2 Unix SMB/CIFS implementation.
3 Infrastructure for async ldap client requests
4 Copyright (C) Volker Lendecke 2009
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "tldap_util.h"
23 #include "../libcli/security/security.h"
24 #include "../lib/util/asn1.h"
26 bool tldap_entry_values(struct tldap_message
*msg
, const char *attribute
,
27 DATA_BLOB
**values
, int *num_values
)
29 struct tldap_attribute
*attributes
;
30 int i
, num_attributes
;
32 if (!tldap_entry_attributes(msg
, &attributes
, &num_attributes
)) {
36 for (i
=0; i
<num_attributes
; i
++) {
37 if (strequal(attribute
, attributes
[i
].name
)) {
41 if (i
== num_attributes
) {
44 *num_values
= attributes
[i
].num_values
;
45 *values
= attributes
[i
].values
;
49 bool tldap_get_single_valueblob(struct tldap_message
*msg
,
50 const char *attribute
, DATA_BLOB
*blob
)
55 if (attribute
== NULL
) {
58 if (!tldap_entry_values(msg
, attribute
, &values
, &num_values
)) {
61 if (num_values
!= 1) {
68 char *tldap_talloc_single_attribute(struct tldap_message
*msg
,
69 const char *attribute
,
76 if (!tldap_get_single_valueblob(msg
, attribute
, &val
)) {
79 if (!convert_string_talloc(mem_ctx
, CH_UTF8
, CH_UNIX
,
87 bool tldap_pull_binsid(struct tldap_message
*msg
, const char *attribute
,
92 if (!tldap_get_single_valueblob(msg
, attribute
, &val
)) {
95 return sid_parse(val
.data
, val
.length
, sid
);
98 bool tldap_pull_guid(struct tldap_message
*msg
, const char *attribute
,
103 if (!tldap_get_single_valueblob(msg
, attribute
, &val
)) {
106 return NT_STATUS_IS_OK(GUID_from_data_blob(&val
, guid
));
109 static bool tldap_add_blob_vals(TALLOC_CTX
*mem_ctx
, struct tldap_mod
*mod
,
110 DATA_BLOB
*newvals
, int num_newvals
)
112 int num_values
= talloc_array_length(mod
->values
);
116 tmp
= talloc_realloc(mem_ctx
, mod
->values
, DATA_BLOB
,
117 num_values
+ num_newvals
);
123 for (i
=0; i
<num_newvals
; i
++) {
124 mod
->values
[i
+num_values
].data
= (uint8_t *)talloc_memdup(
125 mod
->values
, newvals
[i
].data
, newvals
[i
].length
);
126 if (mod
->values
[i
+num_values
].data
== NULL
) {
129 mod
->values
[i
+num_values
].length
= newvals
[i
].length
;
131 mod
->num_values
= num_values
+ num_newvals
;
135 bool tldap_add_mod_blobs(TALLOC_CTX
*mem_ctx
,
136 struct tldap_mod
**pmods
, int *pnum_mods
,
137 int mod_op
, const char *attrib
,
138 DATA_BLOB
*newvals
, int num_newvals
)
140 struct tldap_mod new_mod
;
141 struct tldap_mod
*mods
= *pmods
;
142 struct tldap_mod
*mod
= NULL
;
146 mods
= talloc_array(mem_ctx
, struct tldap_mod
, 0);
152 num_mods
= *pnum_mods
;
154 for (i
=0; i
<num_mods
; i
++) {
155 if ((mods
[i
].mod_op
== mod_op
)
156 && strequal(mods
[i
].attribute
, attrib
)) {
163 new_mod
.mod_op
= mod_op
;
164 new_mod
.attribute
= talloc_strdup(mods
, attrib
);
165 if (new_mod
.attribute
== NULL
) {
168 new_mod
.num_values
= 0;
169 new_mod
.values
= NULL
;
173 if ((num_newvals
!= 0)
174 && !tldap_add_blob_vals(mods
, mod
, newvals
, num_newvals
)) {
178 if ((i
== num_mods
) && (talloc_array_length(mods
) < num_mods
+ 1)) {
179 mods
= talloc_realloc(talloc_tos(), mods
