2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Matthias Dieter Wallnöfer 2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "ldap_server/ldap_server.h"
23 #include "../lib/util/dlinklist.h"
24 #include "auth/credentials/credentials.h"
25 #include "auth/gensec/gensec.h"
26 #include "param/param.h"
27 #include "smbd/service_stream.h"
28 #include "dsdb/samdb/samdb.h"
29 #include <ldb_errors.h>
30 #include <ldb_module.h>
33 static int map_ldb_error(TALLOC_CTX
*mem_ctx
, int ldb_err
,
34 const char *add_err_string
, const char **errstring
)
38 /* Certain LDB modules need to return very special WERROR codes. Proof
39 * for them here and if they exist skip the rest of the mapping. */
40 if (add_err_string
!= NULL
) {
42 strtol(add_err_string
, &endptr
, 16);
43 if (endptr
!= add_err_string
) {
44 *errstring
= add_err_string
;
49 /* Otherwise we calculate here a generic, but appropriate WERROR. */
55 case LDB_ERR_OPERATIONS_ERROR
:
56 err
= WERR_DS_OPERATIONS_ERROR
;
58 case LDB_ERR_PROTOCOL_ERROR
:
59 err
= WERR_DS_PROTOCOL_ERROR
;
61 case LDB_ERR_TIME_LIMIT_EXCEEDED
:
62 err
= WERR_DS_TIMELIMIT_EXCEEDED
;
64 case LDB_ERR_SIZE_LIMIT_EXCEEDED
:
65 err
= WERR_DS_SIZELIMIT_EXCEEDED
;
67 case LDB_ERR_COMPARE_FALSE
:
68 err
= WERR_DS_COMPARE_FALSE
;
70 case LDB_ERR_COMPARE_TRUE
:
71 err
= WERR_DS_COMPARE_TRUE
;
73 case LDB_ERR_AUTH_METHOD_NOT_SUPPORTED
:
74 err
= WERR_DS_AUTH_METHOD_NOT_SUPPORTED
;
76 case LDB_ERR_STRONG_AUTH_REQUIRED
:
77 err
= WERR_DS_STRONG_AUTH_REQUIRED
;
79 case LDB_ERR_REFERRAL
:
80 err
= WERR_DS_REFERRAL
;
82 case LDB_ERR_ADMIN_LIMIT_EXCEEDED
:
83 err
= WERR_DS_ADMIN_LIMIT_EXCEEDED
;
85 case LDB_ERR_UNSUPPORTED_CRITICAL_EXTENSION
:
86 err
= WERR_DS_UNAVAILABLE_CRIT_EXTENSION
;
88 case LDB_ERR_CONFIDENTIALITY_REQUIRED
:
89 err
= WERR_DS_CONFIDENTIALITY_REQUIRED
;
91 case LDB_ERR_SASL_BIND_IN_PROGRESS
:
94 case LDB_ERR_NO_SUCH_ATTRIBUTE
:
95 err
= WERR_DS_NO_ATTRIBUTE_OR_VALUE
;
97 case LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE
:
98 err
= WERR_DS_ATTRIBUTE_TYPE_UNDEFINED
;
100 case LDB_ERR_INAPPROPRIATE_MATCHING
:
101 err
= WERR_DS_INAPPROPRIATE_MATCHING
;
103 case LDB_ERR_CONSTRAINT_VIOLATION
:
104 err
= WERR_DS_CONSTRAINT_VIOLATION
;
106 case LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS
:
107 err
= WERR_DS_ATTRIBUTE_OR_VALUE_EXISTS
;
109 case LDB_ERR_INVALID_ATTRIBUTE_SYNTAX
:
110 err
= WERR_DS_INVALID_ATTRIBUTE_SYNTAX
;
112 case LDB_ERR_NO_SUCH_OBJECT
:
113 err
= WERR_DS_NO_SUCH_OBJECT
;
115 case LDB_ERR_ALIAS_PROBLEM
:
116 err
= WERR_DS_ALIAS_PROBLEM
;
118 case LDB_ERR_INVALID_DN_SYNTAX
:
119 err
= WERR_DS_INVALID_DN_SYNTAX
;
121 case LDB_ERR_ALIAS_DEREFERENCING_PROBLEM
:
122 err
= WERR_DS_ALIAS_DEREF_PROBLEM
;
124 case LDB_ERR_INAPPROPRIATE_AUTHENTICATION
:
125 err
= WERR_DS_INAPPROPRIATE_AUTH
;
127 case LDB_ERR_INVALID_CREDENTIALS
:
128 err
= WERR_ACCESS_DENIED
;
130 case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
:
131 err
= WERR_DS_INSUFF_ACCESS_RIGHTS
;
136 case LDB_ERR_UNAVAILABLE
:
137 err
= WERR_DS_UNAVAILABLE
;
139 case LDB_ERR_UNWILLING_TO_PERFORM
:
140 err
= WERR_DS_UNWILLING_TO_PERFORM
;
142 case LDB_ERR_LOOP_DETECT
:
143 err
= WERR_DS_LOOP_DETECT
;
145 case LDB_ERR_NAMING_VIOLATION
:
146 err
= WERR_DS_NAMING_VIOLATION
;
148 case LDB_ERR_OBJECT_CLASS_VIOLATION
:
149 err
= WERR_DS_OBJ_CLASS_VIOLATION
;
151 case LDB_ERR_NOT_ALLOWED_ON_NON_LEAF
:
152 err
= WERR_DS_CANT_ON_NON_LEAF
;
154 case LDB_ERR_NOT_ALLOWED_ON_RDN
:
155 err
= WERR_DS_CANT_ON_RDN
;
157 case LDB_ERR_ENTRY_ALREADY_EXISTS
:
158 err
= WERR_DS_OBJ_STRING_NAME_EXISTS
;
160 case LDB_ERR_OBJECT_CLASS_MODS_PROHIBITED
:
161 err
= WERR_DS_CANT_MOD_OBJ_CLASS
;
163 case LDB_ERR_AFFECTS_MULTIPLE_DSAS
:
164 err
= WERR_DS_AFFECTS_MULTIPLE_DSAS
;
167 err
= WERR_DS_GENERIC_ERROR
;
171 *errstring
= talloc_asprintf(mem_ctx
, "%08X: %s", W_ERROR_V(err
),
172 add_err_string
!= NULL
? add_err_string
: ldb_strerror(ldb_err
));
174 /* result is 1:1 for now */
179 connect to the sam database
181 NTSTATUS
ldapsrv_backend_Init(struct ldapsrv_connection
*conn
)
183 conn
->ldb
= samdb_connect(conn
,
184 conn
->connection
->event
