source4/ldap_server/ldap_bind.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    LDAP server
   4    Copyright (C) Stefan Metzmacher 2004
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "ldap_server/ldap_server.h"
  22 #include "auth/auth.h"
  23 #include "smbd/service.h"
  24 #include <ldb.h>
  25 #include <ldb_errors.h>
  26 #include "../lib/util/dlinklist.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "auth/gensec/gensec.h"
  29 #include "auth/gensec/gensec_tstream.h"
  30 #include "param/param.h"
  31 #include "../lib/util/tevent_ntstatus.h"
  32
  33 static char *ldapsrv_bind_error_msg(TALLOC_CTX *mem_ctx,
  34                                     HRESULT hresult,
  35                                     uint32_t DSID,
  36                                     NTSTATUS status)
  37 {
  38         WERROR werr;
  39         char *msg = NULL;
  40
  41         status = nt_status_squash(status);
  42         werr = ntstatus_to_werror(status);
  43
  44         /*
  45          * There are 4 lower case hex digits following 'v' at the end,
  46          * but different Windows Versions return different values:
  47          *
  48          * Windows 2008R2 uses 'v1db1'
  49          * Windows 2012R2 uses 'v2580'
  50          *
  51          * We just match Windows 2008R2 as that's what was referenced
  52          * in https://bugzilla.samba.org/show_bug.cgi?id=9048
  53          */
  54         msg = talloc_asprintf(mem_ctx, "%08X: LdapErr: DSID-%08X, comment: "
  55                               "AcceptSecurityContext error, data %x, v1db1",
  56                               (unsigned)HRES_ERROR_V(hresult),
  57                               (unsigned)DSID,
  58                               (unsigned)W_ERROR_V(werr));
  59
  60         return msg;
  61 }
  62
  63 struct ldapsrv_bind_wait_context {
  64         struct ldapsrv_reply *reply;
  65         struct tevent_req *req;
  66         NTSTATUS status;
  67         bool done;
  68 };
  69
  70 struct ldapsrv_bind_wait_state {
  71         uint8_t dummy;
  72 };
  73
  74 static struct tevent_req *ldapsrv_bind_wait_send(TALLOC_CTX *mem_ctx,
  75                                                  struct tevent_context *ev,
  76                                                  void *private_data)
  77 {
  78         struct ldapsrv_bind_wait_context *bind_wait =
  79                 talloc_get_type_abort(private_data,
  80                 struct ldapsrv_bind_wait_context);
  81         struct tevent_req *req;
  82         struct ldapsrv_bind_wait_state *state;
  83
  84         req = tevent_req_create(mem_ctx, &state,
  85                                 struct ldapsrv_bind_wait_state);
  86         if (req == NULL) {
  87                 return NULL;
  88         }
  89         bind_wait->req = req;
  90
  91         tevent_req_defer_callback(req, ev);
  92
  93         if (!bind_wait->done) {
  94                 return req;
  95         }
  96
  97         if (tevent_req_nterror(req, bind_wait->status)) {
  98                 return tevent_req_post(req, ev);
  99         }
 100
 101         tevent_req_done(req);
 102         return tevent_req_post(req, ev);
 103 }
 104
 105 static NTSTATUS ldapsrv_bind_wait_recv(struct tevent_req *req)
 106 {
 107         return tevent_req_simple_recv_ntstatus(req);
 108 }
 109
 110 static NTSTATUS ldapsrv_bind_wait_setup(struct ldapsrv_call *call,
 111                                         struct ldapsrv_reply *reply)
 112 {
 113         struct ldapsrv_bind_wait_context *bind_wait = NULL;
 114
 115         if (call->wait_private != NULL) {
 116                 return NT_STATUS_INTERNAL_ERROR;
 117         }
 118
 119         bind_wait = talloc_zero(call, struct ldapsrv_bind_wait_context);
 120         if (bind_wait == NULL) {
 121                 return NT_STATUS_NO_MEMORY;
 122         }
 123         bind_wait->reply = reply;
 124
 125         call->wait_private = bind_wait;
 126         call->wait_send = ldapsrv_bind_wait_send;
 127         call->wait_recv = ldapsrv_bind_wait_recv;
 128         return NT_STATUS_OK;
 129 }
 130
 131 static void ldapsrv_bind_wait_finished(struct ldapsrv_call *call,
 132                                        NTSTATUS status)
 133 {
 134         struct ldapsrv_bind_wait_context *bind_wait =
