lib/ldb-samba/ldb_ildap.c

   1 /*
   2    ldb database library - ildap backend
   3
   4    Copyright (C) Andrew Tridgell  2005
   5    Copyright (C) Simo Sorce       2008
   6
   7      ** NOTE! The following LGPL license applies to the ldb
   8      ** library. This does NOT imply that all of Samba is released
   9      ** under the LGPL
  10
  11    This library is free software; you can redistribute it and/or
  12    modify it under the terms of the GNU Lesser General Public
  13    License as published by the Free Software Foundation; either
  14    version 3 of the License, or (at your option) any later version.
  15
  16    This library is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19    Lesser General Public License for more details.
  20
  21    You should have received a copy of the GNU Lesser General Public
  22    License along with this library; if not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 /*
  26  *  Name: ldb_ildap
  27  *
  28  *  Component: ldb ildap backend
  29  *
  30  *  Description: This is a ldb backend for the internal ldap
  31  *  client library in Samba4. By using this backend we are
  32  *  independent of a system ldap library
  33  *
  34  *  Author: Andrew Tridgell
  35  *
  36  *  Modifications:
  37  *
  38  *  - description: make the module use asynchronous calls
  39  *    date: Feb 2006
  40  *    author: Simo Sorce
  41  */
  42
  43 #include "includes.h"
  44 #include "ldb_module.h"
  45 #include "util/dlinklist.h"
  46
  47 #include "libcli/ldap/libcli_ldap.h"
  48 #include "libcli/ldap/ldap_client.h"
  49 #include "auth/auth.h"
  50 #include "auth/credentials/credentials.h"
  51
  52 struct ildb_private {
  53         struct ldap_connection *ldap;
  54         struct tevent_context *event_ctx;
  55 };
  56
  57 struct ildb_context {
  58         struct ldb_module *module;
  59         struct ldb_request *req;
  60
  61         struct ildb_private *ildb;
  62         struct ldap_request *ireq;
  63
  64         /* indicate we are already processing
  65          * the ldap_request in ildb_callback() */
  66         bool in_ildb_callback;
  67
  68         bool done;
  69
  70         struct ildb_destructor_ctx *dc;
  71 };
  72
  73 static void ildb_request_done(struct ildb_context *ctx,
  74                               struct ldb_control **ctrls, int error)
  75 {
  76         struct ldb_context *ldb;
  77         struct ldb_reply *ares;
  78
  79         ldb = ldb_module_get_ctx(ctx->module);
  80
  81         ctx->done = true;
  82
  83         if (ctx->req == NULL) {
  84                 /* if the req has been freed already just return */
  85                 return;
  86         }
  87
  88         ares = talloc_zero(ctx->req, struct ldb_reply);
  89         if (!ares) {
  90                 ldb_oom(ldb);
  91                 ctx->req->callback(ctx->req, NULL);
  92                 return;
  93         }
  94         ares->type = LDB_REPLY_DONE;
  95         ares->controls = talloc_steal(ares, ctrls);
  96         ares->error = error;
  97
  98         ctx->req->callback(ctx->req, ares);
  99 }
 100
 101 static void ildb_auto_done_callback(struct tevent_context *ev,
 102                                     struct tevent_timer *te,
 103                                     struct timeval t,
 104                                     void *private_data)
 105 {
 106         struct ildb_context *ac;
 107
 108         ac = talloc_get_type(private_data, struct ildb_context);
 109         ildb_request_done(ac, NULL, LDB_SUCCESS);
 110 }
 111
 112 /*
 113   convert a ldb_message structure to a list of ldap_mod structures
 114   ready for ildap_add() or ildap_modify()
 115 */
 116 static struct ldap_mod **ildb_msg_to_mods(void *mem_ctx, int *num_mods,
 117                                           const struct ldb_message *msg,
 118                                           int use_flags)
 119 {
 120         struct ldap_mod **mods;
 121         unsigned int i;
 122         int n = 0;
 123
 124         /* allocate maximum number of elements needed */
 125         mods = talloc_array(mem_ctx, struct ldap_mod *, msg->num_elements+1);