.ctx
,
187 conn
->global_catalog
? LDB_FLG_RDONLY
: 0);
188 if (conn
->ldb
== NULL
) {
189 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
192 if (conn
->server_credentials
) {
193 char **sasl_mechs
= NULL
;
194 struct gensec_security_ops
**backends
= gensec_security_all();
195 struct gensec_security_ops
**ops
196 = gensec_use_kerberos_mechs(conn
, backends
, conn
->server_credentials
);
197 unsigned int i
, j
= 0;
198 for (i
= 0; ops
&& ops
[i
]; i
++) {
199 if (!lpcfg_parm_bool(conn
->lp_ctx
, NULL
, "gensec", ops
[i
]->name
, ops
[i
]->enabled
))
202 if (ops
[i
]->sasl_name
&& ops
[i
]->server_start
) {
203 char *sasl_name
= talloc_strdup(conn
, ops
[i
]->sasl_name
);
206 return NT_STATUS_NO_MEMORY
;
208 sasl_mechs
= talloc_realloc(conn
, sasl_mechs
, char *, j
+ 2);
210 return NT_STATUS_NO_MEMORY
;
212 sasl_mechs
[j
] = sasl_name
;
213 talloc_steal(sasl_mechs
, sasl_name
);
214 sasl_mechs
[j
+1] = NULL
;
218 talloc_unlink(conn
, ops
);
220 /* ldb can have a different lifetime to conn, so we
221 need to ensure that sasl_mechs lives as long as the
223 talloc_steal(conn
->ldb
, sasl_mechs
);
225 ldb_set_opaque(conn
->ldb
, "supportedSASLMechanisms", sasl_mechs
);
228 ldb_set_opaque(conn
->ldb
, "remoteAddress",
229 conn
->connection
->remote_address
);
234 struct ldapsrv_reply
*ldapsrv_init_reply(struct ldapsrv_call
*call
, uint8_t type
)
236 struct ldapsrv_reply
*reply
;
238 reply
= talloc(call
, struct ldapsrv_reply
);
242 reply
->msg
= talloc(reply
, struct ldap_message
);
243 if (reply
->msg
== NULL
) {
248 reply
->msg
->messageid
= call
->request
->messageid
;
249 reply
->msg
->type
= type
;
250 reply
->msg
->controls
= NULL
;
255 void ldapsrv_queue_reply(struct ldapsrv_call
*call
, struct ldapsrv_reply
*reply
)
257 DLIST_ADD_END(call
->replies
, reply
, struct ldapsrv_reply
*);
260 static NTSTATUS
ldapsrv_unwilling(struct ldapsrv_call
*call
, int error
)
262 struct ldapsrv_reply
*reply
;
263 struct ldap_ExtendedResponse
*r
;
265 DEBUG(10,("Unwilling type[%d] id[%d]\n", call
->request
->type
, call
->request
->messageid
));
267 reply
= ldapsrv_init_reply(call
, LDAP_TAG_ExtendedResponse
);
269 return NT_STATUS_NO_MEMORY
;
272 r
= &reply
->msg
->r
.ExtendedResponse
;
273 r
->response
.resultcode
= error
;
274 r
->response
.dn
= NULL
;
275 r
->response
.errormessage
= NULL
;
276 r
->response
.referral
= NULL
;
280 ldapsrv_queue_reply(call
, reply
);
284 static int ldapsrv_add_with_controls(struct ldapsrv_call
*call
,
285 const struct ldb_message
*message
,
286 struct ldb_control
**controls
,
289 struct ldb_context
*ldb
= call
->conn
->ldb
;
290 struct ldb_request
*req
;
293 ret
= ldb_msg_sanity_check(ldb
, message
);
294 if (ret
!= LDB_SUCCESS
) {
298 ret
= ldb_build_add_req(&req
, ldb
, ldb
,
302 ldb_modify_default_callback
,
305 if (ret
!= LDB_SUCCESS
) return ret
;
307 if (call
->conn
->global_catalog
) {
308 return ldb_error(ldb
, LDB_ERR_UNWILLING_TO_PERFORM
, "modify forbidden on global catalog port");
310 ldb_request_add_control(req
, DSDB_CONTROL_NO_GLOBAL_CATALOG
, false, NULL
);
312 ret
= ldb_transaction_start(ldb
);
313 if (ret
!= LDB_SUCCESS
) {
317 if (!call
->conn
->is_privileged
) {
318 ldb_req_mark_untrusted(req
);
321 LDB_REQ_SET_LOCATION(req
);
323 ret
= ldb_request(ldb
, req
);
324 if (ret
== LDB_SUCCESS
) {
325 ret
= ldb_wait(req
->handle
, LDB_WAIT_ALL
);
328 if (ret
== LDB_SUCCESS
) {
329 ret
= ldb_transaction_commit(ldb
);
332 ldb_transaction_cancel(ldb
);
339 /* create and execute a modify request */
340 static int ldapsrv_mod_with_controls(struct ldapsrv_call
*call
,
341 const struct ldb_message
*message
,
342 struct ldb_control
**controls
,
345 struct ldb_context
*ldb
= call
->conn
->ldb
;
346 struct ldb_request
*req
;
349 ret
= ldb_msg_sanity_check(ldb
, message
);
350 if (ret
!= LDB_SUCCESS
) {
354 ret
= ldb_build_mod_req(&req
, ldb
, ldb
,
358 ldb_modify_default_callback
,
361 if (ret
!= LDB_SUCCESS
) {
365 if (call
->conn
->global_catalog
) {
366 return ldb_error(ldb
, LDB_ERR_UNWILLING_TO_PERFORM
, "modify forbidden on global catalog port");
368 ldb_request_add_control(req
, DSDB_CONTROL_NO_GLOBAL_CATALOG
