2 Unix SMB/CIFS implementation.
3 Infrastructure for async ldap client requests
4 Copyright (C) Volker Lendecke 2009
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "tldap_util.h"
23 #include "../libcli/security/security.h"
24 #include "../lib/util/asn1.h"
25 #include "../librpc/ndr/libndr.h"
27 bool tldap_entry_values(struct tldap_message
*msg
, const char *attribute
,
28 DATA_BLOB
**values
, int *num_values
)
30 struct tldap_attribute
*attributes
;
31 int i
, num_attributes
;
33 if (!tldap_entry_attributes(msg
, &attributes
, &num_attributes
)) {
37 for (i
=0; i
<num_attributes
; i
++) {
38 if (strequal(attribute
, attributes
[i
].name
)) {
42 if (i
== num_attributes
) {
45 *num_values
= attributes
[i
].num_values
;
46 *values
= attributes
[i
].values
;
50 bool tldap_get_single_valueblob(struct tldap_message
*msg
,
51 const char *attribute
, DATA_BLOB
*blob
)
56 if (attribute
== NULL
) {
59 if (!tldap_entry_values(msg
, attribute
, &values
, &num_values
)) {
62 if (num_values
!= 1) {
69 char *tldap_talloc_single_attribute(struct tldap_message
*msg
,
70 const char *attribute
,
77 if (!tldap_get_single_valueblob(msg
, attribute
, &val
)) {
80 if (!convert_string_talloc(mem_ctx
, CH_UTF8
, CH_UNIX
,
82 &result
, &len
, false)) {
88 bool tldap_pull_binsid(struct tldap_message
*msg
, const char *attribute
,
93 if (!tldap_get_single_valueblob(msg
, attribute
, &val
)) {
96 return sid_parse((char *)val
.data
, val
.length
, sid
);
99 bool tldap_pull_guid(struct tldap_message
*msg
, const char *attribute
,
104 if (!tldap_get_single_valueblob(msg
, attribute
, &val
)) {
107 return NT_STATUS_IS_OK(GUID_from_data_blob(&val
, guid
));
110 static bool tldap_add_blob_vals(TALLOC_CTX
*mem_ctx
, struct tldap_mod
*mod
,
111 DATA_BLOB
*newvals
, int num_newvals
)
113 int num_values
= talloc_array_length(mod
->values
);
117 tmp
= talloc_realloc(mem_ctx
, mod
->values
, DATA_BLOB
,
118 num_values
+ num_newvals
);
124 for (i
=0; i
<num_newvals
; i
++) {
125 mod
->values
[i
+num_values
].data
= (uint8_t *)talloc_memdup(
126 mod
->values
, newvals
[i
].data
, newvals
[i
].length
);
127 if (mod
->values
[i
+num_values
].data
== NULL
) {
130 mod
->values
[i
+num_values
].length
= newvals
[i
].length
;
132 mod
->num_values
= num_values
+ num_newvals
;
136 bool tldap_add_mod_blobs(TALLOC_CTX
*mem_ctx
,
137 struct tldap_mod
**pmods
, int *pnum_mods
,
138 int mod_op
, const char *attrib
,
139 DATA_BLOB
*newvals
, int num_newvals
)
141 struct tldap_mod new_mod
;
142 struct tldap_mod
*mods
= *pmods
;
143 struct tldap_mod
*mod
= NULL
;
147 mods
= talloc_array(mem_ctx
, struct tldap_mod
, 0);
153 num_mods
= *pnum_mods
;
155 for (i
=0; i
<num_mods
; i
++) {
156 if ((mods
[i
].mod_op
== mod_op
)
157 && strequal(mods
[i
].attribute
, attrib
)) {
164 new_mod
.mod_op
= mod_op
;
165 new_mod
.attribute
= talloc_strdup(mods
, attrib
);
166 if (new_mod
.attribute
== NULL
) {
169 new_mod
.num_values
= 0;
170 new_mod
.values
= NULL
;
174 if ((num_newvals
!= 0)
175 && !tldap_add_blob_vals(mods
, mod
, newvals
, num_newvals
)) {
179 if ((i
== num_mods
) && (talloc_array_length(mods
) < num_mods
+ 1)) {
180 mods