, struct tldap_mod
,
184 mods
[num_mods
] = *mod
;
192 bool tldap_add_mod_str(TALLOC_CTX
*mem_ctx
,
193 struct tldap_mod
**pmods
, int *pnum_mods
,
194 int mod_op
, const char *attrib
, const char *str
)
199 if (!convert_string_talloc(talloc_tos(), CH_UNIX
, CH_UTF8
, str
,
200 strlen(str
), &utf8
.data
, &utf8
.length
)) {
204 ret
= tldap_add_mod_blobs(mem_ctx
, pmods
, pnum_mods
, mod_op
, attrib
,
206 TALLOC_FREE(utf8
.data
);
210 static bool tldap_make_mod_blob_int(struct tldap_message
*existing
,
212 struct tldap_mod
**pmods
, int *pnum_mods
,
213 const char *attrib
, DATA_BLOB newval
,
214 int (*comparison
)(const DATA_BLOB
*d1
,
215 const DATA_BLOB
*d2
))
218 DATA_BLOB
*values
= NULL
;
219 DATA_BLOB oldval
= data_blob_null
;
221 if ((existing
!= NULL
)
222 && tldap_entry_values(existing
, attrib
, &values
, &num_values
)) {
224 if (num_values
> 1) {
225 /* can't change multivalue attributes atm */
228 if (num_values
== 1) {
233 if ((oldval
.data
!= NULL
) && (newval
.data
!= NULL
)
234 && (comparison(&oldval
, &newval
) == 0)) {
235 /* Believe it or not, but LDAP will deny a delete and
236 an add at the same time if the values are the
238 DEBUG(10,("tldap_make_mod_blob_int: attribute |%s| not "
239 "changed.\n", attrib
));
243 if (oldval
.data
!= NULL
) {
244 /* By deleting exactly the value we found in the entry this
245 * should be race-free in the sense that the LDAP-Server will
246 * deny the complete operation if somebody changed the
247 * attribute behind our back. */
248 /* This will also allow modifying single valued attributes in
249 * Novell NDS. In NDS you have to first remove attribute and
250 * then you could add new value */
252 DEBUG(10, ("tldap_make_mod_blob_int: deleting attribute |%s|\n",
254 if (!tldap_add_mod_blobs(mem_ctx
, pmods
, pnum_mods
,
256 attrib
, &oldval
, 1)) {
261 /* Regardless of the real operation (add or modify)
262 we add the new value here. We rely on deleting
263 the old value, should it exist. */
265 if (newval
.data
!= NULL
) {
266 DEBUG(10, ("tldap_make_mod_blob_int: adding attribute |%s| value len "
267 "%d\n", attrib
, (int)newval
.length
));
268 if (!tldap_add_mod_blobs(mem_ctx
, pmods
, pnum_mods
,
270 attrib
, &newval
, 1)) {
277 bool tldap_make_mod_blob(struct tldap_message
*existing
, TALLOC_CTX
*mem_ctx
,
278 struct tldap_mod
**pmods
, int *pnum_mods
,
279 const char *attrib
, DATA_BLOB newval
)
281 return tldap_make_mod_blob_int(existing
, mem_ctx
, pmods
, pnum_mods
,
282 attrib
, newval
, data_blob_cmp
);
285 static int compare_utf8_blobs(const DATA_BLOB
*d1
, const DATA_BLOB
*d2
)
291 if (!convert_string_talloc(talloc_tos(), CH_UTF8
, CH_UNIX
, d1
->data
,
292 d1
->length
, &s1
, &s1len
)) {
293 /* can't do much here */
296 if (!convert_string_talloc(talloc_tos(), CH_UTF8
, CH_UNIX
, d2
->data
,
297 d2
->length
, &s2
, &s2len
)) {
298 /* can't do much here */
302 ret
= strcasecmp_m(s1
, s2
);
308 bool tldap_make_mod_fmt(struct tldap_message
*existing
, TALLOC_CTX
*mem_ctx
,
309 struct tldap_mod
**pmods
, int *pnum_mods
,
310 const char *attrib
, const char *fmt
, ...)