 135                 talloc_get_type_abort(call->wait_private,
 136                 struct ldapsrv_bind_wait_context);
 137
 138         bind_wait->done = true;
 139         bind_wait->status = status;
 140
 141         if (bind_wait->req == NULL) {
 142                 return;
 143         }
 144
 145         if (tevent_req_nterror(bind_wait->req, status)) {
 146                 return;
 147         }
 148
 149         tevent_req_done(bind_wait->req);
 150 }
 151
 152 static void ldapsrv_BindSimple_done(struct tevent_req *subreq);
 153
 154 static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
 155 {
 156         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 157         struct ldapsrv_reply *reply = NULL;
 158         struct ldap_BindResponse *resp = NULL;
 159         int result;
 160         const char *errstr = NULL;
 161         NTSTATUS status;
 162         bool using_tls = call->conn->sockets.active == call->conn->sockets.tls;
 163         struct tevent_req *subreq = NULL;
 164
 165         DEBUG(10, ("BindSimple dn: %s\n",req->dn));
 166
 167         reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 168         if (!reply) {
 169                 return NT_STATUS_NO_MEMORY;
 170         }
 171
 172         if (req->dn != NULL &&
 173             strlen(req->dn) != 0 &&
 174             call->conn->require_strong_auth > LDAP_SERVER_REQUIRE_STRONG_AUTH_NO &&
 175             !using_tls)
 176         {
 177                 status = NT_STATUS_NETWORK_ACCESS_DENIED;
 178                 result = LDAP_STRONG_AUTH_REQUIRED;
 179                 errstr = talloc_asprintf(reply,
 180                                          "BindSimple: Transport encryption required.");
 181                 goto do_reply;
 182         }
 183
 184         subreq = authenticate_ldap_simple_bind_send(call,
 185                                         call->conn->connection->event.ctx,
 186                                         call->conn->connection->msg_ctx,
 187                                         call->conn->lp_ctx,
 188                                         call->conn->connection->remote_address,
 189                                         call->conn->connection->local_address,
 190                                         using_tls,
 191                                         req->dn,
 192                                         req->creds.password);
 193         if (subreq == NULL) {
 194                 return NT_STATUS_NO_MEMORY;
 195         }
 196         tevent_req_set_callback(subreq, ldapsrv_BindSimple_done, call);
 197
 198         status = ldapsrv_bind_wait_setup(call, reply);
 199         if (!NT_STATUS_IS_OK(status)) {
 200                 TALLOC_FREE(subreq);
 201                 return status;
 202         }
 203
 204         /*
 205          * The rest will be async.
 206          */
 207         return NT_STATUS_OK;
 208
 209 do_reply:
 210         resp = &reply->msg->r.BindResponse;
 211         resp->response.resultcode = result;
 212         resp->response.errormessage = errstr;
 213         resp->response.dn = NULL;
 214         resp->response.referral = NULL;
 215         resp->SASL.secblob = NULL;
 216
 217         ldapsrv_queue_reply(call, reply);
 218         return NT_STATUS_OK;
 219 }
 220
 221 static void ldapsrv_BindSimple_done(struct tevent_req *subreq)
 222 {
 223         struct ldapsrv_call *call =
 224                 tevent_req_callback_data(subreq,
 225                 struct ldapsrv_call);
 226         struct ldapsrv_bind_wait_context *bind_wait =
 227                 talloc_get_type_abort(call->wait_private,
 228                 struct ldapsrv_bind_wait_context);
 229         struct ldapsrv_reply *reply = bind_wait->reply;
 230         struct auth_session_info *session_info = NULL;
 231         NTSTATUS status;
 232         struct ldap_BindResponse *resp = NULL;
 233         int result;
 234         const char *errstr = NULL;
 235
 236         status = authenticate_ldap_simple_bind_recv(subreq,
 237                                                     call,
 238                                                     &session_info);
 239         if (NT_STATUS_IS_OK(status)) {
 240                 char *ldb_errstring = NULL;
 241                 result = LDAP_SUCCESS;
 242                 errstr = NULL;
 243
