?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
dsdb: Fix CID 1034902 Dereference before null check
[Samba.git] / source4 / dsdb / samdb / ldb_modules / extended_dn_out.c
blobbdb35be46904f66ff04115a7a276f81166eb8def
1 /*
2 ldb database library
3
4 Copyright (C) Simo Sorce 2005-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2007-2009
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 /*
22 * Name: ldb
23 *
24 * Component: ldb extended dn control module
25 *
26 * Description: this module builds a special dn for returned search
27 * results, and fixes some other aspects of the result (returned case issues)
28 * values.
29 *
30 * Authors: Simo Sorce
31 * Andrew Bartlett
32 */
33
34 #include "includes.h"
35 #include <ldb.h>
36 #include <ldb_errors.h>
37 #include <ldb_module.h>
38 #include "libcli/security/security.h"
39 #include "librpc/gen_ndr/ndr_misc.h"
40 #include "librpc/gen_ndr/ndr_security.h"
41 #include "librpc/ndr/libndr.h"
42 #include "dsdb/samdb/samdb.h"
43 #include "dsdb/samdb/ldb_modules/util.h"
44
45 struct extended_dn_out_private {
46 bool dereference;
47 bool normalise;
48 struct dsdb_openldap_dereference_control *dereference_control;
49 const char **attrs;
50 };
51
52 /* Do the lazy init of the derererence control */
53
54 static int extended_dn_out_dereference_setup_control(struct ldb_context *ldb, struct extended_dn_out_private *p)
55 {
56 const struct dsdb_schema *schema;
57 struct dsdb_openldap_dereference_control *dereference_control;
58 struct dsdb_attribute *cur;
59
60 unsigned int i = 0;
61 if (p->dereference_control) {
62 return LDB_SUCCESS;
63 }
64
65 schema = dsdb_get_schema(ldb, p);
66 if (!schema) {
67 /* No schema on this DB (yet) */
68 return LDB_SUCCESS;
69 }
70
71 p->dereference_control = dereference_control
72 = talloc_zero(p, struct dsdb_openldap_dereference_control);
73
74 if (!p->dereference_control) {
75 return ldb_oom(ldb);
76 }
77
78 for (cur = schema->attributes; cur; cur = cur->next) {
79 if (cur->dn_format != DSDB_NORMAL_DN) {
80 continue;
81 }
82 dereference_control->dereference
83 = talloc_realloc(p, dereference_control->dereference,
84 struct dsdb_openldap_dereference *, i + 2);
85 if (!dereference_control->dereference) {
86 return ldb_oom(ldb);
87 }
88 dereference_control->dereference[i] = talloc(dereference_control->dereference,
89 struct dsdb_openldap_dereference);
90 if (!dereference_control->dereference[i]) {
91 return ldb_oom(ldb);
92 }
93 dereference_control->dereference[i]->source_attribute = cur->lDAPDisplayName;
94 dereference_control->dereference[i]->dereference_attribute = p->attrs;
95 i++;
96 dereference_control->dereference[i] = NULL;
97 }
98 return LDB_SUCCESS;
99 }
100
101 static char **copy_attrs(void *mem_ctx, const char * const * attrs)
102 {
103 char **nattrs;
104 unsigned int i, num;
105
106 for (num = 0; attrs[num]; num++);
107
108 nattrs = talloc_array(mem_ctx, char *, num + 1);
109 if (!nattrs) return NULL;
110
111 for(i = 0; i < num; i++) {
112 nattrs[i] = talloc_strdup(nattrs, attrs[i]);
113 if (!nattrs[i]) {
114 talloc_free(nattrs);
115 return NULL;
116 }
117 }
118 nattrs[i] = NULL;
119
120 return nattrs;
121 }
122
123 static bool add_attrs(void *mem_ctx, char ***attrs, const char *attr)
124 {
125 char **nattrs;
126 unsigned int num;
127
128 for (num = 0; (*attrs)[num]; num++);
129
130 nattrs = talloc_realloc(mem_ctx, *attrs, char *, num + 2);
131 if (!nattrs) return false;
132
133 *attrs = nattrs;
134
135 nattrs[num] = talloc_strdup(nattrs, attr);
136 if (!nattrs[num]) return false;
137
138 nattrs[num + 1] = NULL;
139
140 return true;
141 }
142
143 /* Inject the extended DN components, so the DN cn=Adminstrator,cn=users,dc=samba,dc=example,dc=com becomes