315 DATA_BLOB blob
= data_blob_null
;
318 newval
= talloc_vasprintf(talloc_tos(), fmt
, ap
);
321 if (newval
== NULL
) {
325 blob
.length
= strlen(newval
);
326 if (blob
.length
!= 0) {
327 blob
.data
= discard_const_p(uint8_t, newval
);
329 ret
= tldap_make_mod_blob_int(existing
, mem_ctx
, pmods
, pnum_mods
,
330 attrib
, blob
, compare_utf8_blobs
);
335 const char *tldap_errstr(TALLOC_CTX
*mem_ctx
, struct tldap_context
*ld
,
338 const char *ld_error
= NULL
;
342 ld_error
= tldap_msg_diagnosticmessage(tldap_ctx_lastmsg(ld
));
344 res
= talloc_asprintf(mem_ctx
, "LDAP error %d (%s), %s",
345 (int)TLDAP_RC_V(rc
), tldap_rc2string(rc
),
346 ld_error
? ld_error
: "unknown");
350 TLDAPRC
tldap_search_va(struct tldap_context
*ld
, const char *base
, int scope
,
351 const char *attrs
[], int num_attrs
, int attrsonly
,
352 TALLOC_CTX
*mem_ctx
, struct tldap_message
***res
,
353 const char *fmt
, va_list ap
)
358 filter
= talloc_vasprintf(talloc_tos(), fmt
, ap
);
359 if (filter
== NULL
) {
360 return TLDAP_NO_MEMORY
;
363 rc
= tldap_search(ld
, base
, scope
, filter
,
364 attrs
, num_attrs
, attrsonly
,
365 NULL
/*sctrls*/, 0, NULL
/*cctrls*/, 0,
366 0 /*timelimit*/, 0 /*sizelimit*/, 0 /*deref*/,
372 TLDAPRC
tldap_search_fmt(struct tldap_context
*ld
, const char *base
, int scope
,
373 const char *attrs
[], int num_attrs
, int attrsonly
,
374 TALLOC_CTX
*mem_ctx
, struct tldap_message
***res
,
375 const char *fmt
, ...)
381 rc
= tldap_search_va(ld
, base
, scope
, attrs
, num_attrs
, attrsonly
,
382 mem_ctx
, res
, fmt
, ap
);
387 bool tldap_pull_uint64(struct tldap_message
*msg
, const char *attr
,
393 str
= tldap_talloc_single_attribute(msg
, attr
, talloc_tos());
395 DEBUG(10, ("Could not find attribute %s\n", attr
));
398 result
= strtoull(str
, NULL
, 10);
404 bool tldap_pull_uint32(struct tldap_message
*msg
, const char *attr
,
409 if (!tldap_pull_uint64(msg
, attr
, &result
)) {
412 *presult
= (uint32_t)result
;
416 struct tldap_fetch_rootdse_state
{
417 struct tldap_context
*ld
;
418 struct tldap_message
*rootdse
;
421 static void tldap_fetch_rootdse_done(struct tevent_req
*subreq
);
423 struct tevent_req
*tldap_fetch_rootdse_send(TALLOC_CTX
*mem_ctx
,
424 struct tevent_context
*ev
,
425 struct tldap_context
*ld
)
427 struct tevent_req
*req
, *subreq
;
428 struct tldap_fetch_rootdse_state
*state
;
429 static const char *attrs
[2] = { "*", "+" };
431 req
= tevent_req_create(mem_ctx
, &state
,
432 struct tldap_fetch_rootdse_state
);
437 state
->rootdse
= NULL
;
439 subreq
= tldap_search_send(
440 mem_ctx
, ev
, ld
, "", TLDAP_SCOPE_BASE
, "(objectclass=*)",
441 attrs
, ARRAY_SIZE(attrs
), 0, NULL
, 0, NULL
, 0, 0, 0, 0);
442 if (tevent_req_nomem(subreq
, req
)) {
443 return tevent_req_post(req
, ev
);
445 tevent_req_set_callback(subreq
, tldap_fetch_rootdse_done
, req
);
449 static void tldap_fetch_rootdse_done(struct tevent_req
*subreq
)
451 struct tevent_req
*req
= tevent_req_callback_data(
452 subreq
, struct tevent_req
);
453 struct tldap_fetch_rootdse_state
*state
= tevent_req_data(
454 req
, struct tldap_fetch_rootdse_state
);
455 struct tldap_message
*msg
;
458 rc
= tldap_search_recv(subreq
, state
, &msg
);
459 if (tevent_req_ldap_error(req
, rc
)) {
463 switch (tldap_msg_type(msg
)) {
464 case TLDAP_RES_SEARCH_ENTRY
:
465 if (state
->rootdse
!= NULL
) {
468 state
->rootdse
= msg
;
470 case TLDAP_RES_SEARCH_RESULT
:
472 if (state
->rootdse
== NULL
) {
475 tevent_req_done(req
);
483 tevent_req_ldap_error(req
, TLDAP_PROTOCOL_ERROR
);
487 TLDAPRC
tldap_fetch_rootdse_recv(struct tevent_req
*req
)
