected mode, which means
58 * we get ICMP errors back instead of timing
59 * out requests. And we can only send requests
60 * to the connected peer.
61 */
62 bool connected;
63
64 /* the queue for outgoing dgrams */
65 struct tevent_queue *send_queue;
66
67 /* do we have an async tsocket_recvfrom request pending */
68 struct tevent_req *recv_subreq;
69
70 struct {
71 /* a queue of pending search requests */
72 struct cldap_search_state *list;
73
74 /* mapping from message_id to pending request */
75 struct idr_context *idr;
76 } searches;
77
78 /* what to do with incoming request packets */
79 struct {
80 struct tevent_context *ev;
81 void (*handler)(struct cldap_socket *,
82 void *private_data,
83 struct cldap_incoming *);
84 void *private_data;
85 } incoming;
86 };
87
88 struct cldap_search_state {
89 struct cldap_search_state *prev, *next;
90
91 struct {
92 struct tevent_context *ev;
93 struct cldap_socket *cldap;
94 } caller;
95
96 int message_id;
97
98 struct {
99 uint32_t idx;
100 uint32_t delay;
101 uint32_t count;
102 struct tsocket_address *dest;
103 DATA_BLOB blob;
104 } request;
105
106 struct {
107 struct cldap_incoming *in;
108 struct asn1_data *asn1;
109 } response;
110
111 struct tevent_req *req;
112 };
113
114 static int cldap_socket_destructor(struct cldap_socket *c)
115 {
116 while (c->searches.list) {
117 struct cldap_search_state *s = c->searches.list;
118 DLIST_REMOVE(c->searches.list, s);
119 ZERO_STRUCT(s->caller);
120 }
121
122 talloc_free(c->recv_subreq);
123 talloc_free(c->send_queue);
124 talloc_free(c->sock);
125 return 0;
126 }
127
128 static void cldap_recvfrom_done(struct tevent_req *subreq);
129
130 static bool cldap_recvfrom_setup(struct cldap_socket *c)
131 {
132 struct tevent_context *ev;
133
134 if (c->recv_subreq) {
135 return true;
136 }
137
138 if (!c->searches.list && !c->incoming.handler) {
139 return true;
140 }
141
142 ev = c->incoming.ev;
143 if (ev == NULL) {
144 ev = c->searches.list->caller.ev;
145 }
146
147 c->recv_subreq = tdgram_recvfrom_send(c, ev, c->sock);
148 if (!c->recv_subreq) {
149 return false;
150 }
151 tevent_req_set_callback(c->recv_subreq, cldap_recvfrom_done, c);
152
153 return true;
154 }
155
156 static void cldap_recvfrom_stop(struct cldap_socket *c)
157 {
158 if (!c->recv_subreq) {
159 return;
160 }
161
162 if (c->searches.list || c->incoming.handler) {
163 return;
164 }
165
166 talloc_free(c->recv_subreq);
167 c->recv_subreq = NULL;
168 }
169
170 static bool cldap_socket_recv_dgram(struct cldap_socket *c,
171 struct cldap_incoming *in);
172
173 static void cldap_recvfrom_done(struct tevent_req *subreq)
174 {
175 struct cldap_socket *c = tevent_req_callback_data(subreq,
176 struct cldap_socket);
177 struct cldap_incoming *in = NULL;
178 ssize_t ret;
179 bool setup_done;
180
181 c->recv_subreq = NULL;
182
183 in = talloc_zero(c, struct cldap_incoming);
184 if (!in) {
185 goto nomem;
186 }
187
188 ret = tdgram_recvfrom_recv(subreq,
189 &in->recv_errno,
190 in,
191 &in->buf,
192 &in->src);
193 talloc_free(subreq);
194 subreq = NULL;
195 if (ret >= 0) {
196 in->len = ret;
197 }
198 if (ret == -1 && in->recv_errno == 0) {
199 in->recv_errno = EIO;
200 }
201
202 /* this function should free or steal 'in' */
203 setup_done = cldap_socket_recv_dgram(c, in);
204 in = NULL;
205
206 if (!setup_done && !cldap_recvfrom_setup(c)) {
207 goto nomem;
208 }
209
210 return;
211
212 nomem:
213 talloc_free(subreq);
214 talloc_free(in);
215 }
216
217 /*
218 handle recv events on a cldap socket
