?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
WHATSNEW: Update changes.
[Samba.git] / source4 / ldap_server / ldap_backend.c
bloba6566df92ae86c2f3259b8b2fb389120b4131868
1 /*
2 Unix SMB/CIFS implementation.
3 LDAP server
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Matthias Dieter Wallnöfer 2009
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "ldap_server/ldap_server.h"
23 #include "../lib/util/dlinklist.h"
24 #include "auth/credentials/credentials.h"
25 #include "auth/gensec/gensec.h"
26 #include "param/param.h"
27 #include "smbd/service_stream.h"
28 #include "dsdb/samdb/samdb.h"
29 #include "lib/ldb/include/ldb_errors.h"
30 #include "ldb_wrap.h"
31
32 #define VALID_DN_SYNTAX(dn) do {\
33 if (!(dn)) {\
34 return NT_STATUS_NO_MEMORY;\
35 } else if ( ! ldb_dn_validate(dn)) {\
36 result = LDAP_INVALID_DN_SYNTAX;\
37 map_ldb_error(local_ctx, LDB_ERR_INVALID_DN_SYNTAX, NULL,\
38 &errstr);\
39 goto reply;\
40 }\
41 } while(0)
42
43 static int map_ldb_error(TALLOC_CTX *mem_ctx, int ldb_err,
44 const char *add_err_string, const char **errstring)
45 {
46 WERROR err;
47
48 switch (ldb_err) {
49 case LDB_SUCCESS:
50 err = WERR_OK;
51 break;
52 case LDB_ERR_OPERATIONS_ERROR:
53 err = WERR_DS_OPERATIONS_ERROR;
54 break;
55 case LDB_ERR_PROTOCOL_ERROR:
56 err = WERR_DS_PROTOCOL_ERROR;
57 break;
58 case LDB_ERR_TIME_LIMIT_EXCEEDED:
59 err = WERR_DS_TIMELIMIT_EXCEEDED;
60 break;
61 case LDB_ERR_SIZE_LIMIT_EXCEEDED:
62 err = WERR_DS_SIZE_LIMIT_EXCEEDED;
63 break;
64 case LDB_ERR_COMPARE_FALSE:
65 err = WERR_DS_COMPARE_FALSE;
66 break;
67 case LDB_ERR_COMPARE_TRUE:
68 err = WERR_DS_COMPARE_TRUE;
69 break;
70 case LDB_ERR_AUTH_METHOD_NOT_SUPPORTED:
71 err = WERR_DS_AUTH_METHOD_NOT_SUPPORTED;
72 break;
73 case LDB_ERR_STRONG_AUTH_REQUIRED:
74 err = WERR_DS_STRONG_AUTH_REQUIRED;
75 break;
76 case LDB_ERR_REFERRAL:
77 err = WERR_DS_REFERRAL;
78 break;
79 case LDB_ERR_ADMIN_LIMIT_EXCEEDED:
80 err = WERR_DS_ADMIN_LIMIT_EXCEEDED;
81 break;
82 case LDB_ERR_UNSUPPORTED_CRITICAL_EXTENSION:
83 err = WERR_DS_UNAVAILABLE_CRIT_EXTENSION;
84 break;
85 case LDB_ERR_CONFIDENTIALITY_REQUIRED:
86 err = WERR_DS_CONFIDENTIALITY_REQUIRED;
87 break;
88 case LDB_ERR_SASL_BIND_IN_PROGRESS:
89 err = WERR_DS_BUSY;
90 break;
91 case LDB_ERR_NO_SUCH_ATTRIBUTE:
92 err = WERR_DS_NO_ATTRIBUTE_OR_VALUE;
93 break;
94 case LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE:
95 err = WERR_DS_ATTRIBUTE_TYPE_UNDEFINED;
96 break;
97 case LDB_ERR_INAPPROPRIATE_MATCHING:
98 err = WERR_DS_INAPPROPRIATE_MATCHING;
99 break;
100 case LDB_ERR_CONSTRAINT_VIOLATION:
101 err = WERR_DS_CONSTRAINT_VIOLATION;
102 break;
103 case LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS:
104 err = WERR_DS_ATTRIBUTE_OR_VALUE_EXISTS;
105 break;
106 case LDB_ERR_INVALID_ATTRIBUTE_SYNTAX:
107 err = WERR_DS_INVALID_ATTRIBUTE_SYNTAX;
108 break;
109 case LDB_ERR_NO_SUCH_OBJECT:
110 err = WERR_DS_NO_SUCH_OBJECT;
111 break;
112 case LDB_ERR_ALIAS_PROBLEM:
113 err = WERR_DS_ALIAS_PROBLEM;
114 break;
115 case LDB_ERR_INVALID_DN_SYNTAX:
116 err = WERR_DS_INVALID_DN_SYNTAX;
117 break;
118 case LDB_ERR_ALIAS_DEREFERENCING_PROBLEM:
119 err = WERR_DS_ALIAS_DEREF_PROBLEM;
120 break;
121 case LDB_ERR_INAPPROPRIATE_AUTHENTICATION:
122 err = WERR_DS_INAPPROPRIATE_AUTH;
123 break;
124 case LDB_ERR_INVALID_CREDENTIALS:
125 err = WERR_ACCESS_DENIED;
126 break;
127 case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
128 err = WERR_DS_INSUFF_ACCESS_RIGHTS;
129 break;
130 case LDB_ERR_BUSY:
131 err = WERR_DS_BUSY;
132 break;
133 case LDB_ERR_UNAVAILABLE:
134 err = WERR_DS_UNAVAILABLE;
135 break;
136 case LDB_ERR_UNWILLING_TO_PERFORM:
137 err = WERR_DS_UNWILLING_TO_PERFORM;
138 break;
139 case LDB_ERR_LOOP_DETECT:
140 err = WERR_DS_LOOP_DETECT;
141 break;
142 case LDB_ERR_NAMING_VIOLATION:
143 err = WERR_DS_NAMING_VIOLATION;
144 break;
145 case LDB_ERR_OBJECT_CLASS_VIOLATION:
146 err = WERR_DS_OBJ_CLASS_VIOLATION;
147 break;
148 case LDB_ERR_NOT_ALLOWED_ON_NON_LEAF:
149 err = WERR_DS_CANT_ON_NON_LEAF;
150 break;
151 case LDB_ERR_NOT_ALLOWED_ON_RDN:
152 err = WERR_DS_CANT_ON_RDN;
153 break;
154 case LDB_ERR_ENTRY_ALREADY_EXISTS:
155 err = WERR_DS_OBJ_STRING_NAME_EXISTS;
156 break;
157 case LDB_ERR_OBJECT_CLASS_MODS_PROHIBITED:
158 err = WERR_DS_CANT_MOD_OBJ_CLASS;
159 break;
160 case LDB_ERR_AFFECTS_MULTIPLE_DSAS:
161 err = WERR_DS_AFFECTS_MULTIPLE_DSAS;
162 break;
163 default:
164 err = WERR_DS_GENERIC_ERROR;
165 break;
166 }
167
168 *errstring = talloc_asprintf(mem_ctx, "%08x: %s", W_ERROR_V(err),
169 ldb_strerror(ldb_err));
170 if (add_err_string != NULL) {
171 *errstring = talloc_asprintf(mem_ctx, "%s - %s", *errstring,
172 add_err_string);
173 }
174
175 /* result is 1:1 for now */
176 return ldb_err;
177 }
178
179 /*
180 connect to the sam database
181 */
182 NTSTATUS ldapsrv_backend_Init(struct ldapsrv_connection *conn)
183 {
184 conn->ldb = ldb_wrap_connect(conn,
185 conn->connection->event.ctx,
186 conn->lp_ctx,
187 lpcfg_sam_url(conn->lp_ctx),
188 conn->session_info,
189 samdb_credentials(conn->connection->event.ctx, conn->lp_ctx),
190 conn->global_catalog ? LDB_FLG_RDONLY : 0);
191 if (conn->ldb == NULL) {
192 return NT_STATUS_INTERNAL_DB_CORRUPTION;
193 }
194
195 if (conn->server_credentials) {
196 char **sasl_mechs = NULL;
197 struct gensec_security_ops **backends = gensec_security_all();
198 struct gensec_security_ops **ops
199 = gensec_use_kerberos_mechs(conn, backends, conn->server_credentials);
200 unsigned int i, j = 0;
201 for (i = 0; ops && ops[i]; i++) {
202 if (!lpcfg_parm_bool(conn->lp_ctx, NULL, "gensec", ops[i]->name, ops[i]->enabled))
203 continue;
204
205 if (ops[i]->sasl_name && ops[i]->server_start) {
206 char *sasl_name = talloc_strdup(conn, ops[i]->sasl_name);
207
208 if (!sasl_name) {
209 return NT_STATUS_NO_MEMORY;
210 }
211 sasl_mechs = talloc_realloc(conn, sasl_mechs, char *, j + 2);
212 if (!sasl_mechs) {
213 return NT_STATUS_NO_MEMORY;
214 }
215 sasl_mechs[j] = sasl_name;
216 talloc_steal(sasl_mechs, sasl_name);
217 sasl_mechs[j+1] = NULL;
218 j++;
219 }
220 }
221 talloc_unlink(conn, ops);
222
223 /* ldb can have a different lifetime to conn, so we
224 need to ensure that sasl_mechs lives as long as the
225 ldb does */
226 talloc_steal(conn->ldb, sasl_mechs);
227
228 ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs);
229 }
230
231 return NT_STATUS_OK;
232 }
233
234 struct ldapsrv_reply *ldapsrv_init_reply(struct ldapsrv_call *call, uint8_t type)
235 {
236 struct ldapsrv_reply *reply;
237
238 reply = talloc(call, struct ldapsrv_reply);
239 if (!reply) {
240 return NULL;
241 }
242 reply->msg = talloc(reply, struct ldap_message);
243 if (reply->msg == NULL) {
244 talloc_free(reply);
245 return NULL;
246 }
247
248 reply->msg->messageid = call->request->messageid;
249 reply->msg->type = type;
250 reply->msg->controls = NULL;
251
252 return reply;
253 }
254
255 void ldapsrv_queue_reply(struct ldapsrv_call *call, struct ldapsrv_reply *reply)
256 {
257 DLIST_ADD_END(call->replies, reply, struct ldapsrv_reply *);
258 }
259
260 static NTSTATUS ldapsrv_unwilling(struct ldapsrv_call *call, int error)
261 {
262 struct ldapsrv_reply *reply;
263 struct ldap_ExtendedResponse *r;
264
265 DEBUG(10,("Unwilling type[%d] id[%d]\n", call->request->type, call->request->messageid));
266
267 reply = ldapsrv_init_reply(call, LDAP_TAG_ExtendedResponse);
268 if (!reply) {
269 return NT_STATUS_NO_MEMORY;
270 }
271
272 r = &reply->msg->r.ExtendedResponse;
273 r->response.resultcode = error;
274 r->response.dn = NULL;
275 r->response.errormessage = NULL;
276 r->response.referral = NULL;
277 r->oid = NULL;
278 r->value = NULL;
279
280 ldapsrv_queue_reply(call, reply);
281 return NT_STATUS_OK;
282 }
283
284 static int ldb_add_with_context(struct ldb_context *ldb,
285 const struct ldb_message *message,
286 void *context)
287 {
288 struct ldb_request *req;
289 int ret;
290
291 ret = ldb_msg_sanity_check(ldb, message);
292 if (ret != LDB_SUCCESS) {
293 return ret;
294 }
295
296 ret = ldb_build_add_req(&req, ldb, ldb,
297 message,
298 NULL,
299 context,
300 ldb_modify_default_callback,
301 NULL);
302
303 if (ret != LDB_SUCCESS) return ret;
304
305 ret = ldb_transaction_start(ldb);
306 if (ret != LDB_SUCCESS) {
307 return ret;
308 }
309
310 ret = ldb_request(ldb, req);
311 if (ret == LDB_SUCCESS) {
312 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
313 }
314
315 if (ret == LDB_SUCCESS) {
316 ret = ldb_transaction_commit(ldb);
317 }
318 else {