 126         if (!mods) {
 127                 errno = ENOMEM;
 128                 return NULL;
 129         }
 130         mods[0] = NULL;
 131
 132         for (i = 0; i < msg->num_elements; i++) {
 133                 const struct ldb_message_element *el = &msg->elements[i];
 134
 135                 mods[n] = talloc(mods, struct ldap_mod);
 136                 if (!mods[n]) {
 137                         goto failed;
 138                 }
 139                 mods[n + 1] = NULL;
 140                 mods[n]->type = 0;
 141                 mods[n]->attrib = *el;
 142                 if (use_flags) {
 143                         switch (el->flags & LDB_FLAG_MOD_MASK) {
 144                         case LDB_FLAG_MOD_ADD:
 145                                 mods[n]->type = LDAP_MODIFY_ADD;
 146                                 break;
 147                         case LDB_FLAG_MOD_DELETE:
 148                                 mods[n]->type = LDAP_MODIFY_DELETE;
 149                                 break;
 150                         case LDB_FLAG_MOD_REPLACE:
 151                                 mods[n]->type = LDAP_MODIFY_REPLACE;
 152                                 break;
 153                         }
 154                 }
 155                 n++;
 156         }
 157
 158         *num_mods = n;
 159         return mods;
 160
 161 failed:
 162         talloc_free(mods);
 163         return NULL;
 164 }
 165
 166
 167 /*
 168   map an ildap NTSTATUS to a ldb error code
 169 */
 170 static int ildb_map_error(struct ldb_module *module, NTSTATUS status)
 171 {
 172         struct ildb_private *ildb;
 173         struct ldb_context *ldb;
 174         TALLOC_CTX *mem_ctx;
 175
 176         ildb = talloc_get_type(ldb_module_get_private(module), struct ildb_private);
 177         ldb = ldb_module_get_ctx(module);
 178
 179         if (NT_STATUS_IS_OK(status)) {
 180                 return LDB_SUCCESS;
 181         }
 182
 183         mem_ctx = talloc_new(ildb);
 184         if (!mem_ctx) {
 185                 ldb_oom(ldb);
 186                 return LDB_ERR_OPERATIONS_ERROR;
 187         }
 188         ldb_set_errstring(ldb,
 189                           ldap_errstr(ildb->ldap, mem_ctx, status));
 190         talloc_free(mem_ctx);
 191         if (NT_STATUS_IS_LDAP(status)) {
 192                 return NT_STATUS_LDAP_CODE(status);
 193         }
 194         return LDB_ERR_OPERATIONS_ERROR;
 195 }
 196
 197 static void ildb_request_timeout(struct tevent_context *ev, struct tevent_timer *te,
 198                                  struct timeval t, void *private_data)
 199 {
 200         struct ildb_context *ac = talloc_get_type(private_data, struct ildb_context);
 201
 202         if (ac->ireq->state == LDAP_REQUEST_PENDING) {
 203                 DLIST_REMOVE(ac->ireq->conn->pending, ac->ireq);
 204         }
 205
 206         ildb_request_done(ac, NULL, LDB_ERR_TIME_LIMIT_EXCEEDED);
 207 }
 208
 209 static void ildb_callback(struct ldap_request *req)
 210 {
 211         struct ldb_context *ldb;
 212         struct ildb_context *ac;
 213         NTSTATUS status;
 214         struct ldap_SearchResEntry *search;
 215         struct ldap_message *msg;
 216         struct ldb_control **controls;
 217         struct ldb_message *ldbmsg;
 218         char *referral;
 219         bool callback_failed;
 220         bool request_done;
 221         int ret;
 222         int i;
 223
 224         ac = talloc_get_type(req->async.private_data, struct ildb_context);
 225         ldb = ldb_module_get_ctx(ac->module);
 226         callback_failed = false;
 227         request_done = false;
 228         controls = NULL;
 229
 230         /* check if we are already processing this request */
 231         if (ac->in_ildb_callback) {
 232                 return;
 233         }
 234         /* mark the request as being in process */
 235         ac->in_ildb_callback = true;
 236
 237         if (!NT_STATUS_IS_OK(req->status)) {
 238                 ret = ildb_map_error(ac->module, req->status);
 239                 ildb_request_done(ac, NULL, ret);
 240                 return;