 244                 talloc_unlink(call->conn, call->conn->session_info);
 245                 call->conn->session_info = talloc_steal(call->conn, session_info);
 246
 247                 call->conn->authz_logged = true;
 248
 249                 /* don't leak the old LDB */
 250                 talloc_unlink(call->conn, call->conn->ldb);
 251
 252                 result = ldapsrv_backend_Init(call->conn, &ldb_errstring);
 253
 254                 if (result != LDB_SUCCESS) {
 255                         /* Only put the detailed error in DEBUG() */
 256                         DBG_ERR("ldapsrv_backend_Init failed: %s: %s",
 257                                 ldb_errstring, ldb_strerror(result));
 258                         errstr = talloc_strdup(reply,
 259                                                "Simple Bind: Failed to advise "
 260                                                "ldb new credentials");
 261                         result = LDB_ERR_OPERATIONS_ERROR;
 262                 }
 263         } else {
 264                 status = nt_status_squash(status);
 265
 266                 result = LDAP_INVALID_CREDENTIALS;
 267                 errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_INVALID_TOKEN,
 268                                                 0x0C0903A9, status);
 269         }
 270
 271         resp = &reply->msg->r.BindResponse;
 272         resp->response.resultcode = result;
 273         resp->response.errormessage = errstr;
 274         resp->response.dn = NULL;
 275         resp->response.referral = NULL;
 276         resp->SASL.secblob = NULL;
 277
 278         ldapsrv_queue_reply(call, reply);
 279         ldapsrv_bind_wait_finished(call, NT_STATUS_OK);
 280 }
 281
 282 struct ldapsrv_sasl_postprocess_context {
 283         struct ldapsrv_connection *conn;
 284         struct tstream_context *sasl;
 285 };
 286
 287 struct ldapsrv_sasl_postprocess_state {
 288         uint8_t dummy;
 289 };
 290
 291 static struct tevent_req *ldapsrv_sasl_postprocess_send(TALLOC_CTX *mem_ctx,
 292                                                 struct tevent_context *ev,
 293                                                 void *private_data)
 294 {
 295         struct ldapsrv_sasl_postprocess_context *context =
 296                 talloc_get_type_abort(private_data,
 297                 struct ldapsrv_sasl_postprocess_context);
 298         struct tevent_req *req;
 299         struct ldapsrv_sasl_postprocess_state *state;
 300
 301         req = tevent_req_create(mem_ctx, &state,
 302                                 struct ldapsrv_sasl_postprocess_state);
 303         if (req == NULL) {
 304                 return NULL;
 305         }
 306
 307         TALLOC_FREE(context->conn->sockets.sasl);
 308         context->conn->sockets.sasl = talloc_move(context->conn, &context->sasl);
 309         context->conn->sockets.active = context->conn->sockets.sasl;
 310
 311         tevent_req_done(req);
 312         return tevent_req_post(req, ev);
 313 }
 314
 315 static NTSTATUS ldapsrv_sasl_postprocess_recv(struct tevent_req *req)
 316 {
 317         return tevent_req_simple_recv_ntstatus(req);
 318 }
 319
 320 static NTSTATUS ldapsrv_setup_gensec(struct ldapsrv_connection *conn,
 321                                      const char *sasl_mech,
 322                                      struct gensec_security **_gensec_security)
 323 {
 324         NTSTATUS status;
 325
 326         struct gensec_security *gensec_security;
 327
 328         status = samba_server_gensec_start(conn,
 329                                            conn->connection->event.ctx,
 330                                            conn->connection->msg_ctx,
 331                                            conn->lp_ctx,
 332                                            conn->server_credentials,
 333                                            "ldap",
 334                                            &gensec_security);
 335         if (!NT_STATUS_IS_OK(status)) {
 336                 return status;
 337         }
 338
 339         status = gensec_set_target_service_description(gensec_security,
 340                                                        "LDAP");
 341         if (!NT_STATUS_IS_OK(status)) {
 342                 return status;
 343         }
 344