319 ldb_transaction_cancel(ldb);
320 }
321
322 talloc_free(req);
323 return ret;
324 }
325
326 /* create and execute a modify request */
327 static int ldb_mod_req_with_controls(struct ldb_context *ldb,
328 const struct ldb_message *message,
329 struct ldb_control **controls,
330 void *context)
331 {
332 struct ldb_request *req;
333 int ret;
334
335 ret = ldb_msg_sanity_check(ldb, message);
336 if (ret != LDB_SUCCESS) {
337 return ret;
338 }
339
340 ret = ldb_build_mod_req(&req, ldb, ldb,
341 message,
342 controls,
343 context,
344 ldb_modify_default_callback,
345 NULL);
346
347 if (ret != LDB_SUCCESS) {
348 return ret;
349 }
350
351 ret = ldb_transaction_start(ldb);
352 if (ret != LDB_SUCCESS) {
353 return ret;
354 }
355
356 ret = ldb_request(ldb, req);
357 if (ret == LDB_SUCCESS) {
358 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
359 }
360
361 if (ret == LDB_SUCCESS) {
362 ret = ldb_transaction_commit(ldb);
363 }
364 else {
365 ldb_transaction_cancel(ldb);
366 }
367
368 talloc_free(req);
369 return ret;
370 }
371
372 /* create and execute a delete request */
373 static int ldb_del_req_with_controls(struct ldb_context *ldb,
374 struct ldb_dn *dn,
375 struct ldb_control **controls,
376 void *context)
377 {
378 struct ldb_request *req;
379 int ret;
380
381 ret = ldb_build_del_req(&req, ldb, ldb,
382 dn,
383 controls,
384 context,
385 ldb_modify_default_callback,
386 NULL);
387
388 if (ret != LDB_SUCCESS) return ret;
389
390 ret = ldb_transaction_start(ldb);
391 if (ret != LDB_SUCCESS) {
392 return ret;
393 }
394
395 ret = ldb_request(ldb, req);
396 if (ret == LDB_SUCCESS) {
397 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
398 }
399
400 if (ret == LDB_SUCCESS) {
401 ret = ldb_transaction_commit(ldb);
402 }
403 else {
404 ldb_transaction_cancel(ldb);
405 }
406
407 talloc_free(req);
408 return ret;
409 }
410
411 int ldb_rename_with_context(struct ldb_context *ldb,
412 struct ldb_dn *olddn,
413 struct ldb_dn *newdn,
414 void *context)
415 {
416 struct ldb_request *req;
417 int ret;
418
419 ret = ldb_build_rename_req(&req, ldb, ldb,
420 olddn,
421 newdn,
422 NULL,
423 context,
424 ldb_modify_default_callback,
425 NULL);
426
427 if (ret != LDB_SUCCESS) return ret;
428
429 ret = ldb_transaction_start(ldb);
430 if (ret != LDB_SUCCESS) {
431 return ret;
432 }
433
434 ret = ldb_request(ldb, req);
435 if (ret == LDB_SUCCESS) {
436 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
437 }
438
439 if (ret == LDB_SUCCESS) {
440 ret = ldb_transaction_commit(ldb);
441 }
442 else {
443 ldb_transaction_cancel(ldb);
444 }
445
446 talloc_free(req);
447 return ret;
448 }
449
450 static NTSTATUS ldapsrv_SearchRequest(struct ldapsrv_call *call)
451 {
452 struct ldap_SearchRequest *req = &call->request->r.SearchRequest;
453 struct ldap_SearchResEntry *ent;
454 struct ldap_Result *done;
455 struct ldapsrv_reply *ent_r, *done_r;
456 TALLOC_CTX *local_ctx;
457 struct ldb_context *samdb = talloc_get_type(call->conn->ldb, struct ldb_context);
458 struct ldb_dn *basedn;
459 struct ldb_result *res = NULL;
460 struct ldb_request *lreq;
461 struct ldb_control *search_control;
462 struct ldb_search_options_control *search_options;
463 struct ldb_control *extended_dn_control;
464 struct ldb_extended_dn_control *extended_dn_decoded = NULL;
465 enum ldb_scope scope = LDB_SCOPE_DEFAULT;
466 const char **attrs = NULL;
467 const char *scope_str, *errstr = NULL;
468 int success_limit = 1;
469 int result = -1;
470 int ldb_ret = -1;
471 unsigned int i, j;
472 int extended_type = 1;
473
474 DEBUG(10, ("SearchRequest"));
475 DEBUGADD(10, (" basedn: %s", req->basedn));
476 DEBUGADD(10, (" filter: %s\n", ldb_filter_from_tree(call, req->tree)));
477
478 local_ctx = talloc_new(call);
479 NT_STATUS_HAVE_NO_MEMORY(local_ctx);
480
481 basedn = ldb_dn_new(local_ctx, samdb, req->basedn);
482 VALID_DN_SYNTAX(basedn);
483
484 DEBUG(10, ("SearchRequest: basedn: [%s]\n", req->basedn));
485 DEBUG(10, ("SearchRequest: filter: [%s]\n", ldb_filter_from_tree(call, req->tree)));
486
487 switch (req->scope) {
488 case LDAP_SEARCH_SCOPE_BASE:
489 scope_str = "BASE";
490 scope = LDB_SCOPE_BASE;
491 success_limit = 0;
492 break;
493 case LDAP_SEARCH_SCOPE_SINGLE:
494 scope_str = "ONE";
495 scope = LDB_SCOPE_ONELEVEL;