219 */
220 static bool cldap_socket_recv_dgram(struct cldap_socket *c,
221 struct cldap_incoming *in)
222 {
223 struct asn1_data *asn1;
224 void *p;
225 struct cldap_search_state *search;
226 NTSTATUS status;
227
228 if (in->recv_errno != 0) {
229 goto error;
230 }
231
232 asn1 = asn1_init(in);
233 if (!asn1) {
234 goto nomem;
235 }
236
237 asn1_load_nocopy(asn1, in->buf, in->len);
238
239 in->ldap_msg = talloc(in, struct ldap_message);
240 if (in->ldap_msg == NULL) {
241 goto nomem;
242 }
243
244 /* this initial decode is used to find the message id */
245 status = ldap_decode(asn1, NULL, in->ldap_msg);
246 if (!NT_STATUS_IS_OK(status)) {
247 goto nterror;
248 }
249
250 /* find the pending request */
251 p = idr_find(c->searches.idr, in->ldap_msg->messageid);
252 if (p == NULL) {
253 if (!c->incoming.handler) {
254 TALLOC_FREE(in);
255 return true;
256 }
257
258 /* this function should free or steal 'in' */
259 c->incoming.handler(c, c->incoming.private_data, in);
260 return false;
261 }
262
263 search = talloc_get_type_abort(p, struct cldap_search_state);
264 search->response.in = talloc_move(search, &in);
265
266 search->response.asn1 = asn1;
267
268 asn1_load_nocopy(search->response.asn1,
269 search->response.in->buf, search->response.in->len);
270
271 DLIST_REMOVE(c->searches.list, search);
272
273 if (cldap_recvfrom_setup(c)) {
274 tevent_req_done(search->req);
275 return true;
276 }
277
278 /*
279 * This request was ok, just defer the notify of the caller
280 * and then just fail the next request if needed
281 */
282 tevent_req_defer_callback(search->req, search->caller.ev);
283 tevent_req_done(search->req);
284
285 status = NT_STATUS_NO_MEMORY;
286 /* in is NULL it this point */
287 goto nterror;
288 nomem:
289 in->recv_errno = ENOMEM;
290 error:
291 status = map_nt_error_from_unix_common(in->recv_errno);
292 nterror:
293 TALLOC_FREE(in);
294 /* in connected mode the first pending search gets the error */
295 if (!c->connected) {
296 /* otherwise we just ignore the error */
297 return false;
298 }
299 if (!c->searches.list) {
300 return false;
301 }
302 /*
303 * We might called tevent_req_done() for a successful
304 * search before, so we better deliver the failure
305 * after the success, that is why we better also
306 * use tevent_req_defer_callback() here.
307 */
308 tevent_req_defer_callback(c->searches.list->req,
309 c->searches.list->caller.ev);
310 tevent_req_nterror(c->searches.list->req, status);
311 return false;
312 }
313
314 /*
315 initialise a cldap_sock
316 */
317 NTSTATUS cldap_socket_init(TALLOC_CTX *mem_ctx,
318 const struct tsocket_address *local_addr,
319 const struct tsocket_address *remote_addr,
320 struct cldap_socket **_cldap)
321 {
322 struct cldap_socket *c = NULL;
323 struct tsocket_address *any = NULL;
324 NTSTATUS status;
325 int ret;
326 const char *fam = NULL;
327
328 if (local_addr == NULL && remote_addr == NULL) {
329 return NT_STATUS_INVALID_PARAMETER_MIX;
330 }
331
332 if (remote_addr) {
333 bool is_ipv4;
334 bool is_ipv6;
335
336 is_ipv4 = tsocket_address_is_inet(remote_addr, "ipv4");
337 is_ipv6 = tsocket_address_is_inet(remote_addr, "ipv6");
338
339 if (is_ipv4) {
340 fam = "ipv4";
341 } else if (is_ipv6) {
342 fam = "ipv6";
343 } else {
344 return NT_STATUS_INVALID_ADDRESS;
345 }
346 }
347
348 c = talloc_zero(mem_ctx, struct cldap_socket);
349 if (!c) {
350 goto nomem;
351 }
352
353 if (!local_addr) {
354 /*
355 * Here we know the address family of the remote address.
