2 Unix SMB/CIFS implementation.
3 Infrastructure for async ldap client requests
4 Copyright (C) Volker Lendecke 2009
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "tldap_util.h"
23 #include "../libcli/security/security.h"
25 bool tldap_entry_values(struct tldap_message
*msg
, const char *attribute
,
26 int *num_values
, DATA_BLOB
**values
)
28 struct tldap_attribute
*attributes
;
29 int i
, num_attributes
;
31 if (!tldap_entry_attributes(msg
, &num_attributes
, &attributes
)) {
35 for (i
=0; i
<num_attributes
; i
++) {
36 if (strequal(attribute
, attributes
[i
].name
)) {
40 if (i
== num_attributes
) {
43 *num_values
= attributes
[i
].num_values
;
44 *values
= attributes
[i
].values
;
48 bool tldap_get_single_valueblob(struct tldap_message
*msg
,
49 const char *attribute
, DATA_BLOB
*blob
)
54 if (attribute
== NULL
) {
57 if (!tldap_entry_values(msg
, attribute
, &num_values
, &values
)) {
60 if (num_values
!= 1) {
67 char *tldap_talloc_single_attribute(struct tldap_message
*msg
,
68 const char *attribute
,
75 if (!tldap_get_single_valueblob(msg
, attribute
, &val
)) {
78 if (!convert_string_talloc(mem_ctx
, CH_UTF8
, CH_UNIX
,
80 &result
, &len
, false)) {
86 bool tldap_pull_binsid(struct tldap_message
*msg
, const char *attribute
,
91 if (!tldap_get_single_valueblob(msg
, attribute
, &val
)) {
94 return sid_parse((char *)val
.data
, val
.length
, sid
);
97 bool tldap_pull_guid(struct tldap_message
*msg
, const char *attribute
,
102 if (!tldap_get_single_valueblob(msg
, attribute
, &val
)) {
105 return NT_STATUS_IS_OK(GUID_from_data_blob(&val
, guid
));
108 static bool tldap_add_blob_vals(TALLOC_CTX
*mem_ctx
, struct tldap_mod
*mod
,
109 int num_newvals
, DATA_BLOB
*newvals
)
111 int num_values
= talloc_array_length(mod
->values
);
115 tmp
= talloc_realloc(mem_ctx
, mod
->values
, DATA_BLOB
,
116 num_values
+ num_newvals
);
122 for (i
=0; i
<num_newvals
; i
++) {
123 mod
->values
[i
+num_values
].data
= (uint8_t *)talloc_memdup(
124 mod
->values
, newvals
[i
].data
, newvals
[i
].length
);
125 if (mod
->values
[i
+num_values
].data
== NULL
) {
128 mod
->values
[i
+num_values
].length
= newvals
[i
].length
;
130 mod
->num_values
= num_values
+ num_newvals
;
134 bool tldap_add_mod_blobs(TALLOC_CTX
*mem_ctx
, struct tldap_mod
**pmods
,
135 int mod_op
, const char *attrib
,
136 int num_newvals
, DATA_BLOB
*newvals
)
138 struct tldap_mod new_mod
;
139 struct tldap_mod
*mods
= *pmods
;
140 struct tldap_mod
*mod
= NULL
;
144 mods
= talloc_array(mem_ctx
, struct tldap_mod
, 0);
150 num_mods
= talloc_array_length(mods
);
152 for (i
=0; i
<num_mods
; i
++) {
153 if ((mods
[i
].mod_op
== mod_op
)
154 && strequal(mods
[i
].attribute
, attrib
)) {
161 new_mod
.mod_op
= mod_op
;
162 new_mod
.attribute
= talloc_strdup(mods
, attrib
);
163 if (new_mod
.attribute
== NULL
) {
166 new_mod
.num_values
= 0;
167 new_mod
.values
= NULL
;
171 if ((num_newvals
!= 0)
172 && !tldap_add_blob_vals(mods
, mod
, num_newvals
, newvals
)) {
177 mods
= talloc_realloc(talloc_tos(), mods
, struct tldap_mod
,
182 mods
[num_mods
] = *mod
;