144 <GUID=541203ae-f7d6-47ef-8390-bfcf019f9583>;<SID=S-1-5-21-4177067393-1453636373-93818737-500>;cn=Adminstrator,cn=users,dc=samba,dc=example,dc=com */
145
146 static int inject_extended_dn_out(struct ldb_reply *ares,
147 struct ldb_context *ldb,
148 int type,
149 bool remove_guid,
150 bool remove_sid)
151 {
152 int ret;
153 const DATA_BLOB *guid_blob;
154 const DATA_BLOB *sid_blob;
155
156 guid_blob = ldb_msg_find_ldb_val(ares->message, "objectGUID");
157 sid_blob = ldb_msg_find_ldb_val(ares->message, "objectSid");
158
159 if (!guid_blob) {
160 ldb_set_errstring(ldb, "Did not find objectGUID to inject into extended DN");
161 return LDB_ERR_OPERATIONS_ERROR;
162 }
163
164 ret = ldb_dn_set_extended_component(ares->message->dn, "GUID", guid_blob);
165 if (ret != LDB_SUCCESS) {
166 return ret;
167 }
168 if (sid_blob) {
169 ret = ldb_dn_set_extended_component(ares->message->dn, "SID", sid_blob);
170 if (ret != LDB_SUCCESS) {
171 return ret;
172 }
173 }
174
175 if (remove_guid) {
176 ldb_msg_remove_attr(ares->message, "objectGUID");
177 }
178
179 if (sid_blob && remove_sid) {
180 ldb_msg_remove_attr(ares->message, "objectSid");
181 }
182
183 return LDB_SUCCESS;
184 }
185
186 static int handle_dereference_openldap(struct ldb_dn *dn,
187 struct dsdb_openldap_dereference_result **dereference_attrs,
188 const char *attr, const DATA_BLOB *val)
189 {
190 const struct ldb_val *entryUUIDblob, *sid_blob;
191 struct ldb_message fake_msg; /* easier to use routines that expect an ldb_message */
192 unsigned int j;
193
194 fake_msg.num_elements = 0;
195
196 /* Look for this attribute in the returned control */
197 for (j = 0; dereference_attrs && dereference_attrs[j]; j++) {
198 struct ldb_val source_dn = data_blob_string_const(dereference_attrs[j]->dereferenced_dn);
199 if (ldb_attr_cmp(dereference_attrs[j]->source_attribute, attr) == 0
200 && data_blob_cmp(&source_dn, val) == 0) {
201 fake_msg.num_elements = dereference_attrs[j]->num_attributes;
202 fake_msg.elements = dereference_attrs[j]->attributes;
203 break;
204 }
205 }
206 if (!fake_msg.num_elements) {
207 return LDB_SUCCESS;
208 }
209 /* Look for an OpenLDAP entryUUID */
210
211 entryUUIDblob = ldb_msg_find_ldb_val(&fake_msg, "entryUUID");
212 if (entryUUIDblob) {
213 NTSTATUS status;
214 struct ldb_val guid_blob;
215 struct GUID guid;
216
217 status = GUID_from_data_blob(entryUUIDblob, &guid);
218
219 if (!NT_STATUS_IS_OK(status)) {
220 return LDB_ERR_INVALID_DN_SYNTAX;
221 }
222 status = GUID_to_ndr_blob(&guid, dn, &guid_blob);
223 if (!NT_STATUS_IS_OK(status)) {
224 return LDB_ERR_INVALID_DN_SYNTAX;
225 }
226
227 ldb_dn_set_extended_component(dn, "GUID", &guid_blob);
228 }
229
230 sid_blob = ldb_msg_find_ldb_val(&fake_msg, "objectSid");
231
232 /* Look for the objectSid */
233 if (sid_blob) {
234 ldb_dn_set_extended_component(dn, "SID", sid_blob);
235 }
236 return LDB_SUCCESS;
237 }
238
239 static int handle_dereference_fds(struct ldb_dn *dn,
240 struct dsdb_openldap_dereference_result **dereference_attrs,
241 const char *attr, const DATA_BLOB *val)
242 {
243 const struct ldb_val *nsUniqueIdBlob, *sidBlob;
244 struct ldb_message fake_msg; /* easier to use routines that expect an ldb_message */
245 unsigned int j;
246
247 fake_msg.num_elements = 0;
248
249 /* Look for this attribute in the returned control */
250 for (j = 0; dereference_attrs && dereference_attrs[j]; j++) {
251 struct ldb_val source_dn = data_blob_string_const(dereference_attrs[j]->dereferenced_dn);
252 if (ldb_attr_cmp(dereference_attrs[j]->source_attribute, attr) == 0
253 && data_blob_cmp(&source_dn, val) == 0) {
254 fake_msg.num_elements = dereference_attrs[j]->num_attributes;