, false, NULL
);
370 ret
= ldb_transaction_start(ldb
);
371 if (ret
!= LDB_SUCCESS
) {
375 if (!call
->conn
->is_privileged
) {
376 ldb_req_mark_untrusted(req
);
379 LDB_REQ_SET_LOCATION(req
);
381 ret
= ldb_request(ldb
, req
);
382 if (ret
== LDB_SUCCESS
) {
383 ret
= ldb_wait(req
->handle
, LDB_WAIT_ALL
);
386 if (ret
== LDB_SUCCESS
) {
387 ret
= ldb_transaction_commit(ldb
);
390 ldb_transaction_cancel(ldb
);
397 /* create and execute a delete request */
398 static int ldapsrv_del_with_controls(struct ldapsrv_call
*call
,
400 struct ldb_control
**controls
,
403 struct ldb_context
*ldb
= call
->conn
->ldb
;
404 struct ldb_request
*req
;
407 ret
= ldb_build_del_req(&req
, ldb
, ldb
,
411 ldb_modify_default_callback
,
414 if (ret
!= LDB_SUCCESS
) return ret
;
416 if (call
->conn
->global_catalog
) {
417 return ldb_error(ldb
, LDB_ERR_UNWILLING_TO_PERFORM
, "modify forbidden on global catalog port");
419 ldb_request_add_control(req
, DSDB_CONTROL_NO_GLOBAL_CATALOG
, false, NULL
);
421 ret
= ldb_transaction_start(ldb
);
422 if (ret
!= LDB_SUCCESS
) {
426 if (!call
->conn
->is_privileged
) {
427 ldb_req_mark_untrusted(req
);
430 LDB_REQ_SET_LOCATION(req
);
432 ret
= ldb_request(ldb
, req
);
433 if (ret
== LDB_SUCCESS
) {
434 ret
= ldb_wait(req
->handle
, LDB_WAIT_ALL
);
437 if (ret
== LDB_SUCCESS
) {
438 ret
= ldb_transaction_commit(ldb
);
441 ldb_transaction_cancel(ldb
);
448 static int ldapsrv_rename_with_controls(struct ldapsrv_call
*call
,
449 struct ldb_dn
*olddn
,
450 struct ldb_dn
*newdn
,
451 struct ldb_control
**controls
,
454 struct ldb_context
*ldb
= call
->conn
->ldb
;
455 struct ldb_request
*req
;
458 ret
= ldb_build_rename_req(&req
, ldb
, ldb
,
463 ldb_modify_default_callback
,
466 if (ret
!= LDB_SUCCESS
) return ret
;
468 if (call
->conn
->global_catalog
) {
469 return ldb_error(ldb
, LDB_ERR_UNWILLING_TO_PERFORM
, "modify forbidden on global catalog port");
471 ldb_request_add_control(req
, DSDB_CONTROL_NO_GLOBAL_CATALOG
, false, NULL
);
473 ret
= ldb_transaction_start(ldb
);
474 if (ret
!= LDB_SUCCESS
) {
478 if (!call
->conn
->is_privileged
) {
479 ldb_req_mark_untrusted(req
);
482 LDB_REQ_SET_LOCATION(req
);
484 ret
= ldb_request(ldb
, req
);
485 if (ret
== LDB_SUCCESS
) {
486 ret
= ldb_wait(req
->handle
, LDB_WAIT_ALL
);
489 if (ret
== LDB_SUCCESS
) {
490 ret
= ldb_transaction_commit(ldb
);
493 ldb_transaction_cancel(ldb
);
500 static NTSTATUS
ldapsrv_SearchRequest(struct ldapsrv_call
*call
)
502 struct ldap_SearchRequest
*req
= &call
->request
->r
.SearchRequest
;
503 struct ldap_SearchResEntry
*ent
;
504 struct ldap_Result
*done
;
505 struct ldapsrv_reply
*ent_r
, *done_r
;
506 TALLOC_CTX
*local_ctx
;
507 struct ldb_context
*samdb
= talloc_get_type(call
->conn
->ldb
, struct ldb_context
);
508 struct ldb_dn
*basedn
;
509 struct ldb_result
*res
= NULL
;
510 struct ldb_request
*lreq
;
511 struct ldb_control
*search_control
;
512 struct ldb_search_options_control
*search_options
;
513 struct ldb_control
*extended_dn_control
;
514 struct ldb_extended_dn_control
*extended_dn_decoded
= NULL
;
515 enum ldb_scope scope
= LDB_SCOPE_DEFAULT
;
516 const char **attrs
= NULL
;
517 const char *scope_str
, *errstr
= NULL
;
518 int success_limit
= 1;
522 int extended_type
= 1;
524 DEBUG(10, ("SearchRequest"));
525 DEBUGADD(10, (" basedn: %s", req
->basedn
));
526 DEBUGADD(10, (" filter: %s\n", ldb_filter_from_tree(call
, req
->tree
)));
528 local_ctx
= talloc_new(call
);
529 NT_STATUS_HAVE_NO_MEMORY(local_ctx
);
531 basedn
= ldb_dn_new(local_ctx
, samdb
, req
->basedn
);
532 NT_STATUS_HAVE_NO_MEMORY(basedn
);
534 DEBUG(10, ("SearchRequest: basedn: [%s]\n", req
->basedn
));
535 DEBUG(10, ("SearchRequest: filter: [%s]\n", ldb_filter_from_tree(call
, req
->tree
)));
537 switch (req
->scope
) {
538 case LDAP_SEARCH_SCOPE_BASE
:
540 scope
= LDB_SCOPE_BASE
;
543 case LDAP_SEARCH_SCOPE_SINGLE
:
545 scope
= LDB_SCOPE_ONELEVEL
;
548 case LDAP_SEARCH_SCOPE_SUB
:
550 scope
= LDB_SCOPE_SUBTREE
;
554 result
= LDAP_PROTOCOL_ERROR
;
555 map_ldb_error(local_ctx
, LDB_ERR_PROTOCOL_ERROR
, NULL
,
557 errstr
= talloc_asprintf(local_ctx