356 */
357 if (fam == NULL) {
358 return NT_STATUS_INVALID_PARAMETER_MIX;
359 }
360
361 ret = tsocket_address_inet_from_strings(c, fam,
362 NULL, 0,
363 &any);
364 if (ret != 0) {
365 status = map_nt_error_from_unix_common(errno);
366 goto nterror;
367 }
368 local_addr = any;
369 }
370
371 c->searches.idr = idr_init(c);
372 if (!c->searches.idr) {
373 goto nomem;
374 }
375
376 ret = tdgram_inet_udp_socket(local_addr, remote_addr,
377 c, &c->sock);
378 if (ret != 0) {
379 status = map_nt_error_from_unix_common(errno);
380 goto nterror;
381 }
382 talloc_free(any);
383
384 if (remote_addr) {
385 c->connected = true;
386 }
387
388 c->send_queue = tevent_queue_create(c, "cldap_send_queue");
389 if (!c->send_queue) {
390 goto nomem;
391 }
392
393 talloc_set_destructor(c, cldap_socket_destructor);
394
395 *_cldap = c;
396 return NT_STATUS_OK;
397
398 nomem:
399 status = NT_STATUS_NO_MEMORY;
400 nterror:
401 talloc_free(c);
402 return status;
403 }
404
405 /*
406 setup a handler for incoming requests
407 */
408 NTSTATUS cldap_set_incoming_handler(struct cldap_socket *c,
409 struct tevent_context *ev,
410 void (*handler)(struct cldap_socket *,
411 void *private_data,
412 struct cldap_incoming *),
413 void *private_data)
414 {
415 if (c->connected) {
416 return NT_STATUS_PIPE_CONNECTED;
417 }
418
419 c->incoming.ev = ev;
420 c->incoming.handler = handler;
421 c->incoming.private_data = private_data;
422
423 if (!cldap_recvfrom_setup(c)) {
424 ZERO_STRUCT(c->incoming);
425 return NT_STATUS_NO_MEMORY;
426 }
427
428 return NT_STATUS_OK;
429 }
430
431 struct cldap_reply_state {
432 struct tsocket_address *dest;
433 DATA_BLOB blob;
434 };
435
436 static void cldap_reply_state_destroy(struct tevent_req *subreq);
437
438 /*
439 queue a cldap reply for send
440 */
441 NTSTATUS cldap_reply_send(struct cldap_socket *cldap, struct cldap_reply *io)
442 {
443 struct cldap_reply_state *state = NULL;
444 struct ldap_message *msg;
445 DATA_BLOB blob1, blob2;
446 NTSTATUS status;
447 struct tevent_req *subreq;
448
449 if (cldap->connected) {
450 return NT_STATUS_PIPE_CONNECTED;
451 }
452
453 if (cldap->incoming.ev == NULL) {
454 return NT_STATUS_INVALID_PIPE_STATE;
455 }
456
457 if (!io->dest) {
458 return NT_STATUS_INVALID_ADDRESS;
459 }
460
461 state = talloc(cldap, struct cldap_reply_state);
462 NT_STATUS_HAVE_NO_MEMORY(state);
463
464 state->dest = tsocket_address_copy(io->dest, state);
465 if (!state->dest) {
466 goto nomem;
467 }
468
469 msg = talloc(state, struct ldap_message);
470 if (!msg) {
471 goto nomem;
472 }
473
474 msg->messageid = io->messageid;
475 msg->controls = NULL;
476
477 if (io->response) {
478 msg->type = LDAP_TAG_SearchResultEntry;
479 msg->r.SearchResultEntry = *io->response;
480
481 if (!ldap_encode(msg, NULL, &blob1, state)) {
482 status = NT_STATUS_INVALID_PARAMETER;
483 goto failed;
484 }
485 } else {
486 blob1 = data_blob(NULL, 0);
487 }
488
489 msg->type = LDAP_TAG_SearchResultDone;
490 msg->r.SearchResultDone = *io->result;
491
492 if (!ldap_encode(msg, NULL, &blob2, state)) {
493 status = NT_STATUS_INVALID_PARAMETER;
494 goto failed;
495 }
496 talloc_free(msg);
497
498 state->blob = data_blob_talloc(state, NULL, blob1.length + blob2.length);
499 if (!state->blob.data) {
500 goto nomem;
501 }
502
503 memcpy(state->blob.data, blob1.data, blob1.length);
504 memcpy(state->blob.data+blob1.length, blob2.data, blob2.length);
505 data_blob_free(&blob1);
506 data_blob_free(&blob2);
507
508 subreq = tdgram_sendto_queue_send(state,
509 cldap->incoming.ev,
510 cldap->sock,
511 cldap->send_queue,
512 state->blob.data,
513 state->blob.length,
514 state->dest);
515 if (!subreq) {