255 fake_msg.elements = dereference_attrs[j]->attributes;
256 break;
257 }
258 }
259 if (!fake_msg.num_elements) {
260 return LDB_SUCCESS;
261 }
262
263 /* Look for the nsUniqueId */
264
265 nsUniqueIdBlob = ldb_msg_find_ldb_val(&fake_msg, "nsUniqueId");
266 if (nsUniqueIdBlob) {
267 NTSTATUS status;
268 struct ldb_val guid_blob;
269 struct GUID guid;
270
271 status = NS_GUID_from_string((char *)nsUniqueIdBlob->data, &guid);
272
273 if (!NT_STATUS_IS_OK(status)) {
274 return LDB_ERR_INVALID_DN_SYNTAX;
275 }
276 status = GUID_to_ndr_blob(&guid, dn, &guid_blob);
277 if (!NT_STATUS_IS_OK(status)) {
278 return LDB_ERR_INVALID_DN_SYNTAX;
279 }
280
281 ldb_dn_set_extended_component(dn, "GUID", &guid_blob);
282 }
283
284 /* Look for the objectSid */
285
286 sidBlob = ldb_msg_find_ldb_val(&fake_msg, "sambaSID");
287 if (sidBlob) {
288 enum ndr_err_code ndr_err;
289
290 struct ldb_val sid_blob;
291 struct dom_sid *sid;
292
293 sid = dom_sid_parse_length(NULL, sidBlob);
294
295 if (sid == NULL) {
296 return LDB_ERR_INVALID_DN_SYNTAX;
297 }
298
299 ndr_err = ndr_push_struct_blob(&sid_blob, NULL, sid,
300 (ndr_push_flags_fn_t)ndr_push_dom_sid);
301 talloc_free(sid);
302 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
303 return LDB_ERR_INVALID_DN_SYNTAX;
304 }
305
306 ldb_dn_set_extended_component(dn, "SID", &sid_blob);
307 }
308 return LDB_SUCCESS;
309 }
310
311 /* search */
312 struct extended_search_context {
313 struct ldb_module *module;
314 const struct dsdb_schema *schema;
315 struct ldb_request *req;
316 bool inject;
317 bool remove_guid;
318 bool remove_sid;
319 int extended_type;
320 };
321
322
323 /*
324 fix one-way links to have the right string DN, to cope with
325 renames of the target
326 */
327 static int fix_one_way_link(struct extended_search_context *ac, struct ldb_dn *dn,
328 bool is_deleted_objects, bool *remove_value)
329 {
330 struct GUID guid;
331 NTSTATUS status;
332 int ret;
333 struct ldb_dn *real_dn;
334 uint32_t search_flags;
335 TALLOC_CTX *tmp_ctx = talloc_new(ac);
336 const char *attrs[] = { NULL };
337 struct ldb_result *res;
338
339 (*remove_value) = false;
340
341 status = dsdb_get_extended_dn_guid(dn, &guid, "GUID");
342 if (!NT_STATUS_IS_OK(status)) {
343 /* this is a strange DN that doesn't have a GUID! just
344 return the current DN string?? */
345 talloc_free(tmp_ctx);
346 return LDB_SUCCESS;
347 }
348
349 search_flags = DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SEARCH_ALL_PARTITIONS | DSDB_SEARCH_ONE_ONLY;
350
351 if (ldb_request_get_control(ac->req, LDB_CONTROL_SHOW_DEACTIVATED_LINK_OID) ||
352 is_deleted_objects) {
353 search_flags |= DSDB_SEARCH_SHOW_DELETED;
354 }
355
356 ret = dsdb_module_search(ac->module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
357 search_flags, ac->req, "objectguid=%s", GUID_string(tmp_ctx, &guid));
358 if (ret != LDB_SUCCESS || res->count != 1) {
359 /* if we can't resolve this GUID, then we don't
360 display the link. This could be a link to a NC that we don't
361 have, or it could be a link to a deleted object
362 */
363 (*remove_value) = true;
364 talloc_free(tmp_ctx);
365 return LDB_SUCCESS;
366 }
367 real_dn = res->msgs[0]->dn;
368
369 if (strcmp(ldb_dn_get_linearized(dn), ldb_dn_get_linearized(real_dn)) == 0) {
370 /* its already correct */
371 talloc_free(tmp_ctx);
372 return LDB_SUCCESS;
373 }
374
375 /* fix the DN by replacing its components with those from the
376 * real DN
377 */
378 if (!ldb_dn_replace_components(dn, real_dn)) {
379 talloc_free(tmp_ctx);
380 return ldb_operr(ldb_module_get_ctx(ac->module));
381 }
382 talloc_free(tmp_ctx);
383
384 return LDB_SUCCESS;
385 }
386
387
388 /*
389 this is called to post-process the results from the search