 241         }
 242
 243         if (req->num_replies < 1) {
 244                 ret = LDB_ERR_OPERATIONS_ERROR;
 245                 ildb_request_done(ac, NULL, ret);
 246                 return;
 247         }
 248
 249         switch (req->type) {
 250
 251         case LDAP_TAG_ModifyRequest:
 252                 if (req->replies[0]->type != LDAP_TAG_ModifyResponse) {
 253                         ret = LDB_ERR_PROTOCOL_ERROR;
 254                         break;
 255                 }
 256                 status = ldap_check_response(ac->ireq->conn, &req->replies[0]->r.GeneralResult);
 257                 ret = ildb_map_error(ac->module, status);
 258                 request_done = true;
 259                 break;
 260
 261         case LDAP_TAG_AddRequest:
 262                 if (req->replies[0]->type != LDAP_TAG_AddResponse) {
 263                         ret = LDB_ERR_PROTOCOL_ERROR;
 264                         return;
 265                 }
 266                 status = ldap_check_response(ac->ireq->conn, &req->replies[0]->r.GeneralResult);
 267                 ret = ildb_map_error(ac->module, status);
 268                 request_done = true;
 269                 break;
 270
 271         case LDAP_TAG_DelRequest:
 272                 if (req->replies[0]->type != LDAP_TAG_DelResponse) {
 273                         ret = LDB_ERR_PROTOCOL_ERROR;
 274                         return;
 275                 }
 276                 status = ldap_check_response(ac->ireq->conn, &req->replies[0]->r.GeneralResult);
 277                 ret = ildb_map_error(ac->module, status);
 278                 request_done = true;
 279                 break;
 280
 281         case LDAP_TAG_ModifyDNRequest:
 282                 if (req->replies[0]->type != LDAP_TAG_ModifyDNResponse) {
 283                         ret = LDB_ERR_PROTOCOL_ERROR;
 284                         return;
 285                 }
 286                 status = ldap_check_response(ac->ireq->conn, &req->replies[0]->r.GeneralResult);
 287                 ret = ildb_map_error(ac->module, status);
 288                 request_done = true;
 289                 break;
 290
 291         case LDAP_TAG_SearchRequest:
 292                 /* loop over all messages */
 293                 for (i = 0; i < req->num_replies; i++) {
 294
 295                         msg = req->replies[i];
 296                         switch (msg->type) {
 297
 298                         case LDAP_TAG_SearchResultDone:
 299
 300                                 status = ldap_check_response(ac->ireq->conn, &msg->r.GeneralResult);
 301                                 if (!NT_STATUS_IS_OK(status)) {
 302                                         ret = ildb_map_error(ac->module, status);
 303                                         break;
 304                                 }
 305
 306                                 controls = talloc_steal(ac, msg->controls);
 307                                 if (msg->r.SearchResultDone.resultcode) {
 308                                         if (msg->r.SearchResultDone.errormessage) {
 309                                                 ldb_set_errstring(ldb, msg->r.SearchResultDone.errormessage);
 310                                         }
 311                                 }
 312
 313                                 ret = msg->r.SearchResultDone.resultcode;
 314                                 request_done = true;
 315                                 break;
 316
 317                         case LDAP_TAG_SearchResultEntry:
 318
 319                                 ldbmsg = ldb_msg_new(ac);
 320                                 if (!ldbmsg) {
 321                                         ret = LDB_ERR_OPERATIONS_ERROR;
 322                                         break;
 323                                 }
 324
 325                                 search = &(msg->r.SearchResultEntry);
 326
 327                                 ldbmsg->dn = ldb_dn_new(ldbmsg, ldb, search->dn);
 328                                 if ( ! ldb_dn_validate(ldbmsg->dn)) {
 329                                         ret = LDB_ERR_OPERATIONS_ERROR;