516 goto nomem;
517 }
518 /* the callback will just free the state, as we don't need a result */
519 tevent_req_set_callback(subreq, cldap_reply_state_destroy, state);
520
521 return NT_STATUS_OK;
522
523 nomem:
524 status = NT_STATUS_NO_MEMORY;
525 failed:
526 talloc_free(state);
527 return status;
528 }
529
530 static void cldap_reply_state_destroy(struct tevent_req *subreq)
531 {
532 struct cldap_reply_state *state = tevent_req_callback_data(subreq,
533 struct cldap_reply_state);
534
535 /* we don't want to know the result here, we just free the state */
536 talloc_free(subreq);
537 talloc_free(state);
538 }
539
540 static int cldap_search_state_destructor(struct cldap_search_state *s)
541 {
542 if (s->caller.cldap) {
543 if (s->message_id != -1) {
544 idr_remove(s->caller.cldap->searches.idr, s->message_id);
545 s->message_id = -1;
546 }
547 DLIST_REMOVE(s->caller.cldap->searches.list, s);
548 cldap_recvfrom_stop(s->caller.cldap);
549 ZERO_STRUCT(s->caller);
550 }
551
552 return 0;
553 }
554
555 static void cldap_search_state_queue_done(struct tevent_req *subreq);
556 static void cldap_search_state_wakeup_done(struct tevent_req *subreq);
557
558 /*
559 queue a cldap reply for send
560 */
561 struct tevent_req *cldap_search_send(TALLOC_CTX *mem_ctx,
562 struct tevent_context *ev,
563 struct cldap_socket *cldap,
564 const struct cldap_search *io)
565 {
566 struct tevent_req *req, *subreq;
567 struct cldap_search_state *state = NULL;
568 struct ldap_message *msg;
569 struct ldap_SearchRequest *search;
570 struct timeval now;
571 struct timeval end;
572 uint32_t i;
573 int ret;
574
575 req = tevent_req_create(mem_ctx, &state,
576 struct cldap_search_state);
577 if (!req) {
578 return NULL;
579 }
580 state->caller.ev = ev;
581 state->req = req;
582 state->caller.cldap = cldap;
583 state->message_id = -1;
584
585 talloc_set_destructor(state, cldap_search_state_destructor);
586
587 if (state->caller.cldap == NULL) {
588 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
589 goto post;
590 }
591
592 if (io->in.dest_address) {
593 if (cldap->connected) {
594 tevent_req_nterror(req, NT_STATUS_PIPE_CONNECTED);
595 goto post;
596 }
597 ret = tsocket_address_inet_from_strings(state,
598 "ip",
599 io->in.dest_address,
600 io->in.dest_port,
601 &state->request.dest);
602 if (ret != 0) {
603 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
604 goto post;
605 }
606 } else {
607 if (!cldap->connected) {
608 tevent_req_nterror(req, NT_STATUS_INVALID_ADDRESS);
609 goto post;
610 }
611 state->request.dest = NULL;
612 }
613
614 state->message_id = idr_get_new_random(cldap->searches.idr,
615 state, UINT16_MAX);
616 if (state->message_id == -1) {
617 tevent_req_nterror(req, NT_STATUS_INSUFFICIENT_RESOURCES);
618 goto post;
619 }
620
621 msg = talloc(state, struct ldap_message);
622 if (tevent_req_nomem(msg, req)) {
623 goto post;
624 }
625
626 msg->messageid = state->message_id;
627 msg->type = LDAP_TAG_SearchRequest;
628 msg->controls = NULL;
629 search = &msg->r.SearchRequest;
630
631 search->basedn = "";
632 search->scope = LDAP_SEARCH_SCOPE_BASE;
633 search->deref = LDAP_DEREFERENCE_NEVER;
634 search->timelimit = 0;
635 search->sizelimit = 0;
636 search->attributesonly = false;
637 search->num_attributes = str_list_length(io->in.attributes);
638 search->attributes = io->in.attributes;
639 search->tree = ldb_parse_tree(msg, io->in.filter);
640 if (tevent_req_nomem(search->tree, req)) {
641 goto post;
642 }
643
644 if (!ldap_encode(msg, NULL, &state->request.blob, state)) {
645 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
646 goto post;
647 }
648 talloc_free(msg);
649