489 struct tldap_fetch_rootdse_state
*state
= tevent_req_data(
490 req
, struct tldap_fetch_rootdse_state
);
494 if (tevent_req_is_ldap_error(req
, &rc
)) {
497 /* Trigger parsing the dn, just to make sure it's ok */
498 if (!tldap_entry_dn(state
->rootdse
, &dn
)) {
499 return TLDAP_DECODING_ERROR
;
501 if (!tldap_context_setattr(state
->ld
, "tldap:rootdse",
503 return TLDAP_NO_MEMORY
;
505 return TLDAP_SUCCESS
;
508 TLDAPRC
tldap_fetch_rootdse(struct tldap_context
*ld
)
510 TALLOC_CTX
*frame
= talloc_stackframe();
511 struct tevent_context
*ev
;
512 struct tevent_req
*req
;
513 TLDAPRC rc
= TLDAP_NO_MEMORY
;
515 ev
= samba_tevent_context_init(frame
);
519 req
= tldap_fetch_rootdse_send(frame
, ev
, ld
);
523 if (!tevent_req_poll(req
, ev
)) {
524 rc
= TLDAP_OPERATIONS_ERROR
;
528 rc
= tldap_fetch_rootdse_recv(req
);
534 struct tldap_message
*tldap_rootdse(struct tldap_context
*ld
)
536 return talloc_get_type(tldap_context_getattr(ld
, "tldap:rootdse"),
537 struct tldap_message
);
540 bool tldap_entry_has_attrvalue(struct tldap_message
*msg
,
541 const char *attribute
,
542 const DATA_BLOB blob
)
547 if (!tldap_entry_values(msg
, attribute
, &values
, &num_values
)) {
550 for (i
=0; i
<num_values
; i
++) {
551 if (data_blob_cmp(&values
[i
], &blob
) == 0) {
558 bool tldap_supports_control(struct tldap_context
*ld
, const char *oid
)
560 struct tldap_message
*rootdse
= tldap_rootdse(ld
);
562 if (rootdse
== NULL
) {
565 return tldap_entry_has_attrvalue(rootdse
, "supportedControl",
566 data_blob_const(oid
, strlen(oid
)));
569 struct tldap_control
*tldap_add_control(TALLOC_CTX
*mem_ctx
,
570 struct tldap_control
*ctrls
,
572 struct tldap_control
*ctrl
)
574 struct tldap_control
*result
;
576 result
= talloc_array(mem_ctx
, struct tldap_control
, num_ctrls
+1);
577 if (result
== NULL
) {
580 memcpy(result
, ctrls
, sizeof(struct tldap_control
) * num_ctrls
);
581 result
[num_ctrls
] = *ctrl
;
586 * Find a control returned by the server
588 struct tldap_control
*tldap_msg_findcontrol(struct tldap_message
*msg
,
591 struct tldap_control
*controls
;
594 tldap_msg_sctrls(msg
, &num_controls
, &controls
);
596 for (i
=0; i
<num_controls
; i
++) {
597 if (strcmp(controls
[i
].oid
, oid
) == 0) {
604 struct tldap_search_paged_state
{
605 struct tevent_context
*ev
;
606 struct tldap_context
*ld
;
613 struct tldap_control
*sctrls
;
615 struct tldap_control
*cctrls
;
622 struct asn1_data
*asn1
;
624 struct tldap_message
*result
;
627 static struct tevent_req
*tldap_ship_paged_search(
629 struct tldap_search_paged_state
*state
)
631 struct tldap_control
*pgctrl
;
632 struct asn1_data
*asn1
= NULL
;
634 asn1
= asn1_init(state
);
638 if (!asn1_push_tag(asn1
, ASN1_SEQUENCE(0))) goto err
;
639 if (!asn1_write_Integer(asn1
, state
->page_size
)) goto err
;
640 if (!asn1_write_OctetString(asn1
, state
->cookie
.data
, state
->cookie
.length
)) goto err
;
641 if (!asn1_pop_tag(asn1
)) goto err
;
644 pgctrl
= &state
->sctrls
[state
->num_sctrls
-1];
645 pgctrl
->oid
= TLDAP_CONTROL_PAGEDRESULTS
;
646 pgctrl
->critical
= true;
647 if (!asn1_blob(state
->asn1
, &pgctrl
->value
)) {
650 return tldap_search_send(mem_ctx
, state
->ev
, state
->ld
, state
->base
,
651 state
->scope
, state
->filter
, state
->attrs
,
652 state
->num_attrs
, state
->attrsonly
,
653 state
->sctrls
, state
->num_sctrls
,
654 state
->cctrls
, state
->num_cctrls
,
655 state
->timelimit
, state
->sizelimit
,
664 static void tldap_search_paged_done(struct tevent_req
*subreq
);
666 struct tevent_req
*tldap_search_paged_send(TALLOC_CTX
*mem_ctx
,
667 struct tevent_context
