2 Unix SMB/CIFS implementation.
3 Infrastructure for async ldap client requests
4 Copyright (C) Volker Lendecke 2009
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "tldap_util.h"
23 #include "../libcli/security/security.h"
24 #include "../lib/util/asn1.h"
26 bool tldap_entry_values(struct tldap_message
*msg
, const char *attribute
,
27 DATA_BLOB
**values
, int *num_values
)
29 struct tldap_attribute
*attributes
;
30 int i
, num_attributes
;
32 if (!tldap_entry_attributes(msg
, &attributes
, &num_attributes
)) {
36 for (i
=0; i
<num_attributes
; i
++) {
37 if (strequal(attribute
, attributes
[i
].name
)) {
41 if (i
== num_attributes
) {
44 *num_values
= attributes
[i
].num_values
;
45 *values
= attributes
[i
].values
;
49 bool tldap_get_single_valueblob(struct tldap_message
*msg
,
50 const char *attribute
, DATA_BLOB
*blob
)
55 if (attribute
== NULL
) {
58 if (!tldap_entry_values(msg
, attribute
, &values
, &num_values
)) {
61 if (num_values
!= 1) {
68 char *tldap_talloc_single_attribute(struct tldap_message
*msg
,
69 const char *attribute
,
76 if (!tldap_get_single_valueblob(msg
, attribute
, &val
)) {
79 if (!convert_string_talloc(mem_ctx
, CH_UTF8
, CH_UNIX
,
87 bool tldap_pull_binsid(struct tldap_message
*msg
, const char *attribute
,
93 if (!tldap_get_single_valueblob(msg
, attribute
, &val
)) {
96 ret
= sid_parse(val
.data
, val
.length
, sid
);
100 bool tldap_pull_guid(struct tldap_message
*msg
, const char *attribute
,
105 if (!tldap_get_single_valueblob(msg
, attribute
, &val
)) {
108 return NT_STATUS_IS_OK(GUID_from_data_blob(&val
, guid
));
111 static bool tldap_add_blob_vals(TALLOC_CTX
*mem_ctx
, struct tldap_mod
*mod
,
112 DATA_BLOB
*newvals
, int num_newvals
)
114 int num_values
= talloc_array_length(mod
->values
);
118 tmp
= talloc_realloc(mem_ctx
, mod
->values
, DATA_BLOB
,
119 num_values
+ num_newvals
);
125 for (i
=0; i
<num_newvals
; i
++) {
126 mod
->values
[i
+num_values
].data
= (uint8_t *)talloc_memdup(
127 mod
->values
, newvals
[i
].data
, newvals
[i
].length
);
128 if (mod
->values
[i
+num_values
].data
== NULL
) {
131 mod
->values
[i
+num_values
].length
= newvals
[i
].length
;
133 mod
->num_values
= num_values
+ num_newvals
;
137 bool tldap_add_mod_blobs(TALLOC_CTX
*mem_ctx
,
138 struct tldap_mod
**pmods
, int *pnum_mods
,
139 int mod_op
, const char *attrib
,
140 DATA_BLOB
*newvals
, int num_newvals
)
142 struct tldap_mod new_mod
;
143 struct tldap_mod
*mods
= *pmods
;
144 struct tldap_mod
*mod
= NULL
;
148 mods
= talloc_array(mem_ctx
, struct tldap_mod
, 0);
154 num_mods
= *pnum_mods
;
156 for (i
=0; i
<num_mods
; i
++) {
157 if ((mods
[i
].mod_op
== mod_op
)
158 && strequal(mods
[i
].attribute
, attrib
)) {
165 new_mod
.mod_op
= mod_op
;
166 new_mod
.attribute
= talloc_strdup(mods
, attrib
);
167 if (new_mod
.attribute
== NULL
) {
170 new_mod
.num_values
= 0;
171 new_mod
.values
= NULL
;
175 if ((num_newvals
!= 0)
176 && !tldap_add_blob_vals(mods
, mod
, newvals
, num_newvals
)) {
180 if ((i
== num_mods
) && (talloc_array_length(mods
) < num_mods
+ 1)) {
181 mods
= talloc_realloc(talloc_tos(), mods