189 bool tldap_add_mod_str(TALLOC_CTX
*mem_ctx
, struct tldap_mod
**pmods
,
190 int mod_op
, const char *attrib
, const char *str
)
195 if (!convert_string_talloc(talloc_tos(), CH_UNIX
, CH_UTF8
, str
,
196 strlen(str
), &utf8
.data
, &utf8
.length
,
201 ret
= tldap_add_mod_blobs(mem_ctx
, pmods
, mod_op
, attrib
, 1, &utf8
);
202 TALLOC_FREE(utf8
.data
);
206 static bool tldap_make_mod_blob_int(struct tldap_message
*existing
,
208 int *pnum_mods
, struct tldap_mod
**pmods
,
209 const char *attrib
, DATA_BLOB newval
,
210 int (*comparison
)(const DATA_BLOB
*d1
,
211 const DATA_BLOB
*d2
))
214 DATA_BLOB
*values
= NULL
;
215 DATA_BLOB oldval
= data_blob_null
;
217 if ((existing
!= NULL
)
218 && tldap_entry_values(existing
, attrib
, &num_values
, &values
)) {
220 if (num_values
> 1) {
221 /* can't change multivalue attributes atm */
224 if (num_values
== 1) {
229 if ((oldval
.data
!= NULL
) && (newval
.data
!= NULL
)
230 && (comparison(&oldval
, &newval
) == 0)) {
231 /* Believe it or not, but LDAP will deny a delete and
232 an add at the same time if the values are the
234 DEBUG(10,("smbldap_make_mod_blob: attribute |%s| not "
235 "changed.\n", attrib
));
239 if (oldval
.data
!= NULL
) {
240 /* By deleting exactly the value we found in the entry this
241 * should be race-free in the sense that the LDAP-Server will
242 * deny the complete operation if somebody changed the
243 * attribute behind our back. */
244 /* This will also allow modifying single valued attributes in
245 * Novell NDS. In NDS you have to first remove attribute and
246 * then you could add new value */
248 DEBUG(10, ("smbldap_make_mod_blob: deleting attribute |%s|\n",
250 if (!tldap_add_mod_blobs(mem_ctx
, pmods
, TLDAP_MOD_DELETE
,
251 attrib
, 1, &oldval
)) {
256 /* Regardless of the real operation (add or modify)
257 we add the new value here. We rely on deleting
258 the old value, should it exist. */
260 if (newval
.data
!= NULL
) {
261 DEBUG(10, ("smbldap_make_mod: adding attribute |%s| value len "
262 "%d\n", attrib
, (int)newval
.length
));
263 if (!tldap_add_mod_blobs(mem_ctx
, pmods
, TLDAP_MOD_ADD
,
264 attrib
, 1, &newval
)) {
268 *pnum_mods
= talloc_array_length(*pmods
);
272 bool tldap_make_mod_blob(struct tldap_message
*existing
, TALLOC_CTX
*mem_ctx
,
273 int *pnum_mods
, struct tldap_mod
**pmods
,
274 const char *attrib
, DATA_BLOB newval
)
276 return tldap_make_mod_blob_int(existing
, mem_ctx
, pnum_mods
, pmods
,
277 attrib
, newval
, data_blob_cmp
);
280 static int compare_utf8_blobs(const DATA_BLOB
*d1
, const DATA_BLOB
*d2
)
286 if (!convert_string_talloc(talloc_tos(), CH_UTF8
, CH_UNIX
, d1
->data
,
287 d1
->length
, &s1
, &s1len
, false)) {
288 /* can't do much here */
291 if (!convert_string_talloc(talloc_tos(), CH_UTF8
, CH_UNIX
, d2
->data
,
292 d2
->length
, &s2
, &s2len
, false)) {
293 /* can't do much here */
297 ret
= StrCaseCmp(s1
, s2
);
303 bool tldap_make_mod_fmt(struct tldap_message
*existing
, TALLOC_CTX
*mem_ctx
,
304 int *pnum_mods
, struct tldap_mod
**pmods
,
305 const char *attrib
, const char *fmt
, ...)