 330                                         break;
 331                                 }
 332                                 ldbmsg->num_elements = search->num_attributes;
 333                                 ldbmsg->elements = talloc_move(ldbmsg, &search->attributes);
 334
 335                                 controls = talloc_steal(ac, msg->controls);
 336
 337                                 ret = ldb_module_send_entry(ac->req, ldbmsg, controls);
 338                                 if (ret != LDB_SUCCESS) {
 339                                         callback_failed = true;
 340                                 }
 341
 342                                 break;
 343
 344                         case LDAP_TAG_SearchResultReference:
 345
 346                                 referral = talloc_strdup(ac, msg->r.SearchResultReference.referral);
 347
 348                                 ret = ldb_module_send_referral(ac->req, referral);
 349                                 if (ret != LDB_SUCCESS) {
 350                                         callback_failed = true;
 351                                 }
 352
 353                                 break;
 354
 355                         default:
 356                                 /* TAG not handled, fail ! */
 357                                 ret = LDB_ERR_PROTOCOL_ERROR;
 358                                 break;
 359                         }
 360
 361                         if (ret != LDB_SUCCESS) {
 362                                 break;
 363                         }
 364                 }
 365
 366                 talloc_free(req->replies);
 367                 req->replies = NULL;
 368                 req->num_replies = 0;
 369
 370                 break;
 371
 372         default:
 373                 ret = LDB_ERR_PROTOCOL_ERROR;
 374                 break;
 375         }
 376
 377         if (ret != LDB_SUCCESS) {
 378
 379                 /* if the callback failed the caller will have freed the
 380                  * request. Just return and don't try to use it */
 381                 if ( ! callback_failed) {
 382                         request_done = true;
 383                 }
 384         }
 385
 386         /* mark the request as not being in progress */
 387         ac->in_ildb_callback = false;
 388
 389         if (request_done) {
 390                 ildb_request_done(ac, controls, ret);
 391         }
 392
 393         return;
 394 }
 395
 396 static int ildb_request_send(struct ildb_context *ac, struct ldap_message *msg)
 397 {
 398         struct ldb_context *ldb;
 399         struct ldap_request *req;
 400
 401         if (!ac) {
 402                 return LDB_ERR_OPERATIONS_ERROR;
 403         }
 404
 405         ldb = ldb_module_get_ctx(ac->module);
 406
 407         ldb_request_set_state(ac->req, LDB_ASYNC_PENDING);
 408
 409         req = ldap_request_send(ac->ildb->ldap, msg);
 410         if (req == NULL) {
 411                 ldb_set_errstring(ldb, "async send request failed");
 412                 return LDB_ERR_OPERATIONS_ERROR;
 413         }
 414         ac->ireq = talloc_reparent(ac->ildb->ldap, ac, req);
 415
 416         if (!ac->ireq->conn) {
 417                 ldb_set_errstring(ldb, "connection to remote LDAP server dropped?");
 418                 return LDB_ERR_OPERATIONS_ERROR;
 419         }
 420
 421         talloc_free(req->time_event);
 422         req->time_event = NULL;
 423         if (ac->req->timeout) {
 424                 req->time_event = tevent_add_timer(ac->ildb->event_ctx, ac,
 425                                                    timeval_current_ofs(ac->req->timeout, 0),
 426                                                    ildb_request_timeout, ac);
 427         }
 428
 429         req->async.fn = ildb_callback;
 430         req->async.private_data = ac;
 431
 432         return LDB_SUCCESS;
 433 }
 434
 435 /*
 436   search for matching records using an asynchronous function
 437  */
 438 static int ildb_search(struct ildb_context *ac)
 439 {
 440         struct ldb_context *ldb;
 441         struct ldb_request *req = ac->req;