, struct tldap_mod
,
186 mods
[num_mods
] = *mod
;
194 bool tldap_add_mod_str(TALLOC_CTX
*mem_ctx
,
195 struct tldap_mod
**pmods
, int *pnum_mods
,
196 int mod_op
, const char *attrib
, const char *str
)
201 if (!convert_string_talloc(talloc_tos(), CH_UNIX
, CH_UTF8
, str
,
202 strlen(str
), &utf8
.data
, &utf8
.length
)) {
206 ret
= tldap_add_mod_blobs(mem_ctx
, pmods
, pnum_mods
, mod_op
, attrib
,
208 TALLOC_FREE(utf8
.data
);
212 static bool tldap_make_mod_blob_int(struct tldap_message
*existing
,
214 struct tldap_mod
**pmods
, int *pnum_mods
,
215 const char *attrib
, DATA_BLOB newval
,
216 int (*comparison
)(const DATA_BLOB
*d1
,
217 const DATA_BLOB
*d2
))
220 DATA_BLOB
*values
= NULL
;
221 DATA_BLOB oldval
= data_blob_null
;
223 if ((existing
!= NULL
)
224 && tldap_entry_values(existing
, attrib
, &values
, &num_values
)) {
226 if (num_values
> 1) {
227 /* can't change multivalue attributes atm */
230 if (num_values
== 1) {
235 if ((oldval
.data
!= NULL
) && (newval
.data
!= NULL
)
236 && (comparison(&oldval
, &newval
) == 0)) {
237 /* Believe it or not, but LDAP will deny a delete and
238 an add at the same time if the values are the
240 DEBUG(10,("tldap_make_mod_blob_int: attribute |%s| not "
241 "changed.\n", attrib
));
245 if (oldval
.data
!= NULL
) {
246 /* By deleting exactly the value we found in the entry this
247 * should be race-free in the sense that the LDAP-Server will
248 * deny the complete operation if somebody changed the
249 * attribute behind our back. */
250 /* This will also allow modifying single valued attributes in
251 * Novell NDS. In NDS you have to first remove attribute and
252 * then you could add new value */
254 DEBUG(10, ("tldap_make_mod_blob_int: deleting attribute |%s|\n",
256 if (!tldap_add_mod_blobs(mem_ctx
, pmods
, pnum_mods
,
258 attrib
, &oldval
, 1)) {
263 /* Regardless of the real operation (add or modify)
264 we add the new value here. We rely on deleting
265 the old value, should it exist. */
267 if (newval
.data
!= NULL
) {
268 DEBUG(10, ("tldap_make_mod_blob_int: adding attribute |%s| value len "
269 "%d\n", attrib
, (int)newval
.length
));
270 if (!tldap_add_mod_blobs(mem_ctx
, pmods
, pnum_mods
,
272 attrib
, &newval
, 1)) {
279 bool tldap_make_mod_blob(struct tldap_message
*existing
, TALLOC_CTX
*mem_ctx
,
280 struct tldap_mod
**pmods
, int *pnum_mods
,
281 const char *attrib
, DATA_BLOB newval
)
283 return tldap_make_mod_blob_int(existing
, mem_ctx
, pmods
, pnum_mods
,
284 attrib
, newval
, data_blob_cmp
);
287 static int compare_utf8_blobs(const DATA_BLOB
*d1
, const DATA_BLOB
*d2
)
293 if (!convert_string_talloc(talloc_tos(), CH_UTF8
, CH_UNIX
, d1
->data
,
294 d1
->length
, &s1
, &s1len
)) {
295 /* can't do much here */
298 if (!convert_string_talloc(talloc_tos(), CH_UTF8
, CH_UNIX
, d2
->data
,
299 d2
->length
, &s2
, &s2len
)) {
300 /* can't do much here */
304 ret
= strcasecmp_m(s1
, s2
);
310 bool tldap_make_mod_fmt(struct tldap_message
*existing
, TALLOC_CTX
*mem_ctx
,
311 struct tldap_mod
**pmods
, int *pnum_mods
,
312 const char *attrib
, const char *fmt
, ...)