310 DATA_BLOB blob
= data_blob_null
;
313 newval
= talloc_vasprintf(talloc_tos(), fmt
, ap
);
316 if (newval
== NULL
) {
320 blob
.length
= strlen(newval
);
321 if (blob
.length
!= 0) {
322 blob
.data
= CONST_DISCARD(uint8_t *, newval
);
324 ret
= tldap_make_mod_blob_int(existing
, mem_ctx
, pnum_mods
, pmods
,
325 attrib
, blob
, compare_utf8_blobs
);
330 const char *tldap_errstr(TALLOC_CTX
*mem_ctx
, struct tldap_context
*ld
, int rc
)
332 const char *ld_error
= NULL
;
335 ld_error
= tldap_msg_diagnosticmessage(tldap_ctx_lastmsg(ld
));
336 res
= talloc_asprintf(mem_ctx
, "LDAP error %d (%s), %s", rc
,
337 tldap_err2string(rc
),
338 ld_error
? ld_error
: "unknown");
342 int tldap_search_va(struct tldap_context
*ld
, const char *base
, int scope
,
343 const char *attrs
[], int num_attrs
, int attrsonly
,
344 TALLOC_CTX
*mem_ctx
, struct tldap_message
***res
,
345 const char *fmt
, va_list ap
)
350 filter
= talloc_vasprintf(talloc_tos(), fmt
, ap
);
351 if (filter
== NULL
) {
352 return TLDAP_NO_MEMORY
;
355 ret
= tldap_search(ld
, base
, scope
, filter
,
356 attrs
, num_attrs
, attrsonly
,
357 NULL
/*sctrls*/, 0, NULL
/*cctrls*/, 0,
358 0 /*timelimit*/, 0 /*sizelimit*/, 0 /*deref*/,
364 int tldap_search_fmt(struct tldap_context
*ld
, const char *base
, int scope
,
365 const char *attrs
[], int num_attrs
, int attrsonly
,
366 TALLOC_CTX
*mem_ctx
, struct tldap_message
***res
,
367 const char *fmt
, ...)
373 ret
= tldap_search_va(ld
, base
, scope
, attrs
, num_attrs
, attrsonly
,
374 mem_ctx
, res
, fmt
, ap
);
379 bool tldap_pull_uint64(struct tldap_message
*msg
, const char *attr
,
385 str
= tldap_talloc_single_attribute(msg
, attr
, talloc_tos());
387 DEBUG(10, ("Could not find attribute %s\n", attr
));
390 result
= strtoull(str
, NULL
, 10);
396 bool tldap_pull_uint32(struct tldap_message
*msg
, const char *attr
,
401 if (!tldap_pull_uint64(msg
, attr
, &result
)) {
404 *presult
= (uint32_t)result
;
408 struct tldap_fetch_rootdse_state
{
409 struct tldap_context
*ld
;
410 struct tldap_message
*rootdse
;
413 static void tldap_fetch_rootdse_done(struct tevent_req
*subreq
);
415 struct tevent_req
*tldap_fetch_rootdse_send(TALLOC_CTX
*mem_ctx
,
416 struct tevent_context
*ev
,
417 struct tldap_context
*ld
)
419 struct tevent_req
*req
, *subreq
;
420 struct tldap_fetch_rootdse_state
*state
;
421 static const char *attrs
[2] = { "*", "+" };
423 req
= tevent_req_create(mem_ctx
, &state
,
424 struct tldap_fetch_rootdse_state
);
429 state
->rootdse
= NULL
;
431 subreq
= tldap_search_send(
432 mem_ctx
, ev
, ld
, "", TLDAP_SCOPE_BASE
, "(objectclass=*)",
433 attrs
, ARRAY_SIZE(attrs
), 0, NULL
, 0, NULL
, 0, 0, 0, 0);
434 if (tevent_req_nomem(subreq
, req
)) {
435 return tevent_req_post(req
, ev
);
437 tevent_req_set_callback(subreq
, tldap_fetch_rootdse_done
, req
);
441 static void tldap_fetch_rootdse_done(struct tevent_req
*subreq
)
443 struct tevent_req
*req
= tevent_req_callback_data(
444 subreq
, struct tevent_req
);
445 struct tldap_fetch_rootdse_state
*state
= tevent_req_data(
446 req
, struct tldap_fetch_rootdse_state
);
447 struct tldap_message
*msg
;
450 rc
= tldap_search_recv(subreq
, state
, &msg
);
451 if (rc
!= TLDAP_SUCCESS
) {
453 tevent_req_error(req
, rc
);
457 switch (tldap_msg_type(msg
)) {
458 case TLDAP_RES_SEARCH_ENTRY
:
459 if (state
->rootdse
!= NULL
) {
462 state
->rootdse
= msg
;
464 case TLDAP_RES_SEARCH_RESULT
:
466 if (state
->rootdse
== NULL
) {
469 tevent_req_done(req
);
477 tevent_req_error(req
, TLDAP_PROTOCOL_ERROR
);