,
558 "%s. Invalid scope", errstr
);
561 DEBUG(10,("SearchRequest: scope: [%s]\n", scope_str
));
563 if (req
->num_attributes
>= 1) {
564 attrs
= talloc_array(local_ctx
, const char *, req
->num_attributes
+1);
565 NT_STATUS_HAVE_NO_MEMORY(attrs
);
567 for (i
=0; i
< req
->num_attributes
; i
++) {
568 DEBUG(10,("SearchRequest: attrs: [%s]\n",req
->attributes
[i
]));
569 attrs
[i
] = req
->attributes
[i
];
574 DEBUG(5,("ldb_request %s dn=%s filter=%s\n",
575 scope_str
, req
->basedn
, ldb_filter_from_tree(call
, req
->tree
)));
577 res
= talloc_zero(local_ctx
, struct ldb_result
);
578 NT_STATUS_HAVE_NO_MEMORY(res
);
580 ldb_ret
= ldb_build_search_req_ex(&lreq
, samdb
, local_ctx
,
583 call
->request
->controls
,
584 res
, ldb_search_default_callback
,
587 if (ldb_ret
!= LDB_SUCCESS
) {
591 if (call
->conn
->global_catalog
) {
592 search_control
= ldb_request_get_control(lreq
, LDB_CONTROL_SEARCH_OPTIONS_OID
);
594 search_options
= NULL
;
595 if (search_control
) {
596 search_options
= talloc_get_type(search_control
->data
, struct ldb_search_options_control
);
597 search_options
->search_options
|= LDB_SEARCH_OPTION_PHANTOM_ROOT
;
599 search_options
= talloc(lreq
, struct ldb_search_options_control
);
600 NT_STATUS_HAVE_NO_MEMORY(search_options
);
601 search_options
->search_options
= LDB_SEARCH_OPTION_PHANTOM_ROOT
;
602 ldb_request_add_control(lreq
, LDB_CONTROL_SEARCH_OPTIONS_OID
, false, search_options
);
605 ldb_request_add_control(lreq
, DSDB_CONTROL_NO_GLOBAL_CATALOG
, false, NULL
);
608 extended_dn_control
= ldb_request_get_control(lreq
, LDB_CONTROL_EXTENDED_DN_OID
);
610 if (extended_dn_control
) {
611 if (extended_dn_control
->data
) {
612 extended_dn_decoded
= talloc_get_type(extended_dn_control
->data
, struct ldb_extended_dn_control
);
613 extended_type
= extended_dn_decoded
->type
;
619 ldb_set_timeout(samdb
, lreq
, req
->timelimit
);
621 if (!call
->conn
->is_privileged
) {
622 ldb_req_mark_untrusted(lreq
);
625 LDB_REQ_SET_LOCATION(lreq
);
627 ldb_ret
= ldb_request(samdb
, lreq
);
629 if (ldb_ret
!= LDB_SUCCESS
) {
633 ldb_ret
= ldb_wait(lreq
->handle
, LDB_WAIT_ALL
);
635 if (ldb_ret
== LDB_SUCCESS
) {
636 for (i
= 0; i
< res
->count
; i
++) {
637 ent_r
= ldapsrv_init_reply(call
, LDAP_TAG_SearchResultEntry
);
638 NT_STATUS_HAVE_NO_MEMORY(ent_r
);
640 /* Better to have the whole message kept here,
641 * than to find someone further up didn't put
642 * a value in the right spot in the talloc tree */
643 talloc_steal(ent_r
, res
->msgs
[i
]);
645 ent
= &ent_r
->msg
->r
.SearchResultEntry
;
646 ent
->dn
= ldb_dn_get_extended_linearized(ent_r
, res
->msgs
[i
]->dn
, extended_type
);
647 ent
->num_attributes
= 0;
648 ent
->attributes
= NULL
;
649 if (res
->msgs
[i
]->num_elements
== 0) {
652 ent
->num_attributes
= res
->msgs
[i
]->num_elements
;
653 ent
->attributes
= talloc_array(ent_r
, struct ldb_message_element
, ent
->num_attributes
);
654 NT_STATUS_HAVE_NO_MEMORY(ent
->attributes
);
655 for (j
=0; j
< ent
->num_attributes
; j
++) {
656 ent
->attributes
[j
].name
= res
->msgs
[i
]->elements
[j
].name
;
657 ent
->attributes
[j
].num_values
= 0;
658 ent
->attributes
[j
].values
= NULL
;
659 if (req
->attributesonly
&& (res
->msgs
[i
]->elements
[j
].num_values
== 0)) {
662 ent
->attributes
[j
].num_values
= res
->msgs
[i
]->elements
[j
].num_values
;
663 ent
->attributes
[j
].values
= res
->msgs
[i
]->elements
[j
].values
;
666 ldapsrv_queue_reply(call
, ent_r
);
669 /* Send back referrals if they do exist (search operations) */
670 if (res
->refs
!= NULL
) {
672 struct ldap_SearchResRef
*ent_ref
;
674 for (ref
= res
->refs
; *ref
!= NULL
; ++ref
) {
675 ent_r
= ldapsrv_init_reply(call
, LDAP_TAG_SearchResultReference
);
676 NT_STATUS_HAVE_NO_MEMORY(ent_r
);
678 /* Better to have the whole referrals kept here,
679 * than to find someone further up didn't put
680 * a value in the right spot in the talloc tree
682 talloc_steal(ent_r
, *ref
);
684 ent_ref
= &ent_r
->msg
->r
.SearchResultReference
;
685 ent_ref
->referral
= *ref
;
687 ldapsrv_queue_reply(call
, ent_r
);
693 done_r
= ldapsrv_init_reply(call