650 state->request.idx = 0;
651 state->request.delay = 10*1000*1000;
652 state->request.count = 3;
653 if (io->in.timeout > 0) {
654 state->request.delay = io->in.timeout * 1000 * 1000;
655 state->request.count = io->in.retries + 1;
656 }
657
658 now = tevent_timeval_current();
659 end = now;
660 for (i = 0; i < state->request.count; i++) {
661 end = tevent_timeval_add(&end, state->request.delay / 1000000,
662 state->request.delay % 1000000);
663 }
664
665 if (!tevent_req_set_endtime(req, state->caller.ev, end)) {
666 goto post;
667 }
668
669 subreq = tdgram_sendto_queue_send(state,
670 state->caller.ev,
671 state->caller.cldap->sock,
672 state->caller.cldap->send_queue,
673 state->request.blob.data,
674 state->request.blob.length,
675 state->request.dest);
676 if (tevent_req_nomem(subreq, req)) {
677 goto post;
678 }
679 tevent_req_set_callback(subreq, cldap_search_state_queue_done, req);
680
681 DLIST_ADD_END(cldap->searches.list, state);
682
683 return req;
684
685 post:
686 return tevent_req_post(req, state->caller.ev);
687 }
688
689 static void cldap_search_state_queue_done(struct tevent_req *subreq)
690 {
691 struct tevent_req *req = tevent_req_callback_data(subreq,
692 struct tevent_req);
693 struct cldap_search_state *state = tevent_req_data(req,
694 struct cldap_search_state);
695 ssize_t ret;
696 int sys_errno = 0;
697 struct timeval next;
698
699 ret = tdgram_sendto_queue_recv(subreq, &sys_errno);
700 talloc_free(subreq);
701 if (ret == -1) {
702 NTSTATUS status;
703 status = map_nt_error_from_unix_common(sys_errno);
704 DLIST_REMOVE(state->caller.cldap->searches.list, state);
705 ZERO_STRUCT(state->caller.cldap);
706 tevent_req_nterror(req, status);
707 return;
708 }
709
710 state->request.idx++;
711
712 /* wait for incoming traffic */
713 if (!cldap_recvfrom_setup(state->caller.cldap)) {
714 tevent_req_oom(req);
715 return;
716 }
717
718 if (state->request.idx > state->request.count) {
719 /* we just wait for the response or a timeout */
720 return;
721 }
722
723 next = tevent_timeval_current_ofs(state->request.delay / 1000000,
724 state->request.delay % 1000000);
725 subreq = tevent_wakeup_send(state,
726 state->caller.ev,
727 next);
728 if (tevent_req_nomem(subreq, req)) {
729 return;
730 }
731 tevent_req_set_callback(subreq, cldap_search_state_wakeup_done, req);
732 }
733
734 static void cldap_search_state_wakeup_done(struct tevent_req *subreq)
735 {
736 struct tevent_req *req = tevent_req_callback_data(subreq,
737 struct tevent_req);
738 struct cldap_search_state *state = tevent_req_data(req,
739 struct cldap_search_state);
740 bool ok;
741
742 ok = tevent_wakeup_recv(subreq);
743 talloc_free(subreq);
744 if (!ok) {
745 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
746 return;
747 }
748
749 subreq = tdgram_sendto_queue_send(state,
750 state->caller.ev,
751 state->caller.cldap->sock,
752 state->caller.cldap->send_queue,
753 state->request.blob.data,
754 state->request.blob.length,
755 state->request.dest);
756 if (tevent_req_nomem(subreq, req)) {
757 return;
758 }
759 tevent_req_set_callback(subreq, cldap_search_state_queue_done, req);
760 }
761
762 /*
763 receive a cldap reply
764 */
765 NTSTATUS cldap_search_recv(struct tevent_req *req,
766 TALLOC_CTX *mem_ctx,
767 struct cldap_search *io)
768 {
769 struct cldap_search_state *state = tevent_req_data(req,
770 struct cldap_search_state);
771 struct ldap_message *ldap_msg;
772 NTSTATUS status;
773
774 if (tevent_req_is_nterror(req, &status)) {
775 goto failed;
776 }
777
778 ldap_msg = talloc(mem_ctx, struct ldap_message);
779 if (!ldap_msg) {
780 goto nomem;
781 }
782
783 status = ldap_decode(state->response.asn1, NULL, ldap_msg);