481 int tldap_fetch_rootdse_recv(struct tevent_req
*req
)
483 struct tldap_fetch_rootdse_state
*state
= tevent_req_data(
484 req
, struct tldap_fetch_rootdse_state
);
488 if (tevent_req_is_ldap_error(req
, &err
)) {
491 /* Trigger parsing the dn, just to make sure it's ok */
492 if (!tldap_entry_dn(state
->rootdse
, &dn
)) {
493 return TLDAP_DECODING_ERROR
;
495 if (!tldap_context_setattr(state
->ld
, "tldap:rootdse",
497 return TLDAP_NO_MEMORY
;
502 int tldap_fetch_rootdse(struct tldap_context
*ld
)
504 TALLOC_CTX
*frame
= talloc_stackframe();
505 struct tevent_context
*ev
;
506 struct tevent_req
*req
;
509 ev
= event_context_init(frame
);
511 result
= TLDAP_NO_MEMORY
;
515 req
= tldap_fetch_rootdse_send(frame
, ev
, ld
);
517 result
= TLDAP_NO_MEMORY
;
521 if (!tevent_req_poll(req
, ev
)) {
522 result
= TLDAP_OPERATIONS_ERROR
;
526 result
= tldap_fetch_rootdse_recv(req
);
532 struct tldap_message
*tldap_rootdse(struct tldap_context
*ld
)
534 return talloc_get_type(tldap_context_getattr(ld
, "tldap:rootdse"),
535 struct tldap_message
);
538 bool tldap_entry_has_attrvalue(struct tldap_message
*msg
,
539 const char *attribute
,
540 const DATA_BLOB blob
)
545 if (!tldap_entry_values(msg
, attribute
, &num_values
, &values
)) {
548 for (i
=0; i
<num_values
; i
++) {
549 if (data_blob_cmp(&values
[i
], &blob
) == 0) {
556 bool tldap_supports_control(struct tldap_context
*ld
, const char *oid
)
558 struct tldap_message
*rootdse
= tldap_rootdse(ld
);
560 if (rootdse
== NULL
) {
563 return tldap_entry_has_attrvalue(rootdse
, "supportedControl",
564 data_blob_const(oid
, strlen(oid
)));
567 struct tldap_control
*tldap_add_control(TALLOC_CTX
*mem_ctx
,
568 struct tldap_control
*ctrls
,
570 struct tldap_control
*ctrl
)
572 struct tldap_control
*result
;
574 result
= talloc_array(mem_ctx
, struct tldap_control
, num_ctrls
+1);
575 if (result
== NULL
) {
578 memcpy(result
, ctrls
, sizeof(struct tldap_control
) * num_ctrls
);
579 result
[num_ctrls
] = *ctrl
;
584 * Find a control returned by the server
586 struct tldap_control
*tldap_msg_findcontrol(struct tldap_message
*msg
,
589 struct tldap_control
*controls
;
592 tldap_msg_sctrls(msg
, &num_controls
, &controls
);
594 for (i
=0; i
<num_controls
; i
++) {
595 if (strcmp(controls
[i
].oid
, oid
) == 0) {
602 struct tldap_search_paged_state
{
603 struct tevent_context
*ev
;
604 struct tldap_context
*ld
;
611 struct tldap_control
*sctrls
;
613 struct tldap_control
*cctrls
;
620 struct asn1_data
*asn1
;
622 struct tldap_message
*result
;
625 static struct tevent_req
*tldap_ship_paged_search(
627 struct tldap_search_paged_state
*state
)
629 struct tldap_control
*pgctrl
;
630 struct asn1_data
*asn1
;
632 asn1
= asn1_init(state
);
636 asn1_push_tag(asn1
, ASN1_SEQUENCE(0));
637 asn1_write_Integer(asn1
, state
->page_size
);
638 asn1_write_OctetString(asn1
, state
->cookie
.data
, state
->cookie
.length
);
640 if (asn1
->has_error
) {
646 pgctrl
= &state
->sctrls
[state
->num_sctrls
-1];
647 pgctrl
->oid
= TLDAP_CONTROL_PAGEDRESULTS
;
648 pgctrl
->critical
= true;
649 if (!asn1_blob(state
->asn1
, &pgctrl
->value
)) {
653 return tldap_search_send(mem_ctx
, state
->ev
, state
->ld
, state
->base
,
654 state
->scope
, state
->filter
, state
->attrs
,
655 state
->num_attrs
, state
->attrsonly
,
656 state
->sctrls
, state
->num_sctrls
,
657 state
->cctrls
, state
->num_cctrls
,
658 state
->timelimit
, state
->sizelimit
,
662 static void tldap_search_paged_done(struct tevent_req
*subreq
);
664 struct tevent_req
*tldap_search_paged_send(TALLOC_CTX
*mem_ctx
,