= talloc_realloc(talloc_tos(), mods
, struct tldap_mod
,
185 mods
[num_mods
] = *mod
;
193 bool tldap_add_mod_str(TALLOC_CTX
*mem_ctx
,
194 struct tldap_mod
**pmods
, int *pnum_mods
,
195 int mod_op
, const char *attrib
, const char *str
)
200 if (!convert_string_talloc(talloc_tos(), CH_UNIX
, CH_UTF8
, str
,
201 strlen(str
), &utf8
.data
, &utf8
.length
,
206 ret
= tldap_add_mod_blobs(mem_ctx
, pmods
, pnum_mods
, mod_op
, attrib
,
208 TALLOC_FREE(utf8
.data
);
212 static bool tldap_make_mod_blob_int(struct tldap_message
*existing
,
214 struct tldap_mod
**pmods
, int *pnum_mods
,
215 const char *attrib
, DATA_BLOB newval
,
216 int (*comparison
)(const DATA_BLOB
*d1
,
217 const DATA_BLOB
*d2
))
220 DATA_BLOB
*values
= NULL
;
221 DATA_BLOB oldval
= data_blob_null
;
223 if ((existing
!= NULL
)
224 && tldap_entry_values(existing
, attrib
, &values
, &num_values
)) {
226 if (num_values
> 1) {
227 /* can't change multivalue attributes atm */
230 if (num_values
== 1) {
235 if ((oldval
.data
!= NULL
) && (newval
.data
!= NULL
)
236 && (comparison(&oldval
, &newval
) == 0)) {
237 /* Believe it or not, but LDAP will deny a delete and
238 an add at the same time if the values are the
240 DEBUG(10,("tldap_make_mod_blob_int: attribute |%s| not "
241 "changed.\n", attrib
));
245 if (oldval
.data
!= NULL
) {
246 /* By deleting exactly the value we found in the entry this
247 * should be race-free in the sense that the LDAP-Server will
248 * deny the complete operation if somebody changed the
249 * attribute behind our back. */
250 /* This will also allow modifying single valued attributes in
251 * Novell NDS. In NDS you have to first remove attribute and
252 * then you could add new value */
254 DEBUG(10, ("tldap_make_mod_blob_int: deleting attribute |%s|\n",
256 if (!tldap_add_mod_blobs(mem_ctx
, pmods
, pnum_mods
,
258 attrib
, &oldval
, 1)) {
263 /* Regardless of the real operation (add or modify)
264 we add the new value here. We rely on deleting
265 the old value, should it exist. */
267 if (newval
.data
!= NULL
) {
268 DEBUG(10, ("tldap_make_mod_blob_int: adding attribute |%s| value len "
269 "%d\n", attrib
, (int)newval
.length
));
270 if (!tldap_add_mod_blobs(mem_ctx
, pmods
, pnum_mods
,
272 attrib
, &newval
, 1)) {
279 bool tldap_make_mod_blob(struct tldap_message
*existing
, TALLOC_CTX
*mem_ctx
,
280 struct tldap_mod
**pmods
, int *pnum_mods
,
281 const char *attrib
, DATA_BLOB newval
)
283 return tldap_make_mod_blob_int(existing
, mem_ctx
, pmods
, pnum_mods
,
284 attrib
, newval
, data_blob_cmp
);
287 static int compare_utf8_blobs(const DATA_BLOB
*d1
, const DATA_BLOB
*d2
)
293 if (!convert_string_talloc(talloc_tos(), CH_UTF8
, CH_UNIX
, d1
->data
,
294 d1
->length
, &s1
, &s1len
, false)) {
295 /* can't do much here */
298 if (!convert_string_talloc(talloc_tos(), CH_UTF8
, CH_UNIX
, d2
->data
,
299 d2
->length
, &s2
, &s2len
, false)) {
300 /* can't do much here */
304 ret
= StrCaseCmp(s1
, s2
);
310 bool tldap_make_mod_fmt(struct tldap_message
*existing
, TALLOC_CTX
*mem_ctx
,
311 struct tldap_mod
**pmods
, int *pnum_mods
,
312 const char *attrib
, const char *fmt
, ...)