, LDAP_TAG_SearchResultDone
);
694 NT_STATUS_HAVE_NO_MEMORY(done_r
);
696 done
= &done_r
->msg
->r
.SearchResultDone
;
698 done
->referral
= NULL
;
701 } else if (ldb_ret
== LDB_SUCCESS
) {
702 if (res
->count
>= success_limit
) {
703 DEBUG(10,("SearchRequest: results: [%d]\n", res
->count
));
704 result
= LDAP_SUCCESS
;
708 done_r
->msg
->controls
= res
->controls
;
709 talloc_steal(done_r
, res
->controls
);
712 DEBUG(10,("SearchRequest: error\n"));
713 result
= map_ldb_error(local_ctx
, ldb_ret
, ldb_errstring(samdb
),
717 done
->resultcode
= result
;
718 done
->errormessage
= (errstr
?talloc_strdup(done_r
, errstr
):NULL
);
720 talloc_free(local_ctx
);
722 ldapsrv_queue_reply(call
, done_r
);
726 static NTSTATUS
ldapsrv_ModifyRequest(struct ldapsrv_call
*call
)
728 struct ldap_ModifyRequest
*req
= &call
->request
->r
.ModifyRequest
;
729 struct ldap_Result
*modify_result
;
730 struct ldapsrv_reply
*modify_reply
;
731 TALLOC_CTX
*local_ctx
;
732 struct ldb_context
*samdb
= call
->conn
->ldb
;
733 struct ldb_message
*msg
= NULL
;
735 const char *errstr
= NULL
;
736 int result
= LDAP_SUCCESS
;
739 struct ldb_result
*res
= NULL
;
741 DEBUG(10, ("ModifyRequest"));
742 DEBUGADD(10, (" dn: %s\n", req
->dn
));
744 local_ctx
= talloc_named(call
, 0, "ModifyRequest local memory context");
745 NT_STATUS_HAVE_NO_MEMORY(local_ctx
);
747 dn
= ldb_dn_new(local_ctx
, samdb
, req
->dn
);
748 NT_STATUS_HAVE_NO_MEMORY(dn
);
750 DEBUG(10, ("ModifyRequest: dn: [%s]\n", req
->dn
));
752 msg
= talloc(local_ctx
, struct ldb_message
);
753 NT_STATUS_HAVE_NO_MEMORY(msg
);
756 msg
->num_elements
= 0;
757 msg
->elements
= NULL
;
759 if (req
->num_mods
> 0) {
760 msg
->num_elements
= req
->num_mods
;
761 msg
->elements
= talloc_array(msg
, struct ldb_message_element
, req
->num_mods
);
762 NT_STATUS_HAVE_NO_MEMORY(msg
->elements
);
764 for (i
=0; i
< msg
->num_elements
; i
++) {
765 msg
->elements
[i
].name
= discard_const_p(char, req
->mods
[i
].attrib
.name
);
766 msg
->elements
[i
].num_values
= 0;
767 msg
->elements
[i
].values
= NULL
;
769 switch (req
->mods
[i
].type
) {
771 result
= LDAP_PROTOCOL_ERROR
;
772 map_ldb_error(local_ctx
,
773 LDB_ERR_PROTOCOL_ERROR
, NULL
, &errstr
);
774 errstr
= talloc_asprintf(local_ctx
,
775 "%s. Invalid LDAP_MODIFY_* type", errstr
);
777 case LDAP_MODIFY_ADD
:
778 msg
->elements
[i
].flags
= LDB_FLAG_MOD_ADD
;
780 case LDAP_MODIFY_DELETE
:
781 msg
->elements
[i
].flags
= LDB_FLAG_MOD_DELETE
;
783 case LDAP_MODIFY_REPLACE
:
784 msg
->elements
[i
].flags
= LDB_FLAG_MOD_REPLACE
;
788 msg
->elements
[i
].num_values
= req
->mods
[i
].attrib
.num_values
;
789 if (msg
->elements
[i
].num_values
> 0) {
790 msg
->elements
[i
].values
= talloc_array(msg
->elements
, struct ldb_val
,
791 msg
->elements
[i
].num_values
);
792 NT_STATUS_HAVE_NO_MEMORY(msg
->elements
[i
].values
);
794 for (j
=0; j
< msg
->elements
[i
].num_values
; j
++) {
795 msg
->elements
[i
].values
[j
].length
= req
->mods
[i
].attrib
.values
[j
].length
;
796 msg
->elements
[i
].values
[j
].data
= req
->mods
[i
].attrib
.values
[j
].data
;
803 modify_reply
= ldapsrv_init_reply(call
, LDAP_TAG_ModifyResponse
);
804 NT_STATUS_HAVE_NO_MEMORY(modify_reply
);
806 if (result
== LDAP_SUCCESS
) {
807 res
= talloc_zero(local_ctx
, struct ldb_result
);
808 NT_STATUS_HAVE_NO_MEMORY(res
);
809 ldb_ret
= ldapsrv_mod_with_controls(call
, msg
, call
->request
->controls
, res
);
810 result
= map_ldb_error(local_ctx
, ldb_ret
, ldb_errstring(samdb
),
814 modify_result
= &modify_reply
->msg
->r
.ModifyResponse
;
815 modify_result
->dn
= NULL
;
816 if ((res
!= NULL
) && (res
->refs
!= NULL
)) {
817 modify_result
->resultcode
= map_ldb_error(local_ctx
,
820 modify_result
->errormessage
= (errstr
?talloc_strdup(modify_reply
, errstr
):NULL
);
821 modify_result
->referral
= talloc_strdup(call
, *res
->refs
);
823 modify_result
->resultcode
= result
;
824 modify_result
->errormessage
= (errstr
?talloc_strdup(modify_reply
, errstr
):NULL
);
825 modify_result
->referral
= NULL
;
827 talloc_free(local_ctx
);
829 ldapsrv_queue_reply(call
, modify_reply
);
834 static NTSTATUS
ldapsrv_AddRequest(struct ldapsrv_call