496 success_limit = 0;
497 break;
498 case LDAP_SEARCH_SCOPE_SUB:
499 scope_str = "SUB";
500 scope = LDB_SCOPE_SUBTREE;
501 success_limit = 0;
502 break;
503 default:
504 result = LDAP_PROTOCOL_ERROR;
505 map_ldb_error(local_ctx, LDB_ERR_PROTOCOL_ERROR, NULL,
506 &errstr);
507 errstr = talloc_asprintf(local_ctx,
508 "%s. Invalid scope", errstr);
509 goto reply;
510 }
511 DEBUG(10,("SearchRequest: scope: [%s]\n", scope_str));
512
513 if (req->num_attributes >= 1) {
514 attrs = talloc_array(local_ctx, const char *, req->num_attributes+1);
515 NT_STATUS_HAVE_NO_MEMORY(attrs);
516
517 for (i=0; i < req->num_attributes; i++) {
518 DEBUG(10,("SearchRequest: attrs: [%s]\n",req->attributes[i]));
519 attrs[i] = req->attributes[i];
520 }
521 attrs[i] = NULL;
522 }
523
524 DEBUG(5,("ldb_request %s dn=%s filter=%s\n",
525 scope_str, req->basedn, ldb_filter_from_tree(call, req->tree)));
526
527 res = talloc_zero(local_ctx, struct ldb_result);
528 NT_STATUS_HAVE_NO_MEMORY(res);
529
530 ldb_ret = ldb_build_search_req_ex(&lreq, samdb, local_ctx,
531 basedn, scope,
532 req->tree, attrs,
533 call->request->controls,
534 res, ldb_search_default_callback,
535 NULL);
536
537 if (ldb_ret != LDB_SUCCESS) {
538 goto reply;
539 }
540
541 if (call->conn->global_catalog) {
542 search_control = ldb_request_get_control(lreq, LDB_CONTROL_SEARCH_OPTIONS_OID);
543
544 search_options = NULL;
545 if (search_control) {
546 search_options = talloc_get_type(search_control->data, struct ldb_search_options_control);
547 search_options->search_options |= LDB_SEARCH_OPTION_PHANTOM_ROOT;
548 } else {
549 search_options = talloc(lreq, struct ldb_search_options_control);
550 NT_STATUS_HAVE_NO_MEMORY(search_options);
551 search_options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
552 ldb_request_add_control(lreq, LDB_CONTROL_SEARCH_OPTIONS_OID, false, search_options);
553 }
554 }
555
556 extended_dn_control = ldb_request_get_control(lreq, LDB_CONTROL_EXTENDED_DN_OID);
557
558 if (extended_dn_control) {
559 if (extended_dn_control->data) {
560 extended_dn_decoded = talloc_get_type(extended_dn_control->data, struct ldb_extended_dn_control);
561 extended_type = extended_dn_decoded->type;
562 } else {
563 extended_type = 0;
564 }
565 }
566
567 ldb_set_timeout(samdb, lreq, req->timelimit);
568
569 ldb_ret = ldb_request(samdb, lreq);
570
571 if (ldb_ret != LDB_SUCCESS) {
572 goto reply;
573 }
574
575 ldb_ret = ldb_wait(lreq->handle, LDB_WAIT_ALL);
576
577 if (ldb_ret == LDB_SUCCESS) {
578 for (i = 0; i < res->count; i++) {
579 ent_r = ldapsrv_init_reply(call, LDAP_TAG_SearchResultEntry);
580 NT_STATUS_HAVE_NO_MEMORY(ent_r);
581
582 /* Better to have the whole message kept here,
583 * than to find someone further up didn't put
584 * a value in the right spot in the talloc tree */
585 talloc_steal(ent_r, res->msgs[i]);
586
587 ent = &ent_r->msg->r.SearchResultEntry;
588 ent->dn = ldb_dn_get_extended_linearized(ent_r, res->msgs[i]->dn, extended_type);
589 ent->num_attributes = 0;
590 ent->attributes = NULL;
591 if (res->msgs[i]->num_elements == 0) {
592 goto queue_reply;
593 }
594 ent->num_attributes = res->msgs[i]->num_elements;
595 ent->attributes = talloc_array(ent_r, struct ldb_message_element, ent->num_attributes);
596 NT_STATUS_HAVE_NO_MEMORY(ent->attributes);
597 for (j=0; j < ent->num_attributes; j++) {
598 ent->attributes[j].name = res->msgs[i]->elements[j].name;
599 ent->attributes[j].num_values = 0;
600 ent->attributes[j].values = NULL;
601 if (req->attributesonly && (res->msgs[i]->elements[j].num_values == 0)) {
602 continue;
603 }
604 ent->attributes[j].num_values = res->msgs[i]->elements[j].num_values;
605 ent->attributes[j].values = res->msgs[i]->elements[j].values;
606 }
607 queue_reply:
608 ldapsrv_queue_reply(call, ent_r);
609 }
610
611 /* Send back referrals if they do exist (search operations) */
612 if (res->refs != NULL) {
613 char **ref;
614 struct ldap_SearchResRef *ent_ref;
615
616 for (ref = res->refs; *ref != NULL; ++ref) {
617 ent_r = ldapsrv_init_reply(call, LDAP_TAG_SearchResultReference);
618 NT_STATUS_HAVE_NO_MEMORY(ent_r);
619
620 /* Better to have the whole referrals kept here,
621 * than to find someone further up didn't put
622 * a value in the right spot in the talloc tree