 442         struct ldap_message *msg;
 443         int n;
 444
 445         ldb = ldb_module_get_ctx(ac->module);
 446
 447         if (!req->callback || !req->context) {
 448                 ldb_set_errstring(ldb, "Async interface called with NULL callback function or NULL context");
 449                 return LDB_ERR_OPERATIONS_ERROR;
 450         }
 451
 452         if (req->op.search.tree == NULL) {
 453                 ldb_set_errstring(ldb, "Invalid expression parse tree");
 454                 return LDB_ERR_OPERATIONS_ERROR;
 455         }
 456
 457         msg = new_ldap_message(req);
 458         if (msg == NULL) {
 459                 ldb_set_errstring(ldb, "Out of Memory");
 460                 return LDB_ERR_OPERATIONS_ERROR;
 461         }
 462
 463         msg->type = LDAP_TAG_SearchRequest;
 464
 465         if (req->op.search.base == NULL) {
 466                 msg->r.SearchRequest.basedn = talloc_strdup(msg, "");
 467         } else {
 468                 msg->r.SearchRequest.basedn  = ldb_dn_get_extended_linearized(msg, req->op.search.base, 0);
 469         }
 470         if (msg->r.SearchRequest.basedn == NULL) {
 471                 ldb_set_errstring(ldb, "Unable to determine baseDN");
 472                 talloc_free(msg);
 473                 return LDB_ERR_OPERATIONS_ERROR;
 474         }
 475
 476         if (req->op.search.scope == LDB_SCOPE_DEFAULT) {
 477                 msg->r.SearchRequest.scope = LDB_SCOPE_SUBTREE;
 478         } else {
 479                 msg->r.SearchRequest.scope = req->op.search.scope;
 480         }
 481
 482         msg->r.SearchRequest.deref  = LDAP_DEREFERENCE_NEVER;
 483         msg->r.SearchRequest.timelimit = 0;
 484         msg->r.SearchRequest.sizelimit = 0;
 485         msg->r.SearchRequest.attributesonly = 0;
 486         msg->r.SearchRequest.tree = discard_const(req->op.search.tree);
 487
 488         for (n = 0; req->op.search.attrs && req->op.search.attrs[n]; n++) /* noop */ ;
 489         msg->r.SearchRequest.num_attributes = n;
 490         msg->r.SearchRequest.attributes = req->op.search.attrs;
 491         msg->controls = req->controls;
 492
 493         return ildb_request_send(ac, msg);
 494 }
 495
 496 /*
 497   add a record
 498 */
 499 static int ildb_add(struct ildb_context *ac)
 500 {
 501         struct ldb_request *req = ac->req;
 502         struct ldap_message *msg;
 503         struct ldap_mod **mods;
 504         int i,n;
 505
 506         msg = new_ldap_message(req);
 507         if (msg == NULL) {
 508                 return LDB_ERR_OPERATIONS_ERROR;
 509         }
 510
 511         msg->type = LDAP_TAG_AddRequest;
 512
 513         msg->r.AddRequest.dn = ldb_dn_get_extended_linearized(msg, req->op.add.message->dn, 0);
 514         if (msg->r.AddRequest.dn == NULL) {
 515                 talloc_free(msg);
 516                 return LDB_ERR_INVALID_DN_SYNTAX;
 517         }
 518
 519         mods = ildb_msg_to_mods(msg, &n, req->op.add.message, 0);
 520         if (mods == NULL) {
 521                 talloc_free(msg);
 522                 return LDB_ERR_OPERATIONS_ERROR;
 523         }
 524
 525         msg->r.AddRequest.num_attributes = n;
 526         msg->r.AddRequest.attributes = talloc_array(msg, struct ldb_message_element, n);
 527         if (msg->r.AddRequest.attributes == NULL) {
 528                 talloc_free(msg);
 529                 return LDB_ERR_OPERATIONS_ERROR;
 530         }
 531
 532         for (i = 0; i < n; i++) {
 533                 msg->r.AddRequest.attributes[i] = mods[i]->attrib;
 534         }
 535         msg->controls = req->controls;
 536
 537         return ildb_request_send(ac, msg);
 538 }
 539
 540 /*
 541   modify a record
 542 */
 543 static int ildb_modify(struct ildb_context *ac)
 544 {
 545         struct ldb_request *req = ac->req;
 546         struct ldap_message *msg;
 547         struct ldap_mod **mods;
 548         int i,n;
 549
 550         msg = new_ldap_message(req);
 551         if (msg == NULL) {
 552                 return LDB_ERR_OPERATIONS_ERROR;
 553         }
 554
 555         msg->type = LDAP_TAG_ModifyRequest;
 556