317 DATA_BLOB blob
= data_blob_null
;
320 newval
= talloc_vasprintf(talloc_tos(), fmt
, ap
);
323 if (newval
== NULL
) {
327 blob
.length
= strlen(newval
);
328 if (blob
.length
!= 0) {
329 blob
.data
= CONST_DISCARD(uint8_t *, newval
);
331 ret
= tldap_make_mod_blob_int(existing
, mem_ctx
, pmods
, pnum_mods
,
332 attrib
, blob
, compare_utf8_blobs
);
337 const char *tldap_errstr(TALLOC_CTX
*mem_ctx
, struct tldap_context
*ld
, int rc
)
339 const char *ld_error
= NULL
;
343 ld_error
= tldap_msg_diagnosticmessage(tldap_ctx_lastmsg(ld
));
345 res
= talloc_asprintf(mem_ctx
, "LDAP error %d (%s), %s", rc
,
346 tldap_err2string(rc
),
347 ld_error
? ld_error
: "unknown");
351 int tldap_search_va(struct tldap_context
*ld
, const char *base
, int scope
,
352 const char *attrs
[], int num_attrs
, int attrsonly
,
353 TALLOC_CTX
*mem_ctx
, struct tldap_message
***res
,
354 const char *fmt
, va_list ap
)
359 filter
= talloc_vasprintf(talloc_tos(), fmt
, ap
);
360 if (filter
== NULL
) {
361 return TLDAP_NO_MEMORY
;
364 ret
= tldap_search(ld
, base
, scope
, filter
,
365 attrs
, num_attrs
, attrsonly
,
366 NULL
/*sctrls*/, 0, NULL
/*cctrls*/, 0,
367 0 /*timelimit*/, 0 /*sizelimit*/, 0 /*deref*/,
373 int tldap_search_fmt(struct tldap_context
*ld
, const char *base
, int scope
,
374 const char *attrs
[], int num_attrs
, int attrsonly
,
375 TALLOC_CTX
*mem_ctx
, struct tldap_message
***res
,
376 const char *fmt
, ...)
382 ret
= tldap_search_va(ld
, base
, scope
, attrs
, num_attrs
, attrsonly
,
383 mem_ctx
, res
, fmt
, ap
);
388 bool tldap_pull_uint64(struct tldap_message
*msg
, const char *attr
,
394 str
= tldap_talloc_single_attribute(msg
, attr
, talloc_tos());
396 DEBUG(10, ("Could not find attribute %s\n", attr
));
399 result
= strtoull(str
, NULL
, 10);
405 bool tldap_pull_uint32(struct tldap_message
*msg
, const char *attr
,
410 if (!tldap_pull_uint64(msg
, attr
, &result
)) {
413 *presult
= (uint32_t)result
;
417 struct tldap_fetch_rootdse_state
{
418 struct tldap_context
*ld
;
419 struct tldap_message
*rootdse
;
422 static void tldap_fetch_rootdse_done(struct tevent_req
*subreq
);
424 struct tevent_req
*tldap_fetch_rootdse_send(TALLOC_CTX
*mem_ctx
,
425 struct tevent_context
*ev
,
426 struct tldap_context
*ld
)
428 struct tevent_req
*req
, *subreq
;
429 struct tldap_fetch_rootdse_state
*state
;
430 static const char *attrs
[2] = { "*", "+" };
432 req
= tevent_req_create(mem_ctx
, &state
,
433 struct tldap_fetch_rootdse_state
);
438 state
->rootdse
= NULL
;
440 subreq
= tldap_search_send(
441 mem_ctx
, ev
, ld
, "", TLDAP_SCOPE_BASE
, "(objectclass=*)",
442 attrs
, ARRAY_SIZE(attrs
), 0, NULL
, 0, NULL
, 0, 0, 0, 0);
443 if (tevent_req_nomem(subreq
, req
)) {
444 return tevent_req_post(req
, ev
);
446 tevent_req_set_callback(subreq
, tldap_fetch_rootdse_done
, req
);
450 static void tldap_fetch_rootdse_done(struct tevent_req
*subreq
)
452 struct tevent_req
*req
= tevent_req_callback_data(
453 subreq
, struct tevent_req
);
454 struct tldap_fetch_rootdse_state
*state
= tevent_req_data(
455 req
, struct tldap_fetch_rootdse_state
);
456 struct tldap_message
*msg
;
459 rc
= tldap_search_recv(subreq
, state
, &msg
);
460 if (rc
!= TLDAP_SUCCESS
) {
462 tevent_req_error(req
, rc
);
466 switch (tldap_msg_type(msg
)) {
467 case TLDAP_RES_SEARCH_ENTRY
:
468 if (state
->rootdse
!= NULL
) {
471 state
->rootdse
= msg
;
473 case TLDAP_RES_SEARCH_RESULT
:
475 if (state
->rootdse
== NULL
) {
478 tevent_req_done(req
);
486 tevent_req_error(req
, TLDAP_PROTOCOL_ERROR
);