317 DATA_BLOB blob
= data_blob_null
;
320 newval
= talloc_vasprintf(talloc_tos(), fmt
, ap
);
323 if (newval
== NULL
) {
327 blob
.length
= strlen(newval
);
328 if (blob
.length
!= 0) {
329 blob
.data
= discard_const_p(uint8_t, newval
);
331 ret
= tldap_make_mod_blob_int(existing
, mem_ctx
, pmods
, pnum_mods
,
332 attrib
, blob
, compare_utf8_blobs
);
337 const char *tldap_errstr(TALLOC_CTX
*mem_ctx
, struct tldap_context
*ld
,
340 const char *ld_error
= NULL
;
344 ld_error
= tldap_msg_diagnosticmessage(tldap_ctx_lastmsg(ld
));
346 res
= talloc_asprintf(mem_ctx
, "LDAP error %d (%s), %s",
347 (int)TLDAP_RC_V(rc
), tldap_rc2string(rc
),
348 ld_error
? ld_error
: "unknown");
352 TLDAPRC
tldap_search_va(struct tldap_context
*ld
, const char *base
, int scope
,
353 const char *attrs
[], int num_attrs
, int attrsonly
,
354 TALLOC_CTX
*mem_ctx
, struct tldap_message
***res
,
355 const char *fmt
, va_list ap
)
360 filter
= talloc_vasprintf(talloc_tos(), fmt
, ap
);
361 if (filter
== NULL
) {
362 return TLDAP_NO_MEMORY
;
365 rc
= tldap_search(ld
, base
, scope
, filter
,
366 attrs
, num_attrs
, attrsonly
,
367 NULL
/*sctrls*/, 0, NULL
/*cctrls*/, 0,
368 0 /*timelimit*/, 0 /*sizelimit*/, 0 /*deref*/,
374 TLDAPRC
tldap_search_fmt(struct tldap_context
*ld
, const char *base
, int scope
,
375 const char *attrs
[], int num_attrs
, int attrsonly
,
376 TALLOC_CTX
*mem_ctx
, struct tldap_message
***res
,
377 const char *fmt
, ...)
383 rc
= tldap_search_va(ld
, base
, scope
, attrs
, num_attrs
, attrsonly
,
384 mem_ctx
, res
, fmt
, ap
);
389 bool tldap_pull_uint64(struct tldap_message
*msg
, const char *attr
,
396 str
= tldap_talloc_single_attribute(msg
, attr
, talloc_tos());
398 DEBUG(10, ("Could not find attribute %s\n", attr
));
402 result
= smb_strtoull(str
, NULL
, 10, &error
, SMB_STR_STANDARD
);
404 DBG_DEBUG("Attribute conversion failed (%s)\n",
415 bool tldap_pull_uint32(struct tldap_message
*msg
, const char *attr
,
420 if (!tldap_pull_uint64(msg
, attr
, &result
)) {
423 *presult
= (uint32_t)result
;
427 struct tldap_fetch_rootdse_state
{
428 struct tldap_context
*ld
;
429 struct tldap_message
*rootdse
;
432 static void tldap_fetch_rootdse_done(struct tevent_req
*subreq
);
434 struct tevent_req
*tldap_fetch_rootdse_send(TALLOC_CTX
*mem_ctx
,
435 struct tevent_context
*ev
,
436 struct tldap_context
*ld
)
438 struct tevent_req
*req
, *subreq
;
439 struct tldap_fetch_rootdse_state
*state
;
440 static const char *attrs
[2] = { "*", "+" };
442 req
= tevent_req_create(mem_ctx
, &state
,
443 struct tldap_fetch_rootdse_state
);
448 state
->rootdse
= NULL
;
450 subreq
= tldap_search_send(
451 mem_ctx
, ev
, ld
, "", TLDAP_SCOPE_BASE
, "(objectclass=*)",
452 attrs
, ARRAY_SIZE(attrs