390 */
391 static int extended_callback(struct ldb_request *req, struct ldb_reply *ares,
392 int (*handle_dereference)(struct ldb_dn *dn,
393 struct dsdb_openldap_dereference_result **dereference_attrs,
394 const char *attr, const DATA_BLOB *val))
395 {
396 struct extended_search_context *ac;
397 struct ldb_control *control;
398 struct dsdb_openldap_dereference_result_control *dereference_control = NULL;
399 int ret;
400 unsigned int i, j;
401 struct ldb_message *msg;
402 struct extended_dn_out_private *p;
403 struct ldb_context *ldb;
404 bool have_reveal_control=false, checked_reveal_control=false;
405
406 ac = talloc_get_type(req->context, struct extended_search_context);
407 p = talloc_get_type(ldb_module_get_private(ac->module), struct extended_dn_out_private);
408 ldb = ldb_module_get_ctx(ac->module);
409 if (!ares) {
410 return ldb_module_done(ac->req, NULL, NULL,
411 LDB_ERR_OPERATIONS_ERROR);
412 }
413 if (ares->error != LDB_SUCCESS) {
414 return ldb_module_done(ac->req, ares->controls,
415 ares->response, ares->error);
416 }
417
418 msg = ares->message;
419
420 switch (ares->type) {
421 case LDB_REPLY_REFERRAL:
422 return ldb_module_send_referral(ac->req, ares->referral);
423
424 case LDB_REPLY_DONE:
425 return ldb_module_done(ac->req, ares->controls,
426 ares->response, LDB_SUCCESS);
427 case LDB_REPLY_ENTRY:
428 break;
429 }
430
431 if (p && p->normalise) {
432 ret = dsdb_fix_dn_rdncase(ldb, ares->message->dn);
433 if (ret != LDB_SUCCESS) {
434 return ldb_module_done(ac->req, NULL, NULL, ret);
435 }
436 }
437
438 if (ac->inject) {
439 /* for each record returned post-process to add any derived
440 attributes that have been asked for */
441 ret = inject_extended_dn_out(ares, ldb,
442 ac->extended_type, ac->remove_guid,
443 ac->remove_sid);
444 if (ret != LDB_SUCCESS) {
445 return ldb_module_done(ac->req, NULL, NULL, ret);
446 }
447 }
448
449 if ((p && p->normalise) || ac->inject) {
450 const struct ldb_val *val = ldb_msg_find_ldb_val(ares->message, "distinguishedName");
451 if (val) {
452 ldb_msg_remove_attr(ares->message, "distinguishedName");
453 if (ac->inject) {
454 ret = ldb_msg_add_steal_string(ares->message, "distinguishedName",
455 ldb_dn_get_extended_linearized(ares->message, ares->message->dn, ac->extended_type));
456 } else {
457 ret = ldb_msg_add_linearized_dn(ares->message,
458 "distinguishedName",
459 ares->message->dn);
460 }
461 if (ret != LDB_SUCCESS) {
462 return ldb_oom(ldb);
463 }
464 }
465 }
466
467 if (p && p->dereference) {
468 control = ldb_reply_get_control(ares, DSDB_OPENLDAP_DEREFERENCE_CONTROL);
469
470 if (control && control->data) {
471 dereference_control = talloc_get_type(control->data, struct dsdb_openldap_dereference_result_control);
472 }
473 }
474
475 /* Walk the returned elements (but only if we have a schema to
476 * interpret the list with) */
477 for (i = 0; ac->schema && i < msg->num_elements; i++) {
478 bool make_extended_dn;
479 const struct dsdb_attribute *attribute;
480
481 attribute = dsdb_attribute_by_lDAPDisplayName(ac->schema, msg->elements[i].name);
482 if (!attribute) {
483 continue;
484 }
485
486 if (p->normalise) {
487 /* If we are also in 'normalise' mode, then
488 * fix the attribute names to be in the
489 * correct case */
490 msg->elements[i].name = talloc_strdup(msg->elements, attribute->lDAPDisplayName);
491 if (!msg->elements[i].name) {
492 ldb_oom(ldb);
493 return ldb_module_done(ac->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
494 }
495 }
496
497 /* distinguishedName has been dealt with above */
498 if (ldb_attr_cmp(msg->elements[i].name, "distinguishedName") == 0) {
499 continue;
500 }
501
502 /* Look to see if this attributeSyntax is a DN */