490 int tldap_fetch_rootdse_recv(struct tevent_req
*req
)
492 struct tldap_fetch_rootdse_state
*state
= tevent_req_data(
493 req
, struct tldap_fetch_rootdse_state
);
497 if (tevent_req_is_ldap_error(req
, &err
)) {
500 /* Trigger parsing the dn, just to make sure it's ok */
501 if (!tldap_entry_dn(state
->rootdse
, &dn
)) {
502 return TLDAP_DECODING_ERROR
;
504 if (!tldap_context_setattr(state
->ld
, "tldap:rootdse",
506 return TLDAP_NO_MEMORY
;
511 int tldap_fetch_rootdse(struct tldap_context
*ld
)
513 TALLOC_CTX
*frame
= talloc_stackframe();
514 struct tevent_context
*ev
;
515 struct tevent_req
*req
;
518 ev
= event_context_init(frame
);
520 result
= TLDAP_NO_MEMORY
;
524 req
= tldap_fetch_rootdse_send(frame
, ev
, ld
);
526 result
= TLDAP_NO_MEMORY
;
530 if (!tevent_req_poll(req
, ev
)) {
531 result
= TLDAP_OPERATIONS_ERROR
;
535 result
= tldap_fetch_rootdse_recv(req
);
541 struct tldap_message
*tldap_rootdse(struct tldap_context
*ld
)
543 return talloc_get_type(tldap_context_getattr(ld
, "tldap:rootdse"),
544 struct tldap_message
);
547 bool tldap_entry_has_attrvalue(struct tldap_message
*msg
,
548 const char *attribute
,
549 const DATA_BLOB blob
)
554 if (!tldap_entry_values(msg
, attribute
, &values
, &num_values
)) {
557 for (i
=0; i
<num_values
; i
++) {
558 if (data_blob_cmp(&values
[i
], &blob
) == 0) {
565 bool tldap_supports_control(struct tldap_context
*ld
, const char *oid
)
567 struct tldap_message
*rootdse
= tldap_rootdse(ld
);
569 if (rootdse
== NULL
) {
572 return tldap_entry_has_attrvalue(rootdse
, "supportedControl",
573 data_blob_const(oid
, strlen(oid
)));
576 struct tldap_control
*tldap_add_control(TALLOC_CTX
*mem_ctx
,
577 struct tldap_control
*ctrls
,
579 struct tldap_control
*ctrl
)
581 struct tldap_control
*result
;
583 result
= talloc_array(mem_ctx
, struct tldap_control
, num_ctrls
+1);
584 if (result
== NULL
) {
587 memcpy(result
, ctrls
, sizeof(struct tldap_control
) * num_ctrls
);
588 result
[num_ctrls
] = *ctrl
;
593 * Find a control returned by the server
595 struct tldap_control
*tldap_msg_findcontrol(struct tldap_message
*msg
,
598 struct tldap_control
*controls
;
601 tldap_msg_sctrls(msg
, &num_controls
, &controls
);
603 for (i
=0; i
<num_controls
; i
++) {
604 if (strcmp(controls
[i
].oid
, oid
) == 0) {
611 struct tldap_search_paged_state
{
612 struct tevent_context
*ev
;
613 struct tldap_context
*ld
;
620 struct tldap_control
*sctrls
;
622 struct tldap_control
*cctrls
;
629 struct asn1_data
*asn1
;
631 struct tldap_message
*result
;
634 static struct tevent_req
*tldap_ship_paged_search(
636 struct tldap_search_paged_state
*state
)
638 struct tldap_control
*pgctrl
;
639 struct asn1_data
*asn1
;
641 asn1
= asn1_init(state
);
645 asn1_push_tag(asn1
, ASN1_SEQUENCE(0));
646 asn1_write_Integer(asn1
, state
->page_size
);
647 asn1_write_OctetString(asn1
, state
->cookie
.data
, state
->cookie
.length
);
649 if (asn1
->has_error
) {
655 pgctrl
= &state
->sctrls
[state
->num_sctrls
-1];
656 pgctrl
->oid
= TLDAP_CONTROL_PAGEDRESULTS
;
657 pgctrl
->critical
= true;
658 if (!asn1_blob(state
->asn1
, &pgctrl
->value
)) {
662 return tldap_search_send(mem_ctx
, state
->ev
, state
->ld
, state
->base
,
663 state
->scope
, state
->filter
, state
->attrs
,
664 state
->num_attrs
, state
->attrsonly
,
665 state
->sctrls
, state
->num_sctrls
,
666 state
->cctrls
, state
->num_cctrls
,
667 state
->timelimit
, state
->sizelimit
,
671 static void tldap_search_paged_done(struct tevent_req
*subreq
);
673 struct tevent_req
*tldap_search_paged_send(TALLOC_CTX
*mem_ctx
,
