2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Tridgell 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "libcli/ldap/ldap.h"
25 #include "lib/messaging/irpc.h"
26 #include "smbd/service_task.h"
27 #include "smbd/service.h"
28 #include "cldap_server/cldap_server.h"
29 #include "system/network.h"
30 #include "lib/socket/netif.h"
31 #include "lib/ldb/include/ldb.h"
32 #include "lib/ldb/include/ldb_errors.h"
33 #include "dsdb/samdb/samdb.h"
35 #include "auth/auth.h"
36 #include "param/param.h"
37 #include "../lib/tsocket/tsocket.h"
40 handle incoming cldap requests
42 static void cldapd_request_handler(struct cldap_socket
*cldap
,
44 struct cldap_incoming
*in
)
46 struct cldapd_server
*cldapd
= talloc_get_type(private_data
,
47 struct cldapd_server
);
48 struct ldap_SearchRequest
*search
;
50 if (in
->ldap_msg
->type
!= LDAP_TAG_SearchRequest
) {
51 DEBUG(0,("Invalid CLDAP request type %d from %s\n",
53 tsocket_address_string(in
->src
, in
)));
54 cldap_error_reply(cldap
, in
->ldap_msg
->messageid
, in
->src
,
55 LDAP_OPERATIONS_ERROR
, "Invalid CLDAP request");
60 search
= &in
->ldap_msg
->r
.SearchRequest
;
62 if (strcmp("", search
->basedn
) != 0) {
63 DEBUG(0,("Invalid CLDAP basedn '%s' from %s\n",
65 tsocket_address_string(in
->src
, in
)));
66 cldap_error_reply(cldap
, in
->ldap_msg
->messageid
, in
->src
,
67 LDAP_OPERATIONS_ERROR
, "Invalid CLDAP basedn");
72 if (search
->scope
!= LDAP_SEARCH_SCOPE_BASE
) {
73 DEBUG(0,("Invalid CLDAP scope %d from %s\n",
75 tsocket_address_string(in
->src
, in
)));
76 cldap_error_reply(cldap
, in
->ldap_msg
->messageid
, in
->src
,
77 LDAP_OPERATIONS_ERROR
, "Invalid CLDAP scope");
82 if (search
->num_attributes
== 1 &&
83 strcasecmp(search
->attributes
[0], "netlogon") == 0) {
84 cldapd_netlogon_request(cldap
,
87 in
->ldap_msg
->messageid
,
94 cldapd_rootdse_request(cldap
, cldapd
, in
,
95 in
->ldap_msg
->messageid
,
102 start listening on the given address
104 static NTSTATUS
cldapd_add_socket(struct cldapd_server
*cldapd
, struct loadparm_context
*lp_ctx
,
107 struct cldap_socket
*cldapsock
;
108 struct tsocket_address
*socket_address
;
112 ret
= tsocket_address_inet_from_strings(cldapd
,
115 lp_cldap_port(lp_ctx
),
118 status
= map_nt_error_from_unix(errno
);
119 DEBUG(0,("invalid address %s:%d - %s:%s\n",
120 address
, lp_cldap_port(lp_ctx
),
121 gai_strerror(ret
), nt_errstr(status
)));
125 /* listen for unicasts on the CLDAP port (389) */
126 status
= cldap_socket_init(cldapd
,
127 cldapd
->task
->event_ctx
,
131 if (!NT_STATUS_IS_OK(status
)) {
132 DEBUG(0,("Failed to bind to %s - %s\n",
133 tsocket_address_string(socket_address
, socket_address
),
135 talloc_free(socket_address
);
138 talloc_free(socket_address
);
140 cldap_set_incoming_handler(cldapsock
, cldapd_request_handler
, cldapd
);
146 setup our listening sockets on the configured network interfaces
148 static NTSTATUS
cldapd_startup_interfaces(struct cldapd_server
*cldapd
, struct loadparm_context
*lp_ctx
,
149 struct interface
*ifaces
)
152 TALLOC_CTX
*tmp_ctx
= talloc_new(cldapd
);
156 num_interfaces
= iface_count(ifaces
);
158 /* if we are allowing incoming packets from any address, then
159 we need to bind to the wildcard address */
160 if (!lp_bind_interfaces_only(lp_ctx
)) {
161 status
= cldapd_add_socket(cldapd
, lp_ctx
, "0.0.0.0");
162 NT_STATUS_NOT_OK_RETURN(status
);
165 /* now we have to also listen on the specific interfaces,
166 so that replies always come from the right IP */
167 for (i
=0; i
<num_interfaces
; i
++) {
168 const char *address
= talloc_strdup(tmp_ctx
, iface_n_ip(ifaces
, i
));
169 status
= cldapd_add_socket(cldapd
, lp_ctx
, address
);
170 NT_STATUS_NOT_OK_RETURN(status
);
173 talloc_free(tmp_ctx
);
179 startup the cldapd task
181 static void cldapd_task_init(struct task_server
*task
)
183 struct cldapd_server
*cldapd
;
185 struct interface
*ifaces
;
187 load_interfaces(task
, lp_interfaces(task
->lp_ctx
), &ifaces
);
189 if (iface_count(ifaces
) == 0) {
190 task_server_terminate(task
, "cldapd: no network interfaces configured");
194 switch (lp_server_role(task
->lp_ctx
)) {
195 case ROLE_STANDALONE
:
196 task_server_terminate(task
, "cldap_server: no CLDAP server required in standalone configuration");
198 case ROLE_DOMAIN_MEMBER
:
199 task_server_terminate(task
, "cldap_server: no CLDAP server required in member server configuration");
201 case ROLE_DOMAIN_CONTROLLER
:
202 /* Yes, we want an CLDAP server */
206 task_server_set_title(task
, "task[cldapd]");
208 cldapd
= talloc(task
, struct cldapd_server
);
209 if (cldapd
== NULL
) {
210 task_server_terminate(task
, "cldapd: out of memory");
215 cldapd
->samctx
= samdb_connect(cldapd
, task
->event_ctx
, task
->lp_ctx
, system_session(cldapd
, task
->lp_ctx
));
216 if (cldapd
->samctx
== NULL
) {
217 task_server_terminate(task
, "cldapd failed to open samdb");
221 /* start listening on the configured network interfaces */
222 status
= cldapd_startup_interfaces(cldapd
, task
->lp_ctx
, ifaces
);
223 if (!NT_STATUS_IS_OK(status
)) {
224 task_server_terminate(task
, "cldapd failed to setup interfaces");
228 irpc_add_name(task
->msg_ctx
, "cldap_server");
233 register ourselves as a available server
235 NTSTATUS
server_service_cldapd_init(void)
237 return register_server_service("cldap", cldapd_task_init
);