784 if (!NT_STATUS_IS_OK(status)) {
785 goto failed;
786 }
787
788 ZERO_STRUCT(io->out);
789
790 /* the first possible form has a search result in first place */
791 if (ldap_msg->type == LDAP_TAG_SearchResultEntry) {
792 io->out.response = talloc(mem_ctx, struct ldap_SearchResEntry);
793 if (!io->out.response) {
794 goto nomem;
795 }
796 *io->out.response = ldap_msg->r.SearchResultEntry;
797
798 /* decode the 2nd part */
799 status = ldap_decode(state->response.asn1, NULL, ldap_msg);
800 if (!NT_STATUS_IS_OK(status)) {
801 goto failed;
802 }
803 }
804
805 if (ldap_msg->type != LDAP_TAG_SearchResultDone) {
806 status = NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
807 goto failed;
808 }
809
810 io->out.result = talloc(mem_ctx, struct ldap_Result);
811 if (!io->out.result) {
812 goto nomem;
813 }
814 *io->out.result = ldap_msg->r.SearchResultDone;
815
816 if (io->out.result->resultcode != LDAP_SUCCESS) {
817 status = NT_STATUS_LDAP(io->out.result->resultcode);
818 goto failed;
819 }
820
821 tevent_req_received(req);
822 return NT_STATUS_OK;
823
824 nomem:
825 status = NT_STATUS_NO_MEMORY;
826 failed:
827 tevent_req_received(req);
828 return status;
829 }
830
831
832 /*
833 synchronous cldap search
834 */
835 NTSTATUS cldap_search(struct cldap_socket *cldap,
836 TALLOC_CTX *mem_ctx,
837 struct cldap_search *io)
838 {
839 TALLOC_CTX *frame;
840 struct tevent_req *req;
841 struct tevent_context *ev;
842 NTSTATUS status;
843
844 if (cldap->searches.list) {
845 return NT_STATUS_PIPE_BUSY;
846 }
847
848 if (cldap->incoming.handler) {
849 return NT_STATUS_INVALID_PIPE_STATE;
850 }
851
852 frame = talloc_stackframe();
853
854 ev = samba_tevent_context_init(frame);
855 if (ev == NULL) {
856 TALLOC_FREE(frame);
857 return NT_STATUS_NO_MEMORY;
858 }
859
860 req = cldap_search_send(mem_ctx, ev, cldap, io);
861 if (req == NULL) {
862 TALLOC_FREE(frame);
863 return NT_STATUS_NO_MEMORY;
864 }
865
866 if (!tevent_req_poll(req, ev)) {
867 status = map_nt_error_from_unix_common(errno);
868 TALLOC_FREE(frame);
869 return status;
870 }
871
872 status = cldap_search_recv(req, mem_ctx, io);
873 if (!NT_STATUS_IS_OK(status)) {
874 TALLOC_FREE(frame);
875 return status;
876 }
877
878 TALLOC_FREE(frame);
879 return NT_STATUS_OK;
880 }
881
882 struct cldap_netlogon_state {
883 struct cldap_search search;
884 };
885
886 char *cldap_netlogon_create_filter(TALLOC_CTX *mem_ctx,
887 const struct cldap_netlogon *io)
888 {
889 char *filter;
890
891 filter = talloc_asprintf(mem_ctx, "(&(NtVer=%s)",
892 ldap_encode_ndr_uint32(mem_ctx, io->in.version));
893 if (filter == NULL)
894 return NULL;
895
896 if (io->in.user) {
897 filter = talloc_asprintf_append_buffer(filter, "(User=%s)", io->in.user);
898 if (filter == NULL) {
899 return NULL;
900 }
901 }
902 if (io->in.host) {
903 filter = talloc_asprintf_append_buffer(filter, "(Host=%s)", io->in.host);
904 if (filter == NULL) {
905 return NULL;
906 }
907 }
908 if (io->in.realm) {
909 filter = talloc_asprintf_append_buffer(filter, "(DnsDomain=%s)", io->in.realm);
910 if (filter == NULL) {
911 return NULL;
912 }
913 }
914 if (io->in.acct_control != -1) {
915 filter = talloc_asprintf_append_buffer(filter, "(AAC=%s)",
916 ldap_encode_ndr_uint32(mem_ctx, io->in.acct_control));
917 if (filter == NULL) {
918 return NULL;
919 }
920 }
921 if (io->in.domain_sid) {
922 struct dom_sid *sid = dom_sid_parse_talloc(mem_ctx, io->in.domain_sid);
923
924 filter = talloc_asprintf_append_buffer(filter, "(domainSid=%s)",
925 ldap_encode_ndr_dom_sid(mem_ctx, sid));
926 if (filter == NULL) {
927 return NULL;
928 }
929 }
930 if (io->in.domain_guid) {
931 struct GUID guid;