503 if (attribute->dn_format == DSDB_INVALID_DN) {
504 continue;
505 }
506
507 make_extended_dn = ac->inject;
508
509 /* Always show plain DN in case of Object(OR-Name) syntax */
510 if (make_extended_dn) {
511 make_extended_dn = (strcmp(attribute->syntax->ldap_oid, DSDB_SYNTAX_OR_NAME) != 0);
512 }
513
514 for (j = 0; j < msg->elements[i].num_values; j++) {
515 const char *dn_str;
516 struct ldb_dn *dn;
517 struct dsdb_dn *dsdb_dn = NULL;
518 struct ldb_val *plain_dn = &msg->elements[i].values[j];
519 bool is_deleted_objects = false;
520
521 if (!checked_reveal_control) {
522 have_reveal_control =
523 ldb_request_get_control(req, LDB_CONTROL_REVEAL_INTERNALS) != NULL;
524 checked_reveal_control = true;
525 }
526
527 /* this is a fast method for detecting deleted
528 linked attributes, working on the unparsed
529 ldb_val */
530 if (dsdb_dn_is_deleted_val(plain_dn) && !have_reveal_control) {
531 /* it's a deleted linked attribute,
532 and we don't have the reveal control */
533 memmove(&msg->elements[i].values[j],
534 &msg->elements[i].values[j+1],
535 (msg->elements[i].num_values-(j+1))*sizeof(struct ldb_val));
536 msg->elements[i].num_values--;
537 j--;
538 continue;
539 }
540
541
542 dsdb_dn = dsdb_dn_parse(msg, ldb, plain_dn, attribute->syntax->ldap_oid);
543
544 if (!dsdb_dn || !ldb_dn_validate(dsdb_dn->dn)) {
545 ldb_asprintf_errstring(ldb,
546 "could not parse %.*s in %s on %s as a %s DN",
547 (int)plain_dn->length, plain_dn->data,
548 msg->elements[i].name, ldb_dn_get_linearized(msg->dn),
549 attribute->syntax->ldap_oid);
550 talloc_free(dsdb_dn);
551 return ldb_module_done(ac->req, NULL, NULL, LDB_ERR_INVALID_DN_SYNTAX);
552 }
553 dn = dsdb_dn->dn;
554
555 /* we need to know if this is a link to the
556 deleted objects container for fixing one way
557 links */
558 if (dsdb_dn->extra_part.length == 16) {
559 char *hex_string = data_blob_hex_string_upper(req, &dsdb_dn->extra_part);
560 if (hex_string && strcmp(hex_string, DS_GUID_DELETED_OBJECTS_CONTAINER) == 0) {
561 is_deleted_objects = true;
562 }
563 talloc_free(hex_string);
564 }
565
566 /* don't let users see the internal extended
567 GUID components */
568 if (!have_reveal_control) {
569 const char *accept[] = { "GUID", "SID", NULL };
570 ldb_dn_extended_filter(dn, accept);
571 }
572
573 if (p->normalise) {
574 ret = dsdb_fix_dn_rdncase(ldb, dn);
575 if (ret != LDB_SUCCESS) {
576 talloc_free(dsdb_dn);
577 return ldb_module_done(ac->req, NULL, NULL, ret);
578 }
579 }
580
581 /* If we are running in dereference mode (such
582 * as against OpenLDAP) then the DN in the msg
583 * above does not contain the extended values,
584 * and we need to look in the dereference
585 * result */
586
587 /* Look for this value in the attribute */
588
589 if (dereference_control) {
590 ret = handle_dereference(dn,
591 dereference_control->attributes,
592 msg->elements[i].name,
593 &msg->elements[i].values[j]);
594 if (ret != LDB_SUCCESS) {
595 talloc_free(dsdb_dn);
596 return ldb_module_done(ac->req, NULL, NULL, ret);
597 }
598 }
599
600 /* note that we don't fixup objectCategory as
601 it should not be possible to move
602 objectCategory elements in the schema */
603 if (attribute->one_way_link &&
604 strcasecmp(attribute->lDAPDisplayName, "objectCategory") != 0) {
605 bool remove_value;
606 ret = fix_one_way_link(ac, dn, is_deleted_objects, &remove_value);
607 if (ret != LDB_SUCCESS) {
608 talloc_free(dsdb_dn);
609 return ldb_module_done(ac->req, NULL, NULL, ret);
610 }
611 if (remove_value &&
612 !ldb_request_get_control(req, LDB_CONTROL_REVEAL_INTERNALS)) {
613 /* we show these with REVEAL
614 to allow dbcheck to find and
615 cleanup these orphaned links */