 345         status = gensec_set_remote_address(gensec_security,
 346                                            conn->connection->remote_address);
 347         if (!NT_STATUS_IS_OK(status)) {
 348                 return status;
 349         }
 350
 351         status = gensec_set_local_address(gensec_security,
 352                                           conn->connection->local_address);
 353         if (!NT_STATUS_IS_OK(status)) {
 354                 return status;
 355         }
 356
 357         gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES);
 358         gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAP_STYLE);
 359
 360         if (conn->sockets.active == conn->sockets.tls) {
 361                 gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAPS_TRANSPORT);
 362         }
 363
 364         status = gensec_start_mech_by_sasl_name(gensec_security, sasl_mech);
 365
 366         if (!NT_STATUS_IS_OK(status)) {
 367                 return status;
 368         }
 369
 370         *_gensec_security = gensec_security;
 371         return status;
 372 }
 373
 374 static void ldapsrv_BindSASL_done(struct tevent_req *subreq);
 375
 376 static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
 377 {
 378         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 379         struct ldapsrv_reply *reply;
 380         struct ldap_BindResponse *resp;
 381         struct ldapsrv_connection *conn;
 382         int result = 0;
 383         const char *errstr=NULL;
 384         NTSTATUS status = NT_STATUS_OK;
 385         DATA_BLOB input = data_blob_null;
 386         struct tevent_req *subreq = NULL;
 387
 388         DEBUG(10, ("BindSASL dn: %s\n",req->dn));
 389
 390         reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 391         if (!reply) {
 392                 return NT_STATUS_NO_MEMORY;
 393         }
 394         resp = &reply->msg->r.BindResponse;
 395         /* Windows 2000 mmc doesn't like secblob == NULL and reports a decoding error */
 396         resp->SASL.secblob = talloc_zero(reply, DATA_BLOB);
 397         if (resp->SASL.secblob == NULL) {
 398                 return NT_STATUS_NO_MEMORY;
 399         }
 400
 401         conn = call->conn;
 402
 403         /*
 404          * TODO: a SASL bind with a different mechanism
 405          *       should cancel an inprogress SASL bind.
 406          *       (see RFC 4513)
 407          */
 408
 409         if (!conn->gensec) {
 410                 status = ldapsrv_setup_gensec(conn, req->creds.SASL.mechanism,
 411                                               &conn->gensec);
 412                 if (!NT_STATUS_IS_OK(status)) {
 413                         DEBUG(1, ("Failed to start GENSEC server for [%s] code: %s\n",
 414                                   ldb_binary_encode_string(call, req->creds.SASL.mechanism),
 415                                   nt_errstr(status)));
 416                         result = LDAP_OPERATIONS_ERROR;
 417                         errstr = talloc_asprintf(reply, "SASL: Failed to start authentication system: %s",
 418                                                  nt_errstr(status));
 419                         goto do_reply;
 420                 }
 421         }
 422
 423         if (req->creds.SASL.secblob) {
 424                 input = *req->creds.SASL.secblob;
 425         }
 426
 427         subreq = gensec_update_send(call, conn->connection->event.ctx,
 428                                     conn->gensec, input);
 429         if (subreq == NULL) {
 430                 return NT_STATUS_NO_MEMORY;
 431         }
 432         tevent_req_set_callback(subreq, ldapsrv_BindSASL_done, call);
 433
 434         status = ldapsrv_bind_wait_setup(call, reply);
 435         if (!NT_STATUS_IS_OK(status)) {
 436                 TALLOC_FREE(subreq);
 437                 return status;
 438         }
 439
 440         /*
 441          * The rest will be async.
 442          */
 443         return NT_STATUS_OK;
 444
 445 do_reply:
 446         if (result != LDAP_SASL_BIND_IN_PROGRESS) {
 447                 /*
 448                  * We should destroy the gensec context
 449                  * when we hit a fatal error.
 450                  *
 451                  * Note: conn->gensec is already cleared
 452                  * for the LDAP_SUCCESS case.