), 0, NULL
, 0, NULL
, 0, 0, 0, 0);
453 if (tevent_req_nomem(subreq
, req
)) {
454 return tevent_req_post(req
, ev
);
456 tevent_req_set_callback(subreq
, tldap_fetch_rootdse_done
, req
);
460 static void tldap_fetch_rootdse_done(struct tevent_req
*subreq
)
462 struct tevent_req
*req
= tevent_req_callback_data(
463 subreq
, struct tevent_req
);
464 struct tldap_fetch_rootdse_state
*state
= tevent_req_data(
465 req
, struct tldap_fetch_rootdse_state
);
466 struct tldap_message
*msg
;
469 rc
= tldap_search_recv(subreq
, state
, &msg
);
470 if (tevent_req_ldap_error(req
, rc
)) {
474 switch (tldap_msg_type(msg
)) {
475 case TLDAP_RES_SEARCH_ENTRY
:
476 if (state
->rootdse
!= NULL
) {
479 state
->rootdse
= msg
;
481 case TLDAP_RES_SEARCH_RESULT
:
483 if (state
->rootdse
== NULL
) {
486 tevent_req_done(req
);
494 tevent_req_ldap_error(req
, TLDAP_PROTOCOL_ERROR
);
498 TLDAPRC
tldap_fetch_rootdse_recv(struct tevent_req
*req
)
500 struct tldap_fetch_rootdse_state
*state
= tevent_req_data(
501 req
, struct tldap_fetch_rootdse_state
);
505 if (tevent_req_is_ldap_error(req
, &rc
)) {
508 /* Trigger parsing the dn, just to make sure it's ok */
509 if (!tldap_entry_dn(state
->rootdse
, &dn
)) {
510 return TLDAP_DECODING_ERROR
;
512 if (!tldap_context_setattr(state
->ld
, "tldap:rootdse",
514 return TLDAP_NO_MEMORY
;
516 return TLDAP_SUCCESS
;
519 TLDAPRC
tldap_fetch_rootdse(struct tldap_context
*ld
)
521 TALLOC_CTX
*frame
= talloc_stackframe();
522 struct tevent_context
*ev
;
523 struct tevent_req
*req
;
524 TLDAPRC rc
= TLDAP_NO_MEMORY
;
526 ev
= samba_tevent_context_init(frame
);
530 req
= tldap_fetch_rootdse_send(frame
, ev
, ld
);
534 if (!tevent_req_poll(req
, ev
)) {
535 rc
= TLDAP_OPERATIONS_ERROR
;
539 rc
= tldap_fetch_rootdse_recv(req
);
545 struct tldap_message
*tldap_rootdse(struct tldap_context
*ld
)
547 return talloc_get_type(tldap_context_getattr(ld
, "tldap:rootdse"),
548 struct tldap_message
);
551 bool tldap_entry_has_attrvalue(struct tldap_message
*msg
,
552 const char *attribute
,
553 const DATA_BLOB blob
)
558 if (!tldap_entry_values(msg
, attribute
, &values
, &num_values
)) {
561 for (i
=0; i
<num_values
; i
++) {
562 if (data_blob_cmp(&values
[i
], &blob
) == 0) {
569 bool tldap_supports_control(struct tldap_context
*ld
, const char *oid
)
571 struct tldap_message
*rootdse
= tldap_rootdse(ld
);
573 if (rootdse
== NULL
) {
576 return tldap_entry_has_attrvalue(rootdse
, "supportedControl",
577 data_blob_const(oid
, strlen(oid
)));
580 struct tldap_control
*tldap_add_control(TALLOC_CTX
*mem_ctx
,
581 struct tldap_control
*ctrls
,
583 struct tldap_control
*ctrl
)
585 struct tldap_control
*result
;
587 result
= talloc_array(mem_ctx
, struct tldap_control