616 memmove(&msg->elements[i].values[j],
617 &msg->elements[i].values[j+1],
618 (msg->elements[i].num_values-(j+1))*sizeof(struct ldb_val));
619 msg->elements[i].num_values--;
620 j--;
621 continue;
622 }
623 }
624
625 if (make_extended_dn) {
626 dn_str = dsdb_dn_get_extended_linearized(msg->elements[i].values,
627 dsdb_dn, ac->extended_type);
628 } else {
629 dn_str = dsdb_dn_get_linearized(msg->elements[i].values,
630 dsdb_dn);
631 }
632
633 if (!dn_str) {
634 ldb_oom(ldb);
635 talloc_free(dsdb_dn);
636 return ldb_module_done(ac->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
637 }
638 msg->elements[i].values[j] = data_blob_string_const(dn_str);
639 talloc_free(dsdb_dn);
640 }
641 if (msg->elements[i].num_values == 0) {
642 /* we've deleted all of the values from this
643 * element - remove the element */
644 memmove(&msg->elements[i],
645 &msg->elements[i+1],
646 (msg->num_elements-(i+1))*sizeof(struct ldb_message_element));
647 msg->num_elements--;
648 i--;
649 }
650 }
651 return ldb_module_send_entry(ac->req, msg, ares->controls);
652 }
653
654 static int extended_callback_ldb(struct ldb_request *req, struct ldb_reply *ares)
655 {
656 return extended_callback(req, ares, NULL);
657 }
658
659 static int extended_callback_openldap(struct ldb_request *req, struct ldb_reply *ares)
660 {
661 return extended_callback(req, ares, handle_dereference_openldap);
662 }
663
664 static int extended_callback_fds(struct ldb_request *req, struct ldb_reply *ares)
665 {
666 return extended_callback(req, ares, handle_dereference_fds);
667 }
668
669 static int extended_dn_out_search(struct ldb_module *module, struct ldb_request *req,
670 int (*callback)(struct ldb_request *req, struct ldb_reply *ares))
671 {
672 struct ldb_control *control;
673 struct ldb_control *storage_format_control;
674 struct ldb_extended_dn_control *extended_ctrl = NULL;
675 struct extended_search_context *ac;
676 struct ldb_request *down_req;
677 char **new_attrs;
678 const char * const *const_attrs;
679 struct ldb_context *ldb = ldb_module_get_ctx(module);
680 int ret;
681
682 struct extended_dn_out_private *p = talloc_get_type(ldb_module_get_private(module), struct extended_dn_out_private);
683
684 /* The schema manipulation does not apply to special DNs */
685 if (ldb_dn_is_special(req->op.search.base)) {
686 return ldb_next_request(module, req);
687 }
688
689 /* check if there's an extended dn control */
690 control = ldb_request_get_control(req, LDB_CONTROL_EXTENDED_DN_OID);
691 if (control && control->data) {
692 extended_ctrl = talloc_get_type(control->data, struct ldb_extended_dn_control);
693 if (!extended_ctrl) {
694 return LDB_ERR_PROTOCOL_ERROR;
695 }
696 }
697
698 /* Look to see if, as we are in 'store DN+GUID+SID' mode, the
699 * client is after the storage format (to fill in linked
700 * attributes) */
701 storage_format_control = ldb_request_get_control(req, DSDB_CONTROL_DN_STORAGE_FORMAT_OID);
702 if (!control && storage_format_control && storage_format_control->data) {
703 extended_ctrl = talloc_get_type(storage_format_control->data, struct ldb_extended_dn_control);
704 if (!extended_ctrl) {
705 ldb_set_errstring(ldb, "extended_dn_out: extended_ctrl was of the wrong data type");
706 return LDB_ERR_PROTOCOL_ERROR;
707 }
708 }
709
710 ac = talloc_zero(req, struct extended_search_context);
711 if (ac == NULL) {
712 return ldb_oom(ldb);
713 }
714
715 ac->module = module;
716 ac->schema = dsdb_get_schema(ldb, ac);
717 ac->req = req;
718 ac->inject = false;
719 ac->remove_guid = false;
720 ac->remove_sid = false;
721
722 const_attrs = req->op.search.attrs;
723
724 /* We only need to do special processing if we were asked for