 453                  */
 454                 talloc_unlink(conn, conn->gensec);
 455                 conn->gensec = NULL;
 456         }
 457
 458         resp->response.resultcode = result;
 459         resp->response.dn = NULL;
 460         resp->response.errormessage = errstr;
 461         resp->response.referral = NULL;
 462
 463         ldapsrv_queue_reply(call, reply);
 464         return NT_STATUS_OK;
 465 }
 466
 467 static void ldapsrv_BindSASL_done(struct tevent_req *subreq)
 468 {
 469         struct ldapsrv_call *call =
 470                 tevent_req_callback_data(subreq,
 471                 struct ldapsrv_call);
 472         struct ldapsrv_bind_wait_context *bind_wait =
 473                 talloc_get_type_abort(call->wait_private,
 474                 struct ldapsrv_bind_wait_context);
 475         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 476         struct ldapsrv_reply *reply = bind_wait->reply;
 477         struct ldap_BindResponse *resp = &reply->msg->r.BindResponse;
 478         struct ldapsrv_connection *conn = call->conn;
 479         struct auth_session_info *session_info = NULL;
 480         struct ldapsrv_sasl_postprocess_context *context = NULL;
 481         NTSTATUS status;
 482         int result;
 483         const char *errstr = NULL;
 484         char *ldb_errstring = NULL;
 485         DATA_BLOB output = data_blob_null;
 486
 487         status = gensec_update_recv(subreq, call, &output);
 488         TALLOC_FREE(subreq);
 489
 490         if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED, status)) {
 491                 *resp->SASL.secblob = output;
 492                 result = LDAP_SASL_BIND_IN_PROGRESS;
 493                 errstr = NULL;
 494                 goto do_reply;
 495         }
 496
 497         if (!NT_STATUS_IS_OK(status)) {
 498                 status = nt_status_squash(status);
 499                 result = LDAP_INVALID_CREDENTIALS;
 500                 errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_LOGON_DENIED,
 501                                                 0x0C0904DC, status);
 502                 goto do_reply;
 503         }
 504
 505         if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
 506             gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
 507
 508                 context = talloc_zero(call, struct ldapsrv_sasl_postprocess_context);
 509                 if (context == NULL) {
 510                         ldapsrv_bind_wait_finished(call, NT_STATUS_NO_MEMORY);
 511                         return;
 512                 }
 513         }
 514
 515         if (context && conn->sockets.tls) {
 516                 TALLOC_FREE(context);
 517                 status = NT_STATUS_NOT_SUPPORTED;
 518                 result = LDAP_UNWILLING_TO_PERFORM;
 519                 errstr = talloc_asprintf(reply,
 520                                          "SASL:[%s]: Sign or Seal are not allowed if TLS is used",
 521                                          req->creds.SASL.mechanism);
 522                 goto do_reply;
 523         }
 524
 525         if (context && conn->sockets.sasl) {
 526                 TALLOC_FREE(context);
 527                 status = NT_STATUS_NOT_SUPPORTED;
 528                 result = LDAP_UNWILLING_TO_PERFORM;
 529                 errstr = talloc_asprintf(reply,
 530                                          "SASL:[%s]: Sign or Seal are not allowed if SASL encryption has already been set up",
 531                                          req->creds.SASL.mechanism);
 532                 goto do_reply;
 533         }
 534
 535         if (context == NULL) {
 536                 switch (call->conn->require_strong_auth) {
 537                 case LDAP_SERVER_REQUIRE_STRONG_AUTH_NO:
 538                         break;
 539                 case LDAP_SERVER_REQUIRE_STRONG_AUTH_ALLOW_SASL_OVER_TLS:
 540                         if (call->conn->sockets.active == call->conn->sockets.tls) {
 541                                 break;
 542                         }
 543                         status = NT_STATUS_NETWORK_ACCESS_DENIED;
 544                         result = LDAP_STRONG_AUTH_REQUIRED;
 545                         errstr = talloc_asprintf(reply,
 546                                         "SASL:[%s]: not allowed if TLS is used.",
 547                                          req->creds.SASL.mechanism);
 548                         goto do_reply;
 549
 550                 case LDAP_SERVER_REQUIRE_STRONG_AUTH_YES:
 551                         status = NT_STATUS_NETWORK_ACCESS_DENIED;
 552                         result = LDAP_STRONG_AUTH_REQUIRED;
 553                         errstr = talloc_asprintf(reply,
 554                                          "SASL:[%s]: Sign or Seal are required.",
 555                                          req->creds.SASL.mechanism);