, num_ctrls
+1);
588 if (result
== NULL
) {
592 memcpy(result
, ctrls
, sizeof(struct tldap_control
) * num_ctrls
);
594 result
[num_ctrls
] = *ctrl
;
599 * Find a control returned by the server
601 struct tldap_control
*tldap_msg_findcontrol(struct tldap_message
*msg
,
604 struct tldap_control
*controls
;
607 tldap_msg_sctrls(msg
, &num_controls
, &controls
);
609 for (i
=0; i
<num_controls
; i
++) {
610 if (strcmp(controls
[i
].oid
, oid
) == 0) {
617 struct tldap_search_paged_state
{
618 struct tevent_context
*ev
;
619 struct tldap_context
*ld
;
626 struct tldap_control
*sctrls
;
628 struct tldap_control
*cctrls
;
635 struct asn1_data
*asn1
;
637 struct tldap_message
*result
;
640 static struct tevent_req
*tldap_ship_paged_search(
642 struct tldap_search_paged_state
*state
)
644 struct tldap_control
*pgctrl
;
645 struct asn1_data
*asn1
= NULL
;
647 asn1
= asn1_init(state
, ASN1_MAX_TREE_DEPTH
);
651 if (!asn1_push_tag(asn1
, ASN1_SEQUENCE(0))) goto err
;
652 if (!asn1_write_Integer(asn1
, state
->page_size
)) goto err
;
653 if (!asn1_write_OctetString(asn1
, state
->cookie
.data
, state
->cookie
.length
)) goto err
;
654 if (!asn1_pop_tag(asn1
)) goto err
;
657 pgctrl
= &state
->sctrls
[state
->num_sctrls
-1];
658 pgctrl
->oid
= TLDAP_CONTROL_PAGEDRESULTS
;
659 pgctrl
->critical
= true;
660 if (!asn1_blob(state
->asn1
, &pgctrl
->value
)) {
663 return tldap_search_send(mem_ctx
, state
->ev
, state
->ld
, state
->base
,
664 state
->scope
, state
->filter
, state
->attrs
,
665 state
->num_attrs
, state
->attrsonly
,
666 state
->sctrls
, state
->num_sctrls
,
667 state
->cctrls
, state
->num_cctrls
,
668 state
->timelimit
, state
->sizelimit
,
677 static void tldap_search_paged_done(struct tevent_req
*subreq
);
679 struct tevent_req
*tldap_search_paged_send(TALLOC_CTX
*mem_ctx
,
680 struct tevent_context
*ev
,
681 struct tldap_context
*ld
,
682 const char *base
, int scope
,
687 struct tldap_control
*sctrls
,
689 struct tldap_control
*cctrls
,
696 struct tevent_req
*req
, *subreq
;
697 struct tldap_search_paged_state
*state
;
698 struct tldap_control empty_control
;
700 req
= tevent_req_create(mem_ctx
, &state
,
701 struct tldap_search_paged_state
);
708 state
->filter
= filter
;
709 state
->scope
= scope
;
710 state
->attrs
= attrs
;
711 state
->num_attrs
= num_attrs
;
712 state
->attrsonly
= attrsonly
;
713 state
->cctrls
= cctrls
;
714 state
->num_cctrls
= num_cctrls
;
715 state
->timelimit
= timelimit
;
716 state
->sizelimit
= sizelimit
;
717 state
->deref
= deref
;
719 state
->page_size
= page_size
;
721 state
->cookie
= data_blob_null
;
723 ZERO_STRUCT(empty_control
);
725 state
->sctrls
= tldap_add_control(state
, sctrls
, num_sctrls
,
727 if (tevent_req_nomem(state