725 * the extended DN, or we are 'store DN+GUID+SID'
726 * (!dereference) mode. (This is the normal mode for LDB on
727 * tdb). */
728 if (control || (storage_format_control && p && !p->dereference)) {
729 ac->inject = true;
730 if (extended_ctrl) {
731 ac->extended_type = extended_ctrl->type;
732 } else {
733 ac->extended_type = 0;
734 }
735
736 /* check if attrs only is specified, in that case check wether we need to modify them */
737 if (req->op.search.attrs && !is_attr_in_list(req->op.search.attrs, "*")) {
738 if (! is_attr_in_list(req->op.search.attrs, "objectGUID")) {
739 ac->remove_guid = true;
740 }
741 if (! is_attr_in_list(req->op.search.attrs, "objectSid")) {
742 ac->remove_sid = true;
743 }
744 if (ac->remove_guid || ac->remove_sid) {
745 new_attrs = copy_attrs(ac, req->op.search.attrs);
746 if (new_attrs == NULL) {
747 return ldb_oom(ldb);
748 }
749
750 if (ac->remove_guid) {
751 if (!add_attrs(ac, &new_attrs, "objectGUID"))
752 return ldb_operr(ldb);
753 }
754 if (ac->remove_sid) {
755 if (!add_attrs(ac, &new_attrs, "objectSid"))
756 return ldb_operr(ldb);
757 }
758 const_attrs = (const char * const *)new_attrs;
759 }
760 }
761 }
762
763 ret = ldb_build_search_req_ex(&down_req,
764 ldb, ac,
765 req->op.search.base,
766 req->op.search.scope,
767 req->op.search.tree,
768 const_attrs,
769 req->controls,
770 ac, callback,
771 req);
772 LDB_REQ_SET_LOCATION(down_req);
773 if (ret != LDB_SUCCESS) {
774 return ret;
775 }
776
777 /* mark extended DN and storage format controls as done */
778 if (control) {
779 control->critical = 0;
780 }
781
782 if (storage_format_control) {
783 storage_format_control->critical = 0;
784 }
785
786 /* Add in dereference control, if we were asked to, we are
787 * using the 'dereference' mode (such as with an OpenLDAP
788 * backend) and have the control prepared */
789 if (control && p && p->dereference) {
790 ret = extended_dn_out_dereference_setup_control(ldb, p);
791 if (ret != LDB_SUCCESS) {
792 return ret;
793 }
794
795 /* We should always have this, but before the schema
796 * is with us, things get tricky */
797 if (p->dereference_control) {
798
799 /* This control must *not* be critical,
800 * because if this particular request did not
801 * return any dereferencable attributes in the
802 * end, then OpenLDAP will reply with
803 * unavailableCriticalExtension, rather than
804 * just an empty return control */
805 ret = ldb_request_add_control(down_req,
806 DSDB_OPENLDAP_DEREFERENCE_CONTROL,
807 false, p->dereference_control);
808 if (ret != LDB_SUCCESS) {
809 return ret;
810 }
811 }
812 }
813
814 /* perform the search */
815 return ldb_next_request(module, down_req);
816 }
817
818 static int extended_dn_out_ldb_search(struct ldb_module *module, struct ldb_request *req)
819 {
820 return extended_dn_out_search(module, req, extended_callback_ldb);
821 }
822
823 static int extended_dn_out_openldap_search(struct ldb_module *module, struct ldb_request *req)
824 {
825 return extended_dn_out_search(module, req, extended_callback_openldap);
826 }
827
828 static int extended_dn_out_fds_search(struct ldb_module *module, struct ldb_request *req)
829 {
830 return extended_dn_out_search(module, req, extended_callback_fds);
831 }
832
833 static int extended_dn_out_ldb_init(struct ldb_module *module)
834 {
835 int ret;
836
837 struct extended_dn_out_private *p = talloc(module, struct extended_dn_out_private);
838 struct dsdb_extended_dn_store_format *dn_format;
839
840 ldb_module_set_private(module, p);
841
842 if (!p) {
843 return ldb_oom(ldb_module_get_ctx(module));
844 }
845
846 dn_format = talloc(p, struct dsdb_extended_dn_store_format);
847 if (!dn_format) {
848 talloc_free(p);