 556                         goto do_reply;
 557                 }
 558         }
 559
 560         if (context != NULL) {
 561                 context->conn = conn;
 562                 status = gensec_create_tstream(context,
 563                                                context->conn->gensec,
 564                                                context->conn->sockets.raw,
 565                                                &context->sasl);
 566                 if (!NT_STATUS_IS_OK(status)) {
 567                         result = LDAP_OPERATIONS_ERROR;
 568                         errstr = talloc_asprintf(reply,
 569                                          "SASL:[%s]: Failed to setup SASL socket: %s",
 570                                          req->creds.SASL.mechanism, nt_errstr(status));
 571                         goto do_reply;
 572                 }
 573         }
 574
 575         status = gensec_session_info(conn->gensec, call, &session_info);
 576         if (!NT_STATUS_IS_OK(status)) {
 577                 result = LDAP_OPERATIONS_ERROR;
 578                 errstr = talloc_asprintf(reply,
 579                                          "SASL:[%s]: Failed to get session info: %s",
 580                                          req->creds.SASL.mechanism, nt_errstr(status));
 581                 goto do_reply;
 582         }
 583
 584         talloc_unlink(conn, conn->session_info);
 585         conn->session_info = talloc_steal(conn, session_info);
 586
 587         /* don't leak the old LDB */
 588         talloc_unlink(conn, conn->ldb);
 589
 590         call->conn->authz_logged = true;
 591
 592         result = ldapsrv_backend_Init(call->conn, &ldb_errstring);
 593
 594         if (result != LDB_SUCCESS) {
 595                 /* Only put the detailed error in DEBUG() */
 596                 DBG_ERR("ldapsrv_backend_Init failed: %s: %s",
 597                         ldb_errstring, ldb_strerror(result));
 598                 errstr = talloc_strdup(reply,
 599                                        "SASL Bind: Failed to advise "
 600                                        "ldb new credentials");
 601                 result = LDB_ERR_OPERATIONS_ERROR;
 602         }
 603
 604         if (context != NULL) {
 605                 const void *ptr = NULL;
 606
 607                 ptr = talloc_reparent(conn, context->sasl, conn->gensec);
 608                 if (ptr == NULL) {
 609                         ldapsrv_bind_wait_finished(call, NT_STATUS_NO_MEMORY);
 610                         return;
 611                 }
 612
 613                 call->postprocess_send = ldapsrv_sasl_postprocess_send;
 614                 call->postprocess_recv = ldapsrv_sasl_postprocess_recv;
 615                 call->postprocess_private = context;
 616         } else {
 617                 talloc_unlink(conn, conn->gensec);
 618         }
 619         conn->gensec = NULL;
 620
 621         *resp->SASL.secblob = output;
 622         result = LDAP_SUCCESS;
 623         errstr = NULL;
 624
 625 do_reply:
 626         if (result != LDAP_SASL_BIND_IN_PROGRESS) {
 627                 /*
 628                  * We should destroy the gensec context
 629                  * when we hit a fatal error.
 630                  *
 631                  * Note: conn->gensec is already cleared
 632                  * for the LDAP_SUCCESS case.
 633                  */
 634                 talloc_unlink(conn, conn->gensec);
 635                 conn->gensec = NULL;
 636         }
 637
 638         resp->response.resultcode = result;
 639         resp->response.dn = NULL;
 640         resp->response.errormessage = errstr;
 641         resp->response.referral = NULL;
 642
 643         ldapsrv_queue_reply(call, reply);
 644         ldapsrv_bind_wait_finished(call, NT_STATUS_OK);
 645 }
 646
 647 NTSTATUS ldapsrv_BindRequest(struct ldapsrv_call *call)
 648 {
 649         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 650         struct ldapsrv_reply *reply;
 651         struct ldap_BindResponse *resp;
 652
 653         if (call->conn->pending_calls != NULL) {
 654                 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 655                 if (!reply) {
 656                         return NT_STATUS_NO_MEMORY;
 657                 }
 658
 659                 resp = &reply->msg->r.BindResponse;
 660                 resp->response.resultcode = LDAP_BUSY;
 661                 resp->response.dn = NULL;
 662                 resp->response.errormessage = talloc_asprintf(reply, "Pending requests on this LDAP session");
 663                 resp->response.referral = NULL;
 664                 resp->SASL.secblob = NULL;
 665
 666                 ldapsrv_queue_reply(call, reply);
 667                 return NT_STATUS_OK;
 668         }
 669
 670         /*
 671          * TODO: a simple bind should cancel an
 672          *       inprogress SASL bind.