*ev
,
668 struct tldap_context
*ld
,
669 const char *base
, int scope
,
674 struct tldap_control
*sctrls
,
676 struct tldap_control
*cctrls
,
683 struct tevent_req
*req
, *subreq
;
684 struct tldap_search_paged_state
*state
;
685 struct tldap_control empty_control
;
687 req
= tevent_req_create(mem_ctx
, &state
,
688 struct tldap_search_paged_state
);
695 state
->filter
= filter
;
696 state
->scope
= scope
;
697 state
->attrs
= attrs
;
698 state
->num_attrs
= num_attrs
;
699 state
->attrsonly
= attrsonly
;
700 state
->cctrls
= cctrls
;
701 state
->num_cctrls
= num_cctrls
;
702 state
->timelimit
= timelimit
;
703 state
->sizelimit
= sizelimit
;
704 state
->deref
= deref
;
706 state
->page_size
= page_size
;
708 state
->cookie
= data_blob_null
;
710 ZERO_STRUCT(empty_control
);
712 state
->sctrls
= tldap_add_control(state
, sctrls
, num_sctrls
,
714 if (tevent_req_nomem(state
->sctrls
, req
)) {
715 return tevent_req_post(req
, ev
);
717 state
->num_sctrls
= num_sctrls
+1;
719 subreq
= tldap_ship_paged_search(state
, state
);
720 if (tevent_req_nomem(subreq
, req
)) {
721 return tevent_req_post(req
, ev
);
723 tevent_req_set_callback(subreq
, tldap_search_paged_done
, req
);
728 static void tldap_search_paged_done(struct tevent_req
*subreq
)
730 struct tevent_req
*req
= tevent_req_callback_data(
731 subreq
, struct tevent_req
);
732 struct tldap_search_paged_state
*state
= tevent_req_data(
733 req
, struct tldap_search_paged_state
);
734 struct asn1_data
*asn1
= NULL
;
735 struct tldap_control
*pgctrl
;
739 rc
= tldap_search_recv(subreq
, state
, &state
->result
);
740 if (tevent_req_ldap_error(req
, rc
)) {
744 TALLOC_FREE(state
->asn1
);
746 switch (tldap_msg_type(state
->result
)) {
747 case TLDAP_RES_SEARCH_ENTRY
:
748 case TLDAP_RES_SEARCH_REFERENCE
:
749 tevent_req_notify_callback(req
);
751 case TLDAP_RES_SEARCH_RESULT
:
755 tevent_req_ldap_error(req
, TLDAP_PROTOCOL_ERROR
);
761 /* We've finished one paged search, fire the next */
763 pgctrl
= tldap_msg_findcontrol(state
->result
,
764 TLDAP_CONTROL_PAGEDRESULTS
);
765 if (pgctrl
== NULL
) {
766 /* RFC2696 requires the server to return the control */
767 tevent_req_ldap_error(req
, TLDAP_PROTOCOL_ERROR
);
771 TALLOC_FREE(state
->cookie
.data
);
773 asn1
= asn1_init(talloc_tos());
774 if (tevent_req_nomem(asn1
, req
)) {
778 asn1_load_nocopy(asn1
, pgctrl
->value
.data
, pgctrl
->value
.length
);
779 if (!asn1_start_tag(asn1
, ASN1_SEQUENCE(0))) goto err
;
780 if (!asn1_read_Integer(asn1
, &size
)) goto err
;
781 if (!asn1_read_OctetString(asn1
, state
, &state
->cookie
)) goto err
;
782 if (!asn1_end_tag(asn1
)) goto err
;
786 if (state
->cookie
.length
== 0) {
787 /* We're done, no cookie anymore */
788 tevent_req_done(req
);
792 TALLOC_FREE(state
->result
);
794 subreq
= tldap_ship_paged_search(state
, state
);
795 if (tevent_req_nomem(subreq
, req
)) {
798 tevent_req_set_callback(subreq
, tldap_search_paged_done
, req
);
803 tevent_req_ldap_error(req
, TLDAP_DECODING_ERROR
);
806 TLDAPRC
tldap_search_paged_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
807 struct tldap_message
**pmsg
)
809 struct tldap_search_paged_state
*state
= tevent_req_data(
810 req
, struct tldap_search_paged_state
);
813 if (!tevent_req_is_in_progress(req
)
814 && tevent_req_is_ldap_error(req
, &rc
)) {
817 if (tevent_req_is_in_progress(req
)) {
818 switch (tldap_msg_type(state
->result
)) {
819 case TLDAP_RES_SEARCH_ENTRY
:
820 case TLDAP_RES_SEARCH_REFERENCE
:
823 return TLDAP_PROTOCOL_ERROR
;
826 *pmsg
= talloc_move(mem_ctx
, &state
->result
);
827 return TLDAP_SUCCESS
;