623 */
624 talloc_steal(ent_r, *ref);
625
626 ent_ref = &ent_r->msg->r.SearchResultReference;
627 ent_ref->referral = *ref;
628
629 ldapsrv_queue_reply(call, ent_r);
630 }
631 }
632 }
633
634 reply:
635 done_r = ldapsrv_init_reply(call, LDAP_TAG_SearchResultDone);
636 NT_STATUS_HAVE_NO_MEMORY(done_r);
637
638 done = &done_r->msg->r.SearchResultDone;
639 done->dn = NULL;
640 done->referral = NULL;
641
642 if (result != -1) {
643 } else if (ldb_ret == LDB_SUCCESS) {
644 if (res->count >= success_limit) {
645 DEBUG(10,("SearchRequest: results: [%d]\n", res->count));
646 result = LDAP_SUCCESS;
647 errstr = NULL;
648 }
649 if (res->controls) {
650 done_r->msg->controls = res->controls;
651 talloc_steal(done_r, res->controls);
652 }
653 } else {
654 DEBUG(10,("SearchRequest: error\n"));
655 result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
656 &errstr);
657 }
658
659 done->resultcode = result;
660 done->errormessage = (errstr?talloc_strdup(done_r, errstr):NULL);
661
662 talloc_free(local_ctx);
663
664 ldapsrv_queue_reply(call, done_r);
665 return NT_STATUS_OK;
666 }
667
668 static NTSTATUS ldapsrv_ModifyRequest(struct ldapsrv_call *call)
669 {
670 struct ldap_ModifyRequest *req = &call->request->r.ModifyRequest;
671 struct ldap_Result *modify_result;
672 struct ldapsrv_reply *modify_reply;
673 TALLOC_CTX *local_ctx;
674 struct ldb_context *samdb = call->conn->ldb;
675 struct ldb_message *msg = NULL;
676 struct ldb_dn *dn;
677 const char *errstr = NULL;
678 int result = LDAP_SUCCESS;
679 int ldb_ret;
680 unsigned int i,j;
681 struct ldb_result *res = NULL;
682
683 DEBUG(10, ("ModifyRequest"));
684 DEBUGADD(10, (" dn: %s\n", req->dn));
685
686 local_ctx = talloc_named(call, 0, "ModifyRequest local memory context");
687 NT_STATUS_HAVE_NO_MEMORY(local_ctx);
688
689 dn = ldb_dn_new(local_ctx, samdb, req->dn);
690 VALID_DN_SYNTAX(dn);
691
692 DEBUG(10, ("ModifyRequest: dn: [%s]\n", req->dn));
693
694 msg = talloc(local_ctx, struct ldb_message);
695 NT_STATUS_HAVE_NO_MEMORY(msg);
696
697 msg->dn = dn;
698 msg->num_elements = 0;
699 msg->elements = NULL;
700
701 if (req->num_mods > 0) {
702 msg->num_elements = req->num_mods;
703 msg->elements = talloc_array(msg, struct ldb_message_element, req->num_mods);
704 NT_STATUS_HAVE_NO_MEMORY(msg->elements);
705
706 for (i=0; i < msg->num_elements; i++) {
707 msg->elements[i].name = discard_const_p(char, req->mods[i].attrib.name);
708 msg->elements[i].num_values = 0;
709 msg->elements[i].values = NULL;
710
711 switch (req->mods[i].type) {
712 default:
713 result = LDAP_PROTOCOL_ERROR;
714 map_ldb_error(local_ctx,
715 LDB_ERR_PROTOCOL_ERROR, NULL, &errstr);
716 errstr = talloc_asprintf(local_ctx,
717 "%s. Invalid LDAP_MODIFY_* type", errstr);
718 goto reply;
719 case LDAP_MODIFY_ADD:
720 msg->elements[i].flags = LDB_FLAG_MOD_ADD;
721 break;
722 case LDAP_MODIFY_DELETE:
723 msg->elements[i].flags = LDB_FLAG_MOD_DELETE;
724 break;
725 case LDAP_MODIFY_REPLACE:
726 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
727 break;
728 }
729
730 msg->elements[i].num_values = req->mods[i].attrib.num_values;
731 if (msg->elements[i].num_values > 0) {
732 msg->elements[i].values = talloc_array(msg->elements, struct ldb_val,
733 msg->elements[i].num_values);
734 NT_STATUS_HAVE_NO_MEMORY(msg->elements[i].values);
735
736 for (j=0; j < msg->elements[i].num_values; j++) {
737 msg->elements[i].values[j].length = req->mods[i].attrib.values[j].length;
738 msg->elements[i].values[j].data = req->mods[i].attrib.values[j].data;
739 }
740 }
741 }
742 }
743
744 reply:
745 modify_reply = ldapsrv_init_reply(call, LDAP_TAG_ModifyResponse);
746 NT_STATUS_HAVE_NO_MEMORY(modify_reply);
747
748 if (result == LDAP_SUCCESS) {
749 res = talloc_zero(local_ctx, struct ldb_result);
750 NT_STATUS_HAVE_NO_MEMORY(res);
751 ldb_ret = ldb_mod_req_with_controls(samdb, msg, call->request->controls, res);
752 result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
753 &errstr);
754 }
755
756 modify_result = &modify_reply->msg->r.ModifyResponse;
757 modify_result->dn = NULL;
758 if ((res != NULL) && (res->refs != NULL)) {
759 modify_result->resultcode = map_ldb_error(local_ctx,
760 LDB_ERR_REFERRAL,
761 NULL, &errstr);