 557         msg->r.ModifyRequest.dn = ldb_dn_get_extended_linearized(msg, req->op.mod.message->dn, 0);
 558         if (msg->r.ModifyRequest.dn == NULL) {
 559                 talloc_free(msg);
 560                 return LDB_ERR_INVALID_DN_SYNTAX;
 561         }
 562
 563         mods = ildb_msg_to_mods(msg, &n, req->op.mod.message, 1);
 564         if (mods == NULL) {
 565                 talloc_free(msg);
 566                 return LDB_ERR_OPERATIONS_ERROR;
 567         }
 568
 569         msg->r.ModifyRequest.num_mods = n;
 570         msg->r.ModifyRequest.mods = talloc_array(msg, struct ldap_mod, n);
 571         if (msg->r.ModifyRequest.mods == NULL) {
 572                 talloc_free(msg);
 573                 return LDB_ERR_OPERATIONS_ERROR;
 574         }
 575
 576         for (i = 0; i < n; i++) {
 577                 msg->r.ModifyRequest.mods[i] = *mods[i];
 578         }
 579         msg->controls = req->controls;
 580         return ildb_request_send(ac, msg);
 581 }
 582
 583 /*
 584   delete a record
 585 */
 586 static int ildb_delete(struct ildb_context *ac)
 587 {
 588         struct ldb_request *req = ac->req;
 589         struct ldap_message *msg;
 590
 591         msg = new_ldap_message(req);
 592         if (msg == NULL) {
 593                 return LDB_ERR_OPERATIONS_ERROR;
 594         }
 595
 596         msg->type = LDAP_TAG_DelRequest;
 597
 598         msg->r.DelRequest.dn = ldb_dn_get_extended_linearized(msg, req->op.del.dn, 0);
 599         if (msg->r.DelRequest.dn == NULL) {
 600                 talloc_free(msg);
 601                 return LDB_ERR_INVALID_DN_SYNTAX;
 602         }
 603         msg->controls = req->controls;
 604
 605         return ildb_request_send(ac, msg);
 606 }
 607
 608 /*
 609   rename a record
 610 */
 611 static int ildb_rename(struct ildb_context *ac)
 612 {
 613         struct ldb_request *req = ac->req;
 614         struct ldap_message *msg;
 615         const char *rdn_name;
 616         const struct ldb_val *rdn_val;
 617
 618         msg = new_ldap_message(req);
 619         if (msg == NULL) {
 620                 return LDB_ERR_OPERATIONS_ERROR;
 621         }
 622
 623         msg->type = LDAP_TAG_ModifyDNRequest;
 624         msg->r.ModifyDNRequest.dn = ldb_dn_get_extended_linearized(msg, req->op.rename.olddn, 0);
 625         if (msg->r.ModifyDNRequest.dn == NULL) {
 626                 talloc_free(msg);
 627                 return LDB_ERR_INVALID_DN_SYNTAX;
 628         }
 629
 630         rdn_name = ldb_dn_get_rdn_name(req->op.rename.newdn);
 631         rdn_val = ldb_dn_get_rdn_val(req->op.rename.newdn);
 632
 633         if ((rdn_name != NULL) && (rdn_val != NULL)) {
 634                 msg->r.ModifyDNRequest.newrdn =
 635                         talloc_asprintf(msg, "%s=%s", rdn_name,
 636                                         rdn_val->length > 0 ? ldb_dn_escape_value(msg, *rdn_val) : "");
 637         } else {
 638                 msg->r.ModifyDNRequest.newrdn = talloc_strdup(msg, "");
 639         }
 640         if (msg->r.ModifyDNRequest.newrdn == NULL) {
 641                 talloc_free(msg);
 642                 return LDB_ERR_OPERATIONS_ERROR;
 643         }
 644
 645         msg->r.ModifyDNRequest.newsuperior =
 646                 ldb_dn_alloc_linearized(msg, ldb_dn_get_parent(msg, req->op.rename.newdn));
 647         if (msg->r.ModifyDNRequest.newsuperior == NULL) {
 648                 talloc_free(msg);
 649                 return LDB_ERR_INVALID_DN_SYNTAX;
 650         }
 651
 652         msg->r.ModifyDNRequest.deleteolddn = true;
 653         msg->controls = req->controls;
 654
 655         return ildb_request_send(ac, msg);
 656 }
 657
 658 static int ildb_start_trans(struct ldb_module *module)
 659 {
 660         /* TODO implement a local locking mechanism here */
 661
 662         return LDB_SUCCESS;
 663 }
 664
 665 static int ildb_end_trans(struct ldb_module *module)
 666 {
 667         /* TODO implement a local transaction mechanism here */
 668
 669         return LDB_SUCCESS;
 670 }
 671
 672 static int ildb_del_trans(struct ldb_module *module)
 673 {
 674         /* TODO implement a local locking mechanism here */