*call
)
836 struct ldap_AddRequest
*req
= &call
->request
->r
.AddRequest
;
837 struct ldap_Result
*add_result
;
838 struct ldapsrv_reply
*add_reply
;
839 TALLOC_CTX
*local_ctx
;
840 struct ldb_context
*samdb
= call
->conn
->ldb
;
841 struct ldb_message
*msg
= NULL
;
843 const char *errstr
= NULL
;
844 int result
= LDAP_SUCCESS
;
847 struct ldb_result
*res
= NULL
;
849 DEBUG(10, ("AddRequest"));
850 DEBUGADD(10, (" dn: %s\n", req
->dn
));
852 local_ctx
= talloc_named(call
, 0, "AddRequest local memory context");
853 NT_STATUS_HAVE_NO_MEMORY(local_ctx
);
855 dn
= ldb_dn_new(local_ctx
, samdb
, req
->dn
);
856 NT_STATUS_HAVE_NO_MEMORY(dn
);
858 DEBUG(10, ("AddRequest: dn: [%s]\n", req
->dn
));
860 msg
= talloc(local_ctx
, struct ldb_message
);
861 NT_STATUS_HAVE_NO_MEMORY(msg
);
864 msg
->num_elements
= 0;
865 msg
->elements
= NULL
;
867 if (req
->num_attributes
> 0) {
868 msg
->num_elements
= req
->num_attributes
;
869 msg
->elements
= talloc_array(msg
, struct ldb_message_element
, msg
->num_elements
);
870 NT_STATUS_HAVE_NO_MEMORY(msg
->elements
);
872 for (i
=0; i
< msg
->num_elements
; i
++) {
873 msg
->elements
[i
].name
= discard_const_p(char, req
->attributes
[i
].name
);
874 msg
->elements
[i
].flags
= 0;
875 msg
->elements
[i
].num_values
= 0;
876 msg
->elements
[i
].values
= NULL
;
878 if (req
->attributes
[i
].num_values
> 0) {
879 msg
->elements
[i
].num_values
= req
->attributes
[i
].num_values
;
880 msg
->elements
[i
].values
= talloc_array(msg
->elements
, struct ldb_val
,
881 msg
->elements
[i
].num_values
);
882 NT_STATUS_HAVE_NO_MEMORY(msg
->elements
[i
].values
);
884 for (j
=0; j
< msg
->elements
[i
].num_values
; j
++) {
885 msg
->elements
[i
].values
[j
].length
= req
->attributes
[i
].values
[j
].length
;
886 msg
->elements
[i
].values
[j
].data
= req
->attributes
[i
].values
[j
].data
;
892 add_reply
= ldapsrv_init_reply(call
, LDAP_TAG_AddResponse
);
893 NT_STATUS_HAVE_NO_MEMORY(add_reply
);
895 if (result
== LDAP_SUCCESS
) {
896 res
= talloc_zero(local_ctx
, struct ldb_result
);
897 NT_STATUS_HAVE_NO_MEMORY(res
);
898 ldb_ret
= ldapsrv_add_with_controls(call
, msg
, call
->request
->controls
, res
);
899 result
= map_ldb_error(local_ctx
, ldb_ret
, ldb_errstring(samdb
),
903 add_result
= &add_reply
->msg
->r
.AddResponse
;
904 add_result
->dn
= NULL
;
905 if ((res
!= NULL
) && (res
->refs
!= NULL
)) {
906 add_result
->resultcode
= map_ldb_error(local_ctx
,
907 LDB_ERR_REFERRAL
, NULL
,
909 add_result
->errormessage
= (errstr
?talloc_strdup(add_reply
,errstr
):NULL
);
910 add_result
->referral
= talloc_strdup(call
, *res
->refs
);
912 add_result
->resultcode
= result
;
913 add_result
->errormessage
= (errstr
?talloc_strdup(add_reply
,errstr
):NULL
);
914 add_result
->referral
= NULL
;
916 talloc_free(local_ctx
);
918 ldapsrv_queue_reply(call
, add_reply
);
923 static NTSTATUS
ldapsrv_DelRequest(struct ldapsrv_call
*call
)
925 struct ldap_DelRequest
*req
= &call
->request
->r
.DelRequest
;
926 struct ldap_Result
*del_result
;
927 struct ldapsrv_reply
*del_reply
;
928 TALLOC_CTX
*local_ctx
;
929 struct ldb_context
*samdb
= call
->conn
->ldb
;
931 const char *errstr
= NULL
;
932 int result
= LDAP_SUCCESS
;
934 struct ldb_result
*res
= NULL
;
936 DEBUG(10, ("DelRequest"));
937 DEBUGADD(10, (" dn: %s\n", req
->dn
));
939 local_ctx
= talloc_named(call
, 0, "DelRequest local memory context");
940 NT_STATUS_HAVE_NO_MEMORY(local_ctx
);
942 dn
= ldb_dn_new(local_ctx
, samdb
, req
->dn
);
943 NT_STATUS_HAVE_NO_MEMORY(dn
);
945 DEBUG(10, ("DelRequest: dn: [%s]\n", req
->dn
));
947 del_reply
= ldapsrv_init_reply(call
, LDAP_TAG_DelResponse
);
948 NT_STATUS_HAVE_NO_MEMORY(del_reply
);
950 if (result
== LDAP_SUCCESS
) {
951 res
= talloc_zero(local_ctx
, struct ldb_result
);
952 NT_STATUS_HAVE_NO_MEMORY(res
);
953 ldb_ret
= ldapsrv_del_with_controls(call
, dn
, call
->request
->controls
, res
);
954 result
= map_ldb_error(local_ctx
, ldb_ret
, ldb_errstring(samdb
),
958 del_result
= &del_reply
->msg
->r
.DelResponse
;
959 del_result
->dn
= NULL
;
960 if ((res
!= NULL
) && (res
->refs
!= NULL
)) {
961 del_result