849 return ldb_oom(ldb_module_get_ctx(module));
850 }
851
852 dn_format->store_extended_dn_in_ldb = true;
853 ret = ldb_set_opaque(ldb_module_get_ctx(module), DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME, dn_format);
854 if (ret != LDB_SUCCESS) {
855 talloc_free(p);
856 return ret;
857 }
858
859 p->dereference = false;
860 p->normalise = false;
861
862 ret = ldb_mod_register_control(module, LDB_CONTROL_EXTENDED_DN_OID);
863 if (ret != LDB_SUCCESS) {
864 ldb_debug(ldb_module_get_ctx(module), LDB_DEBUG_ERROR,
865 "extended_dn_out: Unable to register control with rootdse!\n");
866 return ldb_operr(ldb_module_get_ctx(module));
867 }
868
869 return ldb_next_init(module);
870 }
871
872 static int extended_dn_out_dereference_init(struct ldb_module *module, const char *attrs[])
873 {
874 int ret;
875 struct extended_dn_out_private *p = talloc_zero(module, struct extended_dn_out_private);
876 struct dsdb_extended_dn_store_format *dn_format;
877
878 ldb_module_set_private(module, p);
879
880 if (!p) {
881 return ldb_module_oom(module);
882 }
883
884 dn_format = talloc(p, struct dsdb_extended_dn_store_format);
885 if (!dn_format) {
886 talloc_free(p);
887 return ldb_module_oom(module);
888 }
889
890 dn_format->store_extended_dn_in_ldb = false;
891
892 ret = ldb_set_opaque(ldb_module_get_ctx(module), DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME, dn_format);
893 if (ret != LDB_SUCCESS) {
894 talloc_free(p);
895 return ret;
896 }
897
898 p->dereference = true;
899
900 p->attrs = attrs;
901 /* At the moment, servers that need dereference also need the
902 * DN and attribute names to be normalised */
903 p->normalise = true;
904
905 ret = ldb_mod_register_control(module, LDB_CONTROL_EXTENDED_DN_OID);
906 if (ret != LDB_SUCCESS) {
907 ldb_debug(ldb_module_get_ctx(module), LDB_DEBUG_ERROR,
908 "extended_dn_out: Unable to register control with rootdse!\n");
909 return ldb_operr(ldb_module_get_ctx(module));
910 }
911
912 return ldb_next_init(module);
913 }
914
915 static int extended_dn_out_openldap_init(struct ldb_module *module)
916 {
917 static const char *attrs[] = {
918 "entryUUID",
919 "objectSid",
920 NULL
921 };
922
923 return extended_dn_out_dereference_init(module, attrs);
924 }
925
926 static int extended_dn_out_fds_init(struct ldb_module *module)
927 {
928 static const char *attrs[] = {
929 "nsUniqueId",
930 "sambaSID",
931 NULL
932 };
933
934 return extended_dn_out_dereference_init(module, attrs);
935 }
936
937 static const struct ldb_module_ops ldb_extended_dn_out_ldb_module_ops = {
938 .name = "extended_dn_out_ldb",
939 .search = extended_dn_out_ldb_search,
940 .init_context = extended_dn_out_ldb_init,
941 };
942
943 static const struct ldb_module_ops ldb_extended_dn_out_openldap_module_ops = {
944 .name = "extended_dn_out_openldap",
945 .search = extended_dn_out_openldap_search,
946 .init_context = extended_dn_out_openldap_init,
947 };
948
949 static const struct ldb_module_ops ldb_extended_dn_out_fds_module_ops = {
950 .name = "extended_dn_out_fds",
951 .search = extended_dn_out_fds_search,
952 .init_context = extended_dn_out_fds_init,
953 };
954
955 /*
956 initialise the module
957 */
958 _PUBLIC_ int ldb_extended_dn_out_module_init(const char *version)
959 {
960 int ret;
961 LDB_MODULE_CHECK_VERSION(version);
962 ret = ldb_register_module(&ldb_extended_dn_out_ldb_module_ops);
963 if (ret != LDB_SUCCESS) {
964 return ret;
965 }
966 ret = ldb_register_module(&ldb_extended_dn_out_openldap_module_ops);
967 if (ret != LDB_SUCCESS) {
968 return ret;
969 }
970 ret = ldb_register_module(&ldb_extended_dn_out_fds_module_ops);
971 if (ret != LDB_SUCCESS) {
972 return ret;
973 }
974 return LDB_SUCCESS;
975 }
Samba GIT mirror