762 modify_result->errormessage = (errstr?talloc_strdup(modify_reply, errstr):NULL);
763 modify_result->referral = talloc_strdup(call, *res->refs);
764 } else {
765 modify_result->resultcode = result;
766 modify_result->errormessage = (errstr?talloc_strdup(modify_reply, errstr):NULL);
767 modify_result->referral = NULL;
768 }
769 talloc_free(local_ctx);
770
771 ldapsrv_queue_reply(call, modify_reply);
772 return NT_STATUS_OK;
773
774 }
775
776 static NTSTATUS ldapsrv_AddRequest(struct ldapsrv_call *call)
777 {
778 struct ldap_AddRequest *req = &call->request->r.AddRequest;
779 struct ldap_Result *add_result;
780 struct ldapsrv_reply *add_reply;
781 TALLOC_CTX *local_ctx;
782 struct ldb_context *samdb = call->conn->ldb;
783 struct ldb_message *msg = NULL;
784 struct ldb_dn *dn;
785 const char *errstr = NULL;
786 int result = LDAP_SUCCESS;
787 int ldb_ret;
788 unsigned int i,j;
789 struct ldb_result *res = NULL;
790
791 DEBUG(10, ("AddRequest"));
792 DEBUGADD(10, (" dn: %s\n", req->dn));
793
794 local_ctx = talloc_named(call, 0, "AddRequest local memory context");
795 NT_STATUS_HAVE_NO_MEMORY(local_ctx);
796
797 dn = ldb_dn_new(local_ctx, samdb, req->dn);
798 VALID_DN_SYNTAX(dn);
799
800 DEBUG(10, ("AddRequest: dn: [%s]\n", req->dn));
801
802 msg = talloc(local_ctx, struct ldb_message);
803 NT_STATUS_HAVE_NO_MEMORY(msg);
804
805 msg->dn = dn;
806 msg->num_elements = 0;
807 msg->elements = NULL;
808
809 if (req->num_attributes > 0) {
810 msg->num_elements = req->num_attributes;
811 msg->elements = talloc_array(msg, struct ldb_message_element, msg->num_elements);
812 NT_STATUS_HAVE_NO_MEMORY(msg->elements);
813
814 for (i=0; i < msg->num_elements; i++) {
815 msg->elements[i].name = discard_const_p(char, req->attributes[i].name);
816 msg->elements[i].flags = 0;
817 msg->elements[i].num_values = 0;
818 msg->elements[i].values = NULL;
819
820 if (req->attributes[i].num_values > 0) {
821 msg->elements[i].num_values = req->attributes[i].num_values;
822 msg->elements[i].values = talloc_array(msg->elements, struct ldb_val,
823 msg->elements[i].num_values);
824 NT_STATUS_HAVE_NO_MEMORY(msg->elements[i].values);
825
826 for (j=0; j < msg->elements[i].num_values; j++) {
827 msg->elements[i].values[j].length = req->attributes[i].values[j].length;
828 msg->elements[i].values[j].data = req->attributes[i].values[j].data;
829 }
830 }
831 }
832 }
833
834 reply:
835 add_reply = ldapsrv_init_reply(call, LDAP_TAG_AddResponse);
836 NT_STATUS_HAVE_NO_MEMORY(add_reply);
837
838 if (result == LDAP_SUCCESS) {
839 res = talloc_zero(local_ctx, struct ldb_result);
840 NT_STATUS_HAVE_NO_MEMORY(res);
841 ldb_ret = ldb_add_with_context(samdb, msg, res);
842 result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
843 &errstr);
844 }
845
846 add_result = &add_reply->msg->r.AddResponse;
847 add_result->dn = NULL;
848 if ((res != NULL) && (res->refs != NULL)) {
849 add_result->resultcode = map_ldb_error(local_ctx,
850 LDB_ERR_REFERRAL, NULL,
851 &errstr);
852 add_result->errormessage = (errstr?talloc_strdup(add_reply,errstr):NULL);
853 add_result->referral = talloc_strdup(call, *res->refs);
854 } else {
855 add_result->resultcode = result;
856 add_result->errormessage = (errstr?talloc_strdup(add_reply,errstr):NULL);
857 add_result->referral = NULL;
858 }
859 talloc_free(local_ctx);
860
861 ldapsrv_queue_reply(call, add_reply);
862 return NT_STATUS_OK;
863
864 }
865
866 static NTSTATUS ldapsrv_DelRequest(struct ldapsrv_call *call)
867 {
868 struct ldap_DelRequest *req = &call->request->r.DelRequest;
869 struct ldap_Result *del_result;
870 struct ldapsrv_reply *del_reply;
871 TALLOC_CTX *local_ctx;
872 struct ldb_context *samdb = call->conn->ldb;
873 struct ldb_dn *dn;
874 const char *errstr = NULL;
875 int result = LDAP_SUCCESS;
876 int ldb_ret;
877 struct ldb_result *res = NULL;
878
879 DEBUG(10, ("DelRequest"));
880 DEBUGADD(10, (" dn: %s\n", req->dn));
881
882 local_ctx = talloc_named(call, 0, "DelRequest local memory context");
883 NT_STATUS_HAVE_NO_MEMORY(local_ctx);
884
885 dn = ldb_dn_new(local_ctx, samdb, req->dn);
886 VALID_DN_SYNTAX(dn);
887
888 DEBUG(10, ("DelRequest: dn: [%s]\n", req->dn));
889
890 reply:
891 del_reply = ldapsrv_init_reply(call, LDAP_TAG_DelResponse);
892 NT_STATUS_HAVE_NO_MEMORY(del_reply);