 673          *       (see RFC 4513)
 674          */
 675         switch (req->mechanism) {
 676                 case LDAP_AUTH_MECH_SIMPLE:
 677                         return ldapsrv_BindSimple(call);
 678                 case LDAP_AUTH_MECH_SASL:
 679                         return ldapsrv_BindSASL(call);
 680         }
 681
 682         reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 683         if (!reply) {
 684                 return NT_STATUS_NO_MEMORY;
 685         }
 686
 687         resp = &reply->msg->r.BindResponse;
 688         resp->response.resultcode = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 689         resp->response.dn = NULL;
 690         resp->response.errormessage = talloc_asprintf(reply, "Bad AuthenticationChoice [%d]", req->mechanism);
 691         resp->response.referral = NULL;
 692         resp->SASL.secblob = NULL;
 693
 694         ldapsrv_queue_reply(call, reply);
 695         return NT_STATUS_OK;
 696 }
 697
 698 struct ldapsrv_unbind_wait_context {
 699         uint8_t dummy;
 700 };
 701
 702 struct ldapsrv_unbind_wait_state {
 703         uint8_t dummy;
 704 };
 705
 706 static struct tevent_req *ldapsrv_unbind_wait_send(TALLOC_CTX *mem_ctx,
 707                                                  struct tevent_context *ev,
 708                                                  void *private_data)
 709 {
 710         struct ldapsrv_unbind_wait_context *unbind_wait =
 711                 talloc_get_type_abort(private_data,
 712                 struct ldapsrv_unbind_wait_context);
 713         struct tevent_req *req;
 714         struct ldapsrv_unbind_wait_state *state;
 715
 716         req = tevent_req_create(mem_ctx, &state,
 717                                 struct ldapsrv_unbind_wait_state);
 718         if (req == NULL) {
 719                 return NULL;
 720         }
 721
 722         (void)unbind_wait;
 723
 724         tevent_req_nterror(req, NT_STATUS_LOCAL_DISCONNECT);
 725         return tevent_req_post(req, ev);
 726 }
 727
 728 static NTSTATUS ldapsrv_unbind_wait_recv(struct tevent_req *req)
 729 {
 730         return tevent_req_simple_recv_ntstatus(req);
 731 }
 732
 733 static NTSTATUS ldapsrv_unbind_wait_setup(struct ldapsrv_call *call)
 734 {
 735         struct ldapsrv_unbind_wait_context *unbind_wait = NULL;
 736
 737         if (call->wait_private != NULL) {
 738                 return NT_STATUS_INTERNAL_ERROR;
 739         }
 740
 741         unbind_wait = talloc_zero(call, struct ldapsrv_unbind_wait_context);
 742         if (unbind_wait == NULL) {
 743                 return NT_STATUS_NO_MEMORY;
 744         }
 745
 746         call->wait_private = unbind_wait;
 747         call->wait_send = ldapsrv_unbind_wait_send;
 748         call->wait_recv = ldapsrv_unbind_wait_recv;
 749         return NT_STATUS_OK;
 750 }
 751
 752 NTSTATUS ldapsrv_UnbindRequest(struct ldapsrv_call *call)
 753 {
 754         struct ldapsrv_call *c = NULL;
 755         struct ldapsrv_call *n = NULL;
 756
 757         DEBUG(10, ("UnbindRequest\n"));
 758
 759         for (c = call->conn->pending_calls; c != NULL; c = n) {
 760                 n = c->next;
 761
 762                 DLIST_REMOVE(call->conn->pending_calls, c);
 763                 TALLOC_FREE(c);
 764         }
 765
 766         return ldapsrv_unbind_wait_setup(call);
 767 }