665 struct tevent_context
*ev
,
666 struct tldap_context
*ld
,
667 const char *base
, int scope
,
672 struct tldap_control
*sctrls
,
674 struct tldap_control
*cctrls
,
681 struct tevent_req
*req
, *subreq
;
682 struct tldap_search_paged_state
*state
;
683 struct tldap_control empty_control
;
685 req
= tevent_req_create(mem_ctx
, &state
,
686 struct tldap_search_paged_state
);
693 state
->filter
= filter
;
694 state
->scope
= scope
;
695 state
->attrs
= attrs
;
696 state
->num_attrs
= num_attrs
;
697 state
->attrsonly
= attrsonly
;
698 state
->cctrls
= cctrls
;
699 state
->num_cctrls
= num_cctrls
;
700 state
->timelimit
= timelimit
;
701 state
->sizelimit
= sizelimit
;
702 state
->deref
= deref
;
704 state
->page_size
= page_size
;
706 state
->cookie
= data_blob_null
;
708 ZERO_STRUCT(empty_control
);
710 state
->sctrls
= tldap_add_control(state
, sctrls
, num_sctrls
,
712 if (tevent_req_nomem(state
->sctrls
, req
)) {
713 return tevent_req_post(req
, ev
);
715 state
->num_sctrls
= num_sctrls
+1;
717 subreq
= tldap_ship_paged_search(state
, state
);
718 if (tevent_req_nomem(subreq
, req
)) {
719 return tevent_req_post(req
, ev
);
721 tevent_req_set_callback(subreq
, tldap_search_paged_done
, req
);
726 static void tldap_search_paged_done(struct tevent_req
*subreq
)
728 struct tevent_req
*req
= tevent_req_callback_data(
729 subreq
, struct tevent_req
);
730 struct tldap_search_paged_state
*state
= tevent_req_data(
731 req
, struct tldap_search_paged_state
);
732 struct asn1_data
*asn1
;
733 struct tldap_control
*pgctrl
;
736 rc
= tldap_search_recv(subreq
, state
, &state
->result
);
737 if (rc
!= TLDAP_SUCCESS
) {
739 tevent_req_error(req
, rc
);
743 TALLOC_FREE(state
->asn1
);
745 switch (tldap_msg_type(state
->result
)) {
746 case TLDAP_RES_SEARCH_ENTRY
:
747 case TLDAP_RES_SEARCH_REFERENCE
:
748 tevent_req_notify_callback(req
);
750 case TLDAP_RES_SEARCH_RESULT
:
754 tevent_req_error(req
, TLDAP_PROTOCOL_ERROR
);
760 /* We've finished one paged search, fire the next */
762 pgctrl
= tldap_msg_findcontrol(state
->result
,
763 TLDAP_CONTROL_PAGEDRESULTS
);
764 if (pgctrl
== NULL
) {
765 /* RFC2696 requires the server to return the control */
766 tevent_req_error(req
, TLDAP_PROTOCOL_ERROR
);
770 TALLOC_FREE(state
->cookie
.data
);
772 asn1
= asn1_init(talloc_tos());
774 tevent_req_error(req
, TLDAP_NO_MEMORY
);
778 asn1_load_nocopy(asn1
, pgctrl
->value
.data
, pgctrl
->value
.length
);
779 asn1_start_tag(asn1
, ASN1_SEQUENCE(0));
780 asn1_read_Integer(asn1
, &size
);
781 asn1_read_OctetString(asn1
, state
, &state
->cookie
);
783 if (asn1
->has_error
) {
784 tevent_req_error(req
, TLDAP_DECODING_ERROR
);
789 if (state
->cookie
.length
== 0) {
790 /* We're done, no cookie anymore */
791 tevent_req_done(req
);
795 TALLOC_FREE(state
->result
);
797 subreq
= tldap_ship_paged_search(state
, state
);
798 if (tevent_req_nomem(subreq
, req
)) {
801 tevent_req_set_callback(subreq
, tldap_search_paged_done
, req
);
804 int tldap_search_paged_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
805 struct tldap_message
**pmsg
)
807 struct tldap_search_paged_state
*state
= tevent_req_data(
808 req
, struct tldap_search_paged_state
);
811 if (!tevent_req_is_in_progress(req
)
812 && tevent_req_is_ldap_error(req
, &err
)) {
815 if (tevent_req_is_in_progress(req
)) {
816 switch (tldap_msg_type(state
->result
)) {
817 case TLDAP_RES_SEARCH_ENTRY
:
818 case TLDAP_RES_SEARCH_REFERENCE
:
821 return TLDAP_PROTOCOL_ERROR
;
824 *pmsg
= talloc_move(mem_ctx
, &state
->result
);
825 return TLDAP_SUCCESS
;