893
894 if (result == LDAP_SUCCESS) {
895 res = talloc_zero(local_ctx, struct ldb_result);
896 NT_STATUS_HAVE_NO_MEMORY(res);
897 ldb_ret = ldb_del_req_with_controls(samdb, dn, call->request->controls, res);
898 result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
899 &errstr);
900 }
901
902 del_result = &del_reply->msg->r.DelResponse;
903 del_result->dn = NULL;
904 if ((res != NULL) && (res->refs != NULL)) {
905 del_result->resultcode = map_ldb_error(local_ctx,
906 LDB_ERR_REFERRAL, NULL,
907 &errstr);
908 del_result->errormessage = (errstr?talloc_strdup(del_reply,errstr):NULL);
909 del_result->referral = talloc_strdup(call, *res->refs);
910 } else {
911 del_result->resultcode = result;
912 del_result->errormessage = (errstr?talloc_strdup(del_reply,errstr):NULL);
913 del_result->referral = NULL;
914 }
915
916 talloc_free(local_ctx);
917
918 ldapsrv_queue_reply(call, del_reply);
919 return NT_STATUS_OK;
920 }
921
922 static NTSTATUS ldapsrv_ModifyDNRequest(struct ldapsrv_call *call)
923 {
924 struct ldap_ModifyDNRequest *req = &call->request->r.ModifyDNRequest;
925 struct ldap_Result *modifydn;
926 struct ldapsrv_reply *modifydn_r;
927 TALLOC_CTX *local_ctx;
928 struct ldb_context *samdb = call->conn->ldb;
929 struct ldb_dn *olddn, *newdn=NULL, *newrdn;
930 struct ldb_dn *parentdn = NULL;
931 const char *errstr = NULL;
932 int result = LDAP_SUCCESS;
933 int ldb_ret;
934 struct ldb_result *res = NULL;
935
936 DEBUG(10, ("ModifyDNRequest"));
937 DEBUGADD(10, (" dn: %s", req->dn));
938 DEBUGADD(10, (" newrdn: %s\n", req->newrdn));
939
940 local_ctx = talloc_named(call, 0, "ModifyDNRequest local memory context");
941 NT_STATUS_HAVE_NO_MEMORY(local_ctx);
942
943 olddn = ldb_dn_new(local_ctx, samdb, req->dn);
944 VALID_DN_SYNTAX(olddn);
945
946 newrdn = ldb_dn_new(local_ctx, samdb, req->newrdn);
947 VALID_DN_SYNTAX(newrdn);
948
949 DEBUG(10, ("ModifyDNRequest: olddn: [%s]\n", req->dn));
950 DEBUG(10, ("ModifyDNRequest: newrdn: [%s]\n", req->newrdn));
951
952 if (ldb_dn_get_comp_num(newrdn) == 0) {
953 result = LDAP_PROTOCOL_ERROR;
954 map_ldb_error(local_ctx, LDB_ERR_PROTOCOL_ERROR, NULL,
955 &errstr);
956 goto reply;
957 }
958
959 if (ldb_dn_get_comp_num(newrdn) > 1) {
960 result = LDAP_NAMING_VIOLATION;
961 map_ldb_error(local_ctx, LDB_ERR_NAMING_VIOLATION, NULL,
962 &errstr);
963 goto reply;
964 }
965
966 /* we can't handle the rename if we should not remove the old dn */
967 if (!req->deleteolddn) {
968 result = LDAP_UNWILLING_TO_PERFORM;
969 map_ldb_error(local_ctx, LDB_ERR_UNWILLING_TO_PERFORM, NULL,
970 &errstr);
971 errstr = talloc_asprintf(local_ctx,
972 "%s. Old RDN must be deleted", errstr);
973 goto reply;
974 }
975
976 if (req->newsuperior) {
977 parentdn = ldb_dn_new(local_ctx, samdb, req->newsuperior);
978 VALID_DN_SYNTAX(parentdn);
979 DEBUG(10, ("ModifyDNRequest: newsuperior: [%s]\n", req->newsuperior));
980 }
981
982 if (!parentdn) {
983 parentdn = ldb_dn_get_parent(local_ctx, olddn);
984 }
985 if (!parentdn) {
986 result = LDAP_NO_SUCH_OBJECT;
987 map_ldb_error(local_ctx, LDB_ERR_NO_SUCH_OBJECT, NULL, &errstr);
988 goto reply;
989 }
990
991 if ( ! ldb_dn_add_child(parentdn, newrdn)) {
992 result = LDAP_OTHER;
993 map_ldb_error(local_ctx, LDB_ERR_OTHER, NULL, &errstr);
994 goto reply;
995 }
996 newdn = parentdn;
997
998 reply:
999 modifydn_r = ldapsrv_init_reply(call, LDAP_TAG_ModifyDNResponse);
1000 NT_STATUS_HAVE_NO_MEMORY(modifydn_r);
1001
1002 if (result == LDAP_SUCCESS) {
1003 res = talloc_zero(local_ctx, struct ldb_result);
1004 NT_STATUS_HAVE_NO_MEMORY(res);
1005 ldb_ret = ldb_rename_with_context(samdb, olddn, newdn, res);
1006 result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
1007 &errstr);
1008 }
1009
1010 modifydn = &modifydn_r->msg->r.ModifyDNResponse;
1011 modifydn->dn = NULL;
1012 if ((res != NULL) && (res->refs != NULL)) {
1013 modifydn->resultcode = map_ldb_error(local_ctx,
1014 LDB_ERR_REFERRAL, NULL,
1015 &errstr);;
1016 modifydn->errormessage = (errstr?talloc_strdup(modifydn_r,errstr):NULL);
1017 modifydn->referral = talloc_strdup(call, *res->refs);
1018 } else {
1019 modifydn->resultcode = result;
1020 modifydn->errormessage = (errstr?talloc_strdup(modifydn_r,errstr):NULL);