674 struct tevent_context
*ev
,
675 struct tldap_context
*ld
,
676 const char *base
, int scope
,
681 struct tldap_control
*sctrls
,
683 struct tldap_control
*cctrls
,
690 struct tevent_req
*req
, *subreq
;
691 struct tldap_search_paged_state
*state
;
692 struct tldap_control empty_control
;
694 req
= tevent_req_create(mem_ctx
, &state
,
695 struct tldap_search_paged_state
);
702 state
->filter
= filter
;
703 state
->scope
= scope
;
704 state
->attrs
= attrs
;
705 state
->num_attrs
= num_attrs
;
706 state
->attrsonly
= attrsonly
;
707 state
->cctrls
= cctrls
;
708 state
->num_cctrls
= num_cctrls
;
709 state
->timelimit
= timelimit
;
710 state
->sizelimit
= sizelimit
;
711 state
->deref
= deref
;
713 state
->page_size
= page_size
;
715 state
->cookie
= data_blob_null
;
717 ZERO_STRUCT(empty_control
);
719 state
->sctrls
= tldap_add_control(state
, sctrls
, num_sctrls
,
721 if (tevent_req_nomem(state
->sctrls
, req
)) {
722 return tevent_req_post(req
, ev
);
724 state
->num_sctrls
= num_sctrls
+1;
726 subreq
= tldap_ship_paged_search(state
, state
);
727 if (tevent_req_nomem(subreq
, req
)) {
728 return tevent_req_post(req
, ev
);
730 tevent_req_set_callback(subreq
, tldap_search_paged_done
, req
);
735 static void tldap_search_paged_done(struct tevent_req
*subreq
)
737 struct tevent_req
*req
= tevent_req_callback_data(
738 subreq
, struct tevent_req
);
739 struct tldap_search_paged_state
*state
= tevent_req_data(
740 req
, struct tldap_search_paged_state
);
741 struct asn1_data
*asn1
;
742 struct tldap_control
*pgctrl
;
745 rc
= tldap_search_recv(subreq
, state
, &state
->result
);
746 if (rc
!= TLDAP_SUCCESS
) {
748 tevent_req_error(req
, rc
);
752 TALLOC_FREE(state
->asn1
);
754 switch (tldap_msg_type(state
->result
)) {
755 case TLDAP_RES_SEARCH_ENTRY
:
756 case TLDAP_RES_SEARCH_REFERENCE
:
757 tevent_req_notify_callback(req
);
759 case TLDAP_RES_SEARCH_RESULT
:
763 tevent_req_error(req
, TLDAP_PROTOCOL_ERROR
);
769 /* We've finished one paged search, fire the next */
771 pgctrl
= tldap_msg_findcontrol(state
->result
,
772 TLDAP_CONTROL_PAGEDRESULTS
);
773 if (pgctrl
== NULL
) {
774 /* RFC2696 requires the server to return the control */
775 tevent_req_error(req
, TLDAP_PROTOCOL_ERROR
);
779 TALLOC_FREE(state
->cookie
.data
);
781 asn1
= asn1_init(talloc_tos());
783 tevent_req_error(req
, TLDAP_NO_MEMORY
);
787 asn1_load_nocopy(asn1
, pgctrl
->value
.data
, pgctrl
->value
.length
);
788 asn1_start_tag(asn1
, ASN1_SEQUENCE(0));
789 asn1_read_Integer(asn1
, &size
);
790 asn1_read_OctetString(asn1
, state
, &state
->cookie
);
792 if (asn1
->has_error
) {
793 tevent_req_error(req
, TLDAP_DECODING_ERROR
);
798 if (state
->cookie
.length
== 0) {
799 /* We're done, no cookie anymore */
800 tevent_req_done(req
);
804 TALLOC_FREE(state
->result
);
806 subreq
= tldap_ship_paged_search(state
, state
);
807 if (tevent_req_nomem(subreq
, req
)) {
810 tevent_req_set_callback(subreq
, tldap_search_paged_done
, req
);
813 int tldap_search_paged_recv(struct tevent_req
*req
, TALLOC_CTX
*mem_ctx
,
814 struct tldap_message
**pmsg
)
816 struct tldap_search_paged_state
*state
= tevent_req_data(
817 req
, struct tldap_search_paged_state
);
820 if (!tevent_req_is_in_progress(req
)
821 && tevent_req_is_ldap_error(req
, &err
)) {
824 if (tevent_req_is_in_progress(req
)) {
825 switch (tldap_msg_type(state
->result
)) {
826 case TLDAP_RES_SEARCH_ENTRY
:
827 case TLDAP_RES_SEARCH_REFERENCE
:
830 return TLDAP_PROTOCOL_ERROR
;
833 *pmsg
= talloc_move(mem_ctx
, &state
->result
);
834 return TLDAP_SUCCESS
;