 675
 676         return LDB_SUCCESS;
 677 }
 678
 679 static bool ildb_dn_is_special(struct ldb_request *req)
 680 {
 681         struct ldb_dn *dn = NULL;
 682
 683         switch (req->operation) {
 684         case LDB_SEARCH:
 685                 dn = req->op.search.base;
 686                 break;
 687         case LDB_ADD:
 688                 dn = req->op.add.message->dn;
 689                 break;
 690         case LDB_MODIFY:
 691                 dn = req->op.mod.message->dn;
 692                 break;
 693         case LDB_DELETE:
 694                 dn = req->op.del.dn;
 695                 break;
 696         case LDB_RENAME:
 697                 dn = req->op.rename.olddn;
 698                 break;
 699         default:
 700                 break;
 701         }
 702
 703         if (dn && ldb_dn_is_special(dn)) {
 704                 return true;
 705         }
 706         return false;
 707 }
 708
 709 static int ildb_handle_request(struct ldb_module *module, struct ldb_request *req)
 710 {
 711         struct ldb_context *ldb;
 712         struct ildb_private *ildb;
 713         struct ildb_context *ac;
 714         struct tevent_timer *te;
 715         int ret;
 716
 717         ildb = talloc_get_type(ldb_module_get_private(module), struct ildb_private);
 718         ldb = ldb_module_get_ctx(module);
 719
 720         if (req->starttime == 0 || req->timeout == 0) {
 721                 ldb_set_errstring(ldb, "Invalid timeout settings");
 722                 return LDB_ERR_TIME_LIMIT_EXCEEDED;
 723         }
 724
 725         ac = talloc_zero(req, struct ildb_context);
 726         if (ac == NULL) {
 727                 ldb_set_errstring(ldb, "Out of Memory");
 728                 return LDB_ERR_OPERATIONS_ERROR;
 729         }
 730
 731         ac->module = module;
 732         ac->req = req;
 733         ac->ildb = ildb;
 734
 735         if (ildb_dn_is_special(req)) {
 736
 737                 te = tevent_add_timer(ac->ildb->event_ctx,
 738                                       ac, timeval_zero(),
 739                                       ildb_auto_done_callback, ac);
 740                 if (NULL == te) {
 741                         return LDB_ERR_OPERATIONS_ERROR;
 742                 }
 743
 744                 return LDB_SUCCESS;
 745         }
 746
 747         switch (ac->req->operation) {
 748         case LDB_SEARCH:
 749                 ret = ildb_search(ac);
 750                 break;
 751         case LDB_ADD:
 752                 ret = ildb_add(ac);
 753                 break;
 754         case LDB_MODIFY:
 755                 ret = ildb_modify(ac);
 756                 break;
 757         case LDB_DELETE:
 758                 ret = ildb_delete(ac);
 759                 break;
 760         case LDB_RENAME:
 761                 ret = ildb_rename(ac);
 762                 break;
 763         default:
 764                 /* no other op supported */
 765                 ret = LDB_ERR_PROTOCOL_ERROR;
 766                 break;
 767         }
 768
 769         return ret;
 770 }
 771
 772 static const struct ldb_module_ops ildb_ops = {
 773         .name              = "ldap",
 774         .search            = ildb_handle_request,
 775         .add               = ildb_handle_request,
 776         .modify            = ildb_handle_request,
 777         .del               = ildb_handle_request,
 778         .rename            = ildb_handle_request,
 779 /*      .request           = ildb_handle_request, */
 780         .start_transaction = ildb_start_trans,
 781         .end_transaction   = ildb_end_trans,
 782         .del_transaction   = ildb_del_trans,
 783 };
 784
 785 /*
 786   connect to the database
 787 */
 788 static int ildb_connect(struct ldb_context *ldb, const char *url,
 789                         unsigned int flags, const char *options[],
 790                         struct ldb_module **_module)
 791 {
 792         struct ldb_module *module;
 793         struct ildb_private *ildb;
 794         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 795         struct cli_credentials *creds;