932 GUID_from_string(io->in.domain_guid, &guid);
933
934 filter = talloc_asprintf_append_buffer(filter, "(DomainGuid=%s)",
935 ldap_encode_ndr_GUID(mem_ctx, &guid));
936 if (filter == NULL) {
937 return NULL;
938 }
939 }
940 filter = talloc_asprintf_append_buffer(filter, ")");
941
942 return filter;
943 }
944
945 static void cldap_netlogon_state_done(struct tevent_req *subreq);
946 /*
947 queue a cldap netlogon for send
948 */
949 struct tevent_req *cldap_netlogon_send(TALLOC_CTX *mem_ctx,
950 struct tevent_context *ev,
951 struct cldap_socket *cldap,
952 const struct cldap_netlogon *io)
953 {
954 struct tevent_req *req, *subreq;
955 struct cldap_netlogon_state *state;
956 char *filter;
957 static const char * const attr[] = { "NetLogon", NULL };
958
959 req = tevent_req_create(mem_ctx, &state,
960 struct cldap_netlogon_state);
961 if (!req) {
962 return NULL;
963 }
964
965 filter = cldap_netlogon_create_filter(state, io);
966 if (tevent_req_nomem(filter, req)) {
967 goto post;
968 }
969
970 if (io->in.dest_address) {
971 state->search.in.dest_address = talloc_strdup(state,
972 io->in.dest_address);
973 if (tevent_req_nomem(state->search.in.dest_address, req)) {
974 goto post;
975 }
976 state->search.in.dest_port = io->in.dest_port;
977 } else {
978 state->search.in.dest_address = NULL;
979 state->search.in.dest_port = 0;
980 }
981 state->search.in.filter = filter;
982 state->search.in.attributes = attr;
983 state->search.in.timeout = 2;
984 state->search.in.retries = 2;
985
986 subreq = cldap_search_send(state, ev, cldap, &state->search);
987 if (tevent_req_nomem(subreq, req)) {
988 goto post;
989 }
990 tevent_req_set_callback(subreq, cldap_netlogon_state_done, req);
991
992 return req;
993 post:
994 return tevent_req_post(req, ev);
995 }
996
997 static void cldap_netlogon_state_done(struct tevent_req *subreq)
998 {
999 struct tevent_req *req = tevent_req_callback_data(subreq,
1000 struct tevent_req);
1001 struct cldap_netlogon_state *state = tevent_req_data(req,
1002 struct cldap_netlogon_state);
1003 NTSTATUS status;
1004
1005 status = cldap_search_recv(subreq, state, &state->search);
1006 talloc_free(subreq);
1007
1008 if (tevent_req_nterror(req, status)) {
1009 return;
1010 }
1011
1012 tevent_req_done(req);
1013 }
1014
1015 /*
1016 receive a cldap netlogon reply
1017 */
1018 NTSTATUS cldap_netlogon_recv(struct tevent_req *req,
1019 TALLOC_CTX *mem_ctx,
1020 struct cldap_netlogon *io)
1021 {
1022 struct cldap_netlogon_state *state = tevent_req_data(req,
1023 struct cldap_netlogon_state);
1024 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1025 DATA_BLOB *data;
1026
1027 if (tevent_req_is_nterror(req, &status)) {
1028 goto failed;
1029 }
1030
1031 if (state->search.out.response == NULL) {
1032 status = NT_STATUS_NOT_FOUND;
1033 goto failed;
1034 }
1035
1036 if (state->search.out.response->num_attributes != 1 ||
1037 strcasecmp(state->search.out.response->attributes[0].name, "netlogon") != 0 ||
1038 state->search.out.response->attributes[0].num_values != 1 ||
1039 state->search.out.response->attributes[0].values->length < 2) {
1040 status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
1041 goto failed;
1042 }
1043 data = state->search.out.response->attributes[0].values;
1044
1045 status = pull_netlogon_samlogon_response(data, mem_ctx,
1046 &io->out.netlogon);
1047 if (!NT_STATUS_IS_OK(status)) {
1048 goto failed;
1049 }
1050
1051 if (io->in.map_response) {
1052 map_netlogon_samlogon_response(&io->out.netlogon);
1053 }
1054
1055 status = NT_STATUS_OK;
1056 failed:
1057 tevent_req_received(req);
1058 return status;
1059 }
1060
1061 /*
1062 sync cldap netlogon search