1021 modifydn->referral = NULL;
1022 }
1023
1024 talloc_free(local_ctx);
1025
1026 ldapsrv_queue_reply(call, modifydn_r);
1027 return NT_STATUS_OK;
1028 }
1029
1030 static NTSTATUS ldapsrv_CompareRequest(struct ldapsrv_call *call)
1031 {
1032 struct ldap_CompareRequest *req = &call->request->r.CompareRequest;
1033 struct ldap_Result *compare;
1034 struct ldapsrv_reply *compare_r;
1035 TALLOC_CTX *local_ctx;
1036 struct ldb_context *samdb = call->conn->ldb;
1037 struct ldb_result *res = NULL;
1038 struct ldb_dn *dn;
1039 const char *attrs[1];
1040 const char *errstr = NULL;
1041 const char *filter = NULL;
1042 int result = LDAP_SUCCESS;
1043 int ldb_ret;
1044
1045 DEBUG(10, ("CompareRequest"));
1046 DEBUGADD(10, (" dn: %s\n", req->dn));
1047
1048 local_ctx = talloc_named(call, 0, "CompareRequest local_memory_context");
1049 NT_STATUS_HAVE_NO_MEMORY(local_ctx);
1050
1051 dn = ldb_dn_new(local_ctx, samdb, req->dn);
1052 VALID_DN_SYNTAX(dn);
1053
1054 DEBUG(10, ("CompareRequest: dn: [%s]\n", req->dn));
1055 filter = talloc_asprintf(local_ctx, "(%s=%*s)", req->attribute,
1056 (int)req->value.length, req->value.data);
1057 NT_STATUS_HAVE_NO_MEMORY(filter);
1058
1059 DEBUGADD(10, ("CompareRequest: attribute: [%s]\n", filter));
1060
1061 attrs[0] = NULL;
1062
1063 reply:
1064 compare_r = ldapsrv_init_reply(call, LDAP_TAG_CompareResponse);
1065 NT_STATUS_HAVE_NO_MEMORY(compare_r);
1066
1067 if (result == LDAP_SUCCESS) {
1068 ldb_ret = ldb_search(samdb, local_ctx, &res,
1069 dn, LDB_SCOPE_BASE, attrs, "%s", filter);
1070 if (ldb_ret != LDB_SUCCESS) {
1071 result = map_ldb_error(local_ctx, ldb_ret,
1072 ldb_errstring(samdb), &errstr);
1073 DEBUG(10,("CompareRequest: error: %s\n", errstr));
1074 } else if (res->count == 0) {
1075 DEBUG(10,("CompareRequest: doesn't matched\n"));
1076 result = LDAP_COMPARE_FALSE;
1077 errstr = NULL;
1078 } else if (res->count == 1) {
1079 DEBUG(10,("CompareRequest: matched\n"));
1080 result = LDAP_COMPARE_TRUE;
1081 errstr = NULL;
1082 } else if (res->count > 1) {
1083 result = LDAP_OTHER;
1084 map_ldb_error(local_ctx, LDB_ERR_OTHER, NULL, &errstr);
1085 errstr = talloc_asprintf(local_ctx,
1086 "%s. Too many objects match!", errstr);
1087 DEBUG(10,("CompareRequest: %d results: %s\n", res->count, errstr));
1088 }
1089 }
1090
1091 compare = &compare_r->msg->r.CompareResponse;
1092 compare->dn = NULL;
1093 compare->resultcode = result;
1094 compare->errormessage = (errstr?talloc_strdup(compare_r,errstr):NULL);
1095 compare->referral = NULL;
1096
1097 talloc_free(local_ctx);
1098
1099 ldapsrv_queue_reply(call, compare_r);
1100 return NT_STATUS_OK;
1101 }
1102
1103 static NTSTATUS ldapsrv_AbandonRequest(struct ldapsrv_call *call)
1104 {
1105 /* struct ldap_AbandonRequest *req = &call->request.r.AbandonRequest;*/
1106 DEBUG(10, ("AbandonRequest\n"));
1107 return NT_STATUS_OK;
1108 }
1109
1110 NTSTATUS ldapsrv_do_call(struct ldapsrv_call *call)
1111 {
1112 unsigned int i;
1113 struct ldap_message *msg = call->request;
1114 /* Check for undecoded critical extensions */
1115 for (i=0; msg->controls && msg->controls[i]; i++) {
1116 if (!msg->controls_decoded[i] &&
1117 msg->controls[i]->critical) {
1118 DEBUG(3, ("ldapsrv_do_call: Critical extension %s is not known to this server\n",
1119 msg->controls[i]->oid));
1120 return ldapsrv_unwilling(call, LDAP_UNAVAILABLE_CRITICAL_EXTENSION);
1121 }
1122 }
1123
1124 switch(call->request->type) {
1125 case LDAP_TAG_BindRequest:
1126 return ldapsrv_BindRequest(call);
1127 case LDAP_TAG_UnbindRequest:
1128 return ldapsrv_UnbindRequest(call);
1129 case LDAP_TAG_SearchRequest:
1130 return ldapsrv_SearchRequest(call);
1131 case LDAP_TAG_ModifyRequest:
1132 return ldapsrv_ModifyRequest(call);
1133 case LDAP_TAG_AddRequest:
1134 return ldapsrv_AddRequest(call);
1135 case LDAP_TAG_DelRequest:
1136 return ldapsrv_DelRequest(call);
1137 case LDAP_TAG_ModifyDNRequest:
1138 return ldapsrv_ModifyDNRequest(call);
1139 case LDAP_TAG_CompareRequest:
1140 return ldapsrv_CompareRequest(call);
1141 case LDAP_TAG_AbandonRequest:
1142 return ldapsrv_AbandonRequest(call);
1143 case LDAP_TAG_ExtendedRequest:
1144 return ldapsrv_ExtendedRequest(call);
1145 default:
1146 return ldapsrv_unwilling(call, 2);
1147 }
1148 }
Samba GIT mirror