->resultcode
= map_ldb_error(local_ctx
,
962 LDB_ERR_REFERRAL
, NULL
,
964 del_result
->errormessage
= (errstr
?talloc_strdup(del_reply
,errstr
):NULL
);
965 del_result
->referral
= talloc_strdup(call
, *res
->refs
);
967 del_result
->resultcode
= result
;
968 del_result
->errormessage
= (errstr
?talloc_strdup(del_reply
,errstr
):NULL
);
969 del_result
->referral
= NULL
;
972 talloc_free(local_ctx
);
974 ldapsrv_queue_reply(call
, del_reply
);
978 static NTSTATUS
ldapsrv_ModifyDNRequest(struct ldapsrv_call
*call
)
980 struct ldap_ModifyDNRequest
*req
= &call
->request
->r
.ModifyDNRequest
;
981 struct ldap_Result
*modifydn
;
982 struct ldapsrv_reply
*modifydn_r
;
983 TALLOC_CTX
*local_ctx
;
984 struct ldb_context
*samdb
= call
->conn
->ldb
;
985 struct ldb_dn
*olddn
, *newdn
=NULL
, *newrdn
;
986 struct ldb_dn
*parentdn
= NULL
;
987 const char *errstr
= NULL
;
988 int result
= LDAP_SUCCESS
;
990 struct ldb_result
*res
= NULL
;
992 DEBUG(10, ("ModifyDNRequest"));
993 DEBUGADD(10, (" dn: %s", req
->dn
));
994 DEBUGADD(10, (" newrdn: %s\n", req
->newrdn
));
996 local_ctx
= talloc_named(call
, 0, "ModifyDNRequest local memory context");
997 NT_STATUS_HAVE_NO_MEMORY(local_ctx
);
999 olddn
= ldb_dn_new(local_ctx
, samdb
, req
->dn
);
1000 NT_STATUS_HAVE_NO_MEMORY(olddn
);
1002 newrdn
= ldb_dn_new(local_ctx
, samdb
, req
->newrdn
);
1003 NT_STATUS_HAVE_NO_MEMORY(newrdn
);
1005 DEBUG(10, ("ModifyDNRequest: olddn: [%s]\n", req
->dn
));
1006 DEBUG(10, ("ModifyDNRequest: newrdn: [%s]\n", req
->newrdn
));
1008 if (ldb_dn_get_comp_num(newrdn
) == 0) {
1009 result
= LDAP_PROTOCOL_ERROR
;
1010 map_ldb_error(local_ctx
, LDB_ERR_PROTOCOL_ERROR
, NULL
,
1015 if (ldb_dn_get_comp_num(newrdn
) > 1) {
1016 result
= LDAP_NAMING_VIOLATION
;
1017 map_ldb_error(local_ctx
, LDB_ERR_NAMING_VIOLATION
, NULL
,
1022 /* we can't handle the rename if we should not remove the old dn */
1023 if (!req
->deleteolddn
) {
1024 result
= LDAP_UNWILLING_TO_PERFORM
;
1025 map_ldb_error(local_ctx
, LDB_ERR_UNWILLING_TO_PERFORM
, NULL
,
1027 errstr
= talloc_asprintf(local_ctx
,
1028 "%s. Old RDN must be deleted", errstr
);
1032 if (req
->newsuperior
) {
1033 DEBUG(10, ("ModifyDNRequest: newsuperior: [%s]\n", req
->newsuperior
));
1034 parentdn
= ldb_dn_new(local_ctx
, samdb
, req
->newsuperior
);
1038 parentdn
= ldb_dn_get_parent(local_ctx
, olddn
);
1041 result
= LDAP_NO_SUCH_OBJECT
;
1042 map_ldb_error(local_ctx
, LDB_ERR_NO_SUCH_OBJECT
, NULL
, &errstr
);
1046 if ( ! ldb_dn_add_child(parentdn
, newrdn
)) {
1047 result
= LDAP_OTHER
;
1048 map_ldb_error(local_ctx
, LDB_ERR_OTHER
, NULL
, &errstr
);
1054 modifydn_r
= ldapsrv_init_reply(call
, LDAP_TAG_ModifyDNResponse
);
1055 NT_STATUS_HAVE_NO_MEMORY(modifydn_r
);
1057 if (result
== LDAP_SUCCESS
) {
1058 res
= talloc_zero(local_ctx
, struct ldb_result
);
1059 NT_STATUS_HAVE_NO_MEMORY(res
);
1060 ldb_ret
= ldapsrv_rename_with_controls(call
, olddn
, newdn
, call
->request
->controls
, res
);
1061 result
= map_ldb_error(local_ctx
, ldb_ret
, ldb_errstring(samdb
),
1065 modifydn
= &modifydn_r
->msg
->r
.ModifyDNResponse
;
1066 modifydn
->dn
= NULL
;
1067 if ((res
!= NULL
) && (res
->refs
!= NULL
)) {
1068 modifydn
->resultcode
= map_ldb_error(local_ctx
,
1069 LDB_ERR_REFERRAL
, NULL
,
1071 modifydn
->errormessage
= (errstr
?talloc_strdup(modifydn_r
,errstr
):NULL
);
1072 modifydn
->referral
= talloc_strdup(call
, *res
->refs
);
1074 modifydn
->resultcode
= result
;
1075 modifydn
->errormessage
= (errstr
?talloc_strdup(modifydn_r
,errstr
):NULL
);
1076 modifydn
->referral
= NULL
;
1079 talloc_free(local_ctx
);
1081 ldapsrv_queue_reply(call
, modifydn_r
);
1082 return NT_STATUS_OK
;
1085 static NTSTATUS
ldapsrv_CompareRequest(struct ldapsrv_call
*call
)
1087 struct ldap_CompareRequest
*req
= &call
->request
->r
.CompareRequest
;
1088 struct ldap_Result
*compare
;
1089 struct ldapsrv_reply
*compare_r
;
1090 TALLOC_CTX
*local_ctx
;
1091 struct ldb_context
*samdb
= call
->conn
->ldb
;
1092 struct ldb_result
*res
= NULL
;
1094 const char *attrs
[1];
1095 const char *errstr
= NULL
;
1096 const char *filter
= NULL
;
1097 int result