 796         struct loadparm_context *lp_ctx;
 797
 798         module = ldb_module_new(ldb, ldb, "ldb_ildap backend", &ildb_ops);
 799         if (!module) return LDB_ERR_OPERATIONS_ERROR;
 800
 801         ildb = talloc(module, struct ildb_private);
 802         if (!ildb) {
 803                 ldb_oom(ldb);
 804                 goto failed;
 805         }
 806         ldb_module_set_private(module, ildb);
 807
 808         ildb->event_ctx = ldb_get_event_context(ldb);
 809
 810         lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
 811                                  struct loadparm_context);
 812
 813         ildb->ldap = ldap4_new_connection(ildb, lp_ctx,
 814                                           ildb->event_ctx);
 815         if (!ildb->ldap) {
 816                 ldb_oom(ldb);
 817                 goto failed;
 818         }
 819
 820         if (flags & LDB_FLG_RECONNECT) {
 821                 ldap_set_reconn_params(ildb->ldap, 10);
 822         }
 823
 824         status = ldap_connect(ildb->ldap, url);
 825         if (!NT_STATUS_IS_OK(status)) {
 826                 ldb_debug(ldb, LDB_DEBUG_ERROR, "Failed to connect to ldap URL '%s' - %s",
 827                           url, ldap_errstr(ildb->ldap, module, status));
 828                 goto failed;
 829         }
 830
 831         /* caller can optionally setup credentials using the opaque token 'credentials' */
 832         creds = talloc_get_type(ldb_get_opaque(ldb, "credentials"), struct cli_credentials);
 833         if (creds == NULL) {
 834                 struct auth_session_info *session_info = talloc_get_type(ldb_get_opaque(ldb, "sessionInfo"), struct auth_session_info);
 835                 if (session_info) {
 836                         creds = session_info->credentials;
 837                 }
 838         }
 839
 840         if (creds != NULL && cli_credentials_authentication_requested(creds)) {
 841                 const char *bind_dn = cli_credentials_get_bind_dn(creds);
 842                 if (bind_dn) {
 843                         const char *password = cli_credentials_get_password(creds);
 844                         status = ldap_bind_simple(ildb->ldap, bind_dn, password);
 845                         if (!NT_STATUS_IS_OK(status)) {
 846                                 ldb_debug(ldb, LDB_DEBUG_ERROR, "Failed to bind - %s",
 847                                           ldap_errstr(ildb->ldap, module, status));
 848                                 goto failed;
 849                         }
 850                 } else {
 851                         status = ldap_bind_sasl(ildb->ldap, creds, lp_ctx);
 852                         if (!NT_STATUS_IS_OK(status)) {
 853                                 ldb_debug(ldb, LDB_DEBUG_ERROR, "Failed to bind - %s",
 854                                           ldap_errstr(ildb->ldap, module, status));
 855                                 goto failed;
 856                         }
 857                 }
 858         }
 859
 860         *_module = module;
 861         return LDB_SUCCESS;
 862
 863 failed:
 864         talloc_free(module);
 865         if (NT_STATUS_IS_LDAP(status)) {
 866                 return NT_STATUS_LDAP_CODE(status);
 867         } else if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)
 868                    || NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
 869                    || NT_STATUS_EQUAL(status, NT_STATUS_LOGON_FAILURE)
 870                    || NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
 871                 return LDB_ERR_INVALID_CREDENTIALS;
 872         }
 873         return LDB_ERR_OPERATIONS_ERROR;
 874 }
 875
 876 /*
 877   initialise the module
 878  */
 879 _PUBLIC_ int ldb_ildap_init(const char *ldb_version)
 880 {
 881         int ret, i;
 882         const char *names[] = { "ldap", "ldaps", "ldapi", NULL };
 883         for (i=0; names[i]; i++) {
 884                 ret = ldb_register_backend(names[i], ildb_connect, true);
 885                 if (ret != LDB_SUCCESS) {
 886                         return ret;
 887                 }
 888         }
 889         return LDB_SUCCESS;
 890 }