->sctrls
, req
)) {
728 return tevent_req_post(req
, ev
);
730 state
->num_sctrls
= num_sctrls
+1;
732 subreq
= tldap_ship_paged_search(state
, state
);
733 if (tevent_req_nomem(subreq
, req
)) {
734 return tevent_req_post(req
, ev
);
736 tevent_req_set_callback(subreq
, tldap_search_paged_done
, req
);
741 static void tldap_search_paged_done(struct tevent_req
*subreq
)
743 struct tevent_req
*req
= tevent_req_callback_data(
744 subreq
, struct tevent_req
);
745 struct tldap_search_paged_state
*state
= tevent_req_data(
746 req
, struct tldap_search_paged_state
);
747 struct asn1_data
*asn1
= NULL
;
748 struct tldap_control
*pgctrl
;
752 rc
= tldap_search_recv(subreq
, state
, &state
->result
);
753 if (tevent_req_ldap_error(req
, rc
)) {
757 TALLOC_FREE(state
->asn1
);
759 switch (tldap_msg_type(state
->result
)) {
760 case TLDAP_RES_SEARCH_ENTRY
:
761 case TLDAP_RES_SEARCH_REFERENCE
:
762 tevent_req_notify_callback(req
);
764 case TLDAP_RES_SEARCH_RESULT
:
768 tevent_req_ldap_error(req
, TLDAP_PROTOCOL_ERROR
);
774 /* We've finished one paged search, fire the next */
776 pgctrl
= tldap_msg_findcontrol(state
->result
,
777 TLDAP_CONTROL_PAGEDRESULTS
);
778 if (pgctrl
== NULL
) {
779 /* RFC2696 requires the server to return the control */
780 tevent_req_ldap_error(req
, TLDAP_PROTOCOL_ERROR
);
784 TALLOC_FREE(state
->cookie
.data
);
786 asn1
= asn1_init(talloc_tos(), ASN1_MAX_TREE_DEPTH
);
787 if (tevent_req_nomem(asn1
, req
)) {
791 asn1_load_nocopy(asn1
, pgctrl
->value
.data
, pgctrl
->value
.length
);
792 if (!asn1_start_tag(asn1
, ASN1_SEQUENCE(0))) goto err
;
793 if (!asn1_read_Integer(asn1
, &size
)) goto err
;
794 if (!asn1_read_OctetString(asn1
, state
, &state
->cookie
)) goto err
;
795 if (!asn1_end_tag(asn1
)) goto err
;
799 if (state
->cookie
.length
== 0) {
800 /* We're done, no cookie anymore */
801 tevent_req_done(req
);
805 TALLOC_FREE(state
->result
);
807 subreq
= tldap_ship_paged_search(state
, state
);
808 if (tevent_req_nomem(subreq
, req
)) {
811 tevent_req_set_callback(subreq
, tldap_search_paged_done
, req
);
817 tevent_req_ldap_error(req
, TLDAP_DECODING_ERROR
);
820 TLDAPRC
tldap_search_paged_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
821 struct tldap_message
**pmsg
)
823 struct tldap_search_paged_state
*state
= tevent_req_data(
824 req
, struct tldap_search_paged_state
);
827 if (!tevent_req_is_in_progress(req
)
828 && tevent_req_is_ldap_error(req
, &rc
)) {
831 if (tevent_req_is_in_progress(req
)) {
832 switch (tldap_msg_type(state
->result
)) {
833 case TLDAP_RES_SEARCH_ENTRY
:
834 case TLDAP_RES_SEARCH_REFERENCE
:
837 return TLDAP_PROTOCOL_ERROR
;
840 *pmsg
= talloc_move(mem_ctx
, &state
->result
);
841 return TLDAP_SUCCESS
;