= LDAP_SUCCESS
;
1100 DEBUG(10, ("CompareRequest"));
1101 DEBUGADD(10, (" dn: %s\n", req
->dn
));
1103 local_ctx
= talloc_named(call
, 0, "CompareRequest local_memory_context");
1104 NT_STATUS_HAVE_NO_MEMORY(local_ctx
);
1106 dn
= ldb_dn_new(local_ctx
, samdb
, req
->dn
);
1107 NT_STATUS_HAVE_NO_MEMORY(dn
);
1109 DEBUG(10, ("CompareRequest: dn: [%s]\n", req
->dn
));
1110 filter
= talloc_asprintf(local_ctx
, "(%s=%*s)", req
->attribute
,
1111 (int)req
->value
.length
, req
->value
.data
);
1112 NT_STATUS_HAVE_NO_MEMORY(filter
);
1114 DEBUGADD(10, ("CompareRequest: attribute: [%s]\n", filter
));
1118 compare_r
= ldapsrv_init_reply(call
, LDAP_TAG_CompareResponse
);
1119 NT_STATUS_HAVE_NO_MEMORY(compare_r
);
1121 if (result
== LDAP_SUCCESS
) {
1122 ldb_ret
= ldb_search(samdb
, local_ctx
, &res
,
1123 dn
, LDB_SCOPE_BASE
, attrs
, "%s", filter
);
1124 if (ldb_ret
!= LDB_SUCCESS
) {
1125 result
= map_ldb_error(local_ctx
, ldb_ret
,
1126 ldb_errstring(samdb
), &errstr
);
1127 DEBUG(10,("CompareRequest: error: %s\n", errstr
));
1128 } else if (res
->count
== 0) {
1129 DEBUG(10,("CompareRequest: doesn't matched\n"));
1130 result
= LDAP_COMPARE_FALSE
;
1132 } else if (res
->count
== 1) {
1133 DEBUG(10,("CompareRequest: matched\n"));
1134 result
= LDAP_COMPARE_TRUE
;
1136 } else if (res
->count
> 1) {
1137 result
= LDAP_OTHER
;
1138 map_ldb_error(local_ctx
, LDB_ERR_OTHER
, NULL
, &errstr
);
1139 errstr
= talloc_asprintf(local_ctx
,
1140 "%s. Too many objects match!", errstr
);
1141 DEBUG(10,("CompareRequest: %d results: %s\n", res
->count
, errstr
));
1145 compare
= &compare_r
->msg
->r
.CompareResponse
;
1147 compare
->resultcode
= result
;
1148 compare
->errormessage
= (errstr
?talloc_strdup(compare_r
,errstr
):NULL
);
1149 compare
->referral
= NULL
;
1151 talloc_free(local_ctx
);
1153 ldapsrv_queue_reply(call
, compare_r
);
1154 return NT_STATUS_OK
;
1157 static NTSTATUS
ldapsrv_AbandonRequest(struct ldapsrv_call
*call
)
1159 /* struct ldap_AbandonRequest *req = &call->request.r.AbandonRequest;*/
1160 DEBUG(10, ("AbandonRequest\n"));
1161 return NT_STATUS_OK
;
1164 NTSTATUS
ldapsrv_do_call(struct ldapsrv_call
*call
)
1167 struct ldap_message
*msg
= call
->request
;
1168 struct ldb_context
*samdb
= call
->conn
->ldb
;
1171 /* Check for undecoded critical extensions */
1172 for (i
=0; msg
->controls
&& msg
->controls
[i
]; i
++) {
1173 if (!msg
->controls_decoded
[i
] &&
1174 msg
->controls
[i
]->critical
) {
1175 DEBUG(3, ("ldapsrv_do_call: Critical extension %s is not known to this server\n",
1176 msg
->controls
[i
]->oid
));
1177 return ldapsrv_unwilling(call
, LDAP_UNAVAILABLE_CRITICAL_EXTENSION
);
1181 switch(call
->request
->type
) {
1182 case LDAP_TAG_BindRequest
:
1183 return ldapsrv_BindRequest(call
);
1184 case LDAP_TAG_UnbindRequest
:
1185 return ldapsrv_UnbindRequest(call
);
1186 case LDAP_TAG_SearchRequest
:
1187 return ldapsrv_SearchRequest(call
);
1188 case LDAP_TAG_ModifyRequest
:
1189 status
= ldapsrv_ModifyRequest(call
);
1191 case LDAP_TAG_AddRequest
:
1192 status
= ldapsrv_AddRequest(call
);
1194 case LDAP_TAG_DelRequest
:
1195 return ldapsrv_DelRequest(call
);
1196 case LDAP_TAG_ModifyDNRequest
:
1197 return ldapsrv_ModifyDNRequest(call
);
1198 case LDAP_TAG_CompareRequest
:
1199 return ldapsrv_CompareRequest(call
);
1200 case LDAP_TAG_AbandonRequest
:
1201 return ldapsrv_AbandonRequest(call
);
1202 case LDAP_TAG_ExtendedRequest
:
1203 return ldapsrv_ExtendedRequest(call
);
1205 return ldapsrv_unwilling(call
, LDAP_PROTOCOL_ERROR
);
1208 if (NT_STATUS_IS_OK(status
)) {
1209 lastts
= (time_t *)ldb_get_opaque(samdb
, DSDB_OPAQUE_LAST_SCHEMA_UPDATE_MSG_OPAQUE_NAME
);
1210 if (lastts
&& !*lastts
) {
1211 DEBUG(10, ("Schema update now was requested, "
1212 "fullfilling the request ts = %d\n",
1215 * Just requesting the schema will do the trick
1216 * as the delay for reload is experied, we will have a reload
1217 * from the schema as expected as we are not yet in a transaction!
1219 dsdb_get_schema(samdb
, NULL
);
1220 *lastts
= time(NULL
);
1221 ldb_set_opaque(samdb
, DSDB_OPAQUE_LAST_SCHEMA_UPDATE_MSG_OPAQUE_NAME
, lastts
);