1063 */
1064 NTSTATUS cldap_netlogon(struct cldap_socket *cldap,
1065 TALLOC_CTX *mem_ctx,
1066 struct cldap_netlogon *io)
1067 {
1068 TALLOC_CTX *frame;
1069 struct tevent_req *req;
1070 struct tevent_context *ev;
1071 NTSTATUS status;
1072
1073 if (cldap->searches.list) {
1074 return NT_STATUS_PIPE_BUSY;
1075 }
1076
1077 if (cldap->incoming.handler) {
1078 return NT_STATUS_INVALID_PIPE_STATE;
1079 }
1080
1081 frame = talloc_stackframe();
1082
1083 ev = samba_tevent_context_init(frame);
1084 if (ev == NULL) {
1085 TALLOC_FREE(frame);
1086 return NT_STATUS_NO_MEMORY;
1087 }
1088
1089 req = cldap_netlogon_send(mem_ctx, ev, cldap, io);
1090 if (req == NULL) {
1091 TALLOC_FREE(frame);
1092 return NT_STATUS_NO_MEMORY;
1093 }
1094
1095 if (!tevent_req_poll(req, ev)) {
1096 status = map_nt_error_from_unix_common(errno);
1097 TALLOC_FREE(frame);
1098 return status;
1099 }
1100
1101 status = cldap_netlogon_recv(req, mem_ctx, io);
1102 if (!NT_STATUS_IS_OK(status)) {
1103 TALLOC_FREE(frame);
1104 return status;
1105 }
1106
1107 TALLOC_FREE(frame);
1108 return NT_STATUS_OK;
1109 }
1110
1111
1112 /*
1113 send an empty reply (used on any error, so the client doesn't keep waiting
1114 or send the bad request again)
1115 */
1116 NTSTATUS cldap_empty_reply(struct cldap_socket *cldap,
1117 uint32_t message_id,
1118 struct tsocket_address *dest)
1119 {
1120 NTSTATUS status;
1121 struct cldap_reply reply;
1122 struct ldap_Result result;
1123
1124 reply.messageid = message_id;
1125 reply.dest = dest;
1126 reply.response = NULL;
1127 reply.result = &result;
1128
1129 ZERO_STRUCT(result);
1130
1131 status = cldap_reply_send(cldap, &reply);
1132
1133 return status;
1134 }
1135
1136 /*
1137 send an error reply (used on any error, so the client doesn't keep waiting
1138 or send the bad request again)
1139 */
1140 NTSTATUS cldap_error_reply(struct cldap_socket *cldap,
1141 uint32_t message_id,
1142 struct tsocket_address *dest,
1143 int resultcode,
1144 const char *errormessage)
1145 {
1146 NTSTATUS status;
1147 struct cldap_reply reply;
1148 struct ldap_Result result;
1149
1150 reply.messageid = message_id;
1151 reply.dest = dest;
1152 reply.response = NULL;
1153 reply.result = &result;
1154
1155 ZERO_STRUCT(result);
1156 result.resultcode = resultcode;
1157 result.errormessage = errormessage;
1158
1159 status = cldap_reply_send(cldap, &reply);
1160
1161 return status;
1162 }
1163
1164
1165 /*
1166 send a netlogon reply
1167 */
1168 NTSTATUS cldap_netlogon_reply(struct cldap_socket *cldap,
1169 uint32_t message_id,
1170 struct tsocket_address *dest,
1171 uint32_t version,
1172 struct netlogon_samlogon_response *netlogon)
1173 {
1174 NTSTATUS status;
1175 struct cldap_reply reply;
1176 struct ldap_SearchResEntry response;
1177 struct ldap_Result result;
1178 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
1179 DATA_BLOB blob;
1180
1181 status = push_netlogon_samlogon_response(&blob, tmp_ctx,
1182 netlogon);
1183 if (!NT_STATUS_IS_OK(status)) {
1184 talloc_free(tmp_ctx);
1185 return status;
1186 }
1187 reply.messageid = message_id;
1188 reply.dest = dest;
1189 reply.response = &response;
1190 reply.result = &result;
1191
1192 ZERO_STRUCT(result);
1193
1194 response.dn = "";
1195 response.num_attributes = 1;
1196 response.attributes = talloc(tmp_ctx, struct ldb_message_element);
1197 NT_STATUS_HAVE_NO_MEMORY(response.attributes);
1198 response.attributes->name = "netlogon";
1199 response.attributes->num_values = 1;
1200 response.attributes->values = &blob;
1201
1202 status = cldap_reply_send(cldap, &reply);
1203
1204 talloc_free(tmp_ctx);
1205
1206 return status;
1207 }
1208
Samba GIT mirror