?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
vfs_acl_xattr: objects without NT ACL xattr
[Samba.git] / libcli / ldap / ldap_message.c
blob76d2ee95c94fd969faa947a5c4b85c97d393bfe0
1 /*
2 Unix SMB/CIFS mplementation.
3 LDAP protocol helper functions for SAMBA
4
5 Copyright (C) Andrew Tridgell 2004
6 Copyright (C) Volker Lendecke 2004
7 Copyright (C) Stefan Metzmacher 2004
8 Copyright (C) Simo Sorce 2004
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22
23 */
24
25 #include "includes.h"
26 #include "../lib/util/asn1.h"
27 #include "../libcli/ldap/ldap_message.h"
28
29 _PUBLIC_ struct ldap_message *new_ldap_message(TALLOC_CTX *mem_ctx)
30 {
31 return talloc_zero(mem_ctx, struct ldap_message);
32 }
33
34
35 static bool add_value_to_attrib(TALLOC_CTX *mem_ctx, struct ldb_val *value,
36 struct ldb_message_element *attrib)
37 {
38 attrib->values = talloc_realloc(mem_ctx,
39 attrib->values,
40 DATA_BLOB,
41 attrib->num_values+1);
42 if (attrib->values == NULL)
43 return false;
44
45 attrib->values[attrib->num_values].data = talloc_steal(attrib->values,
46 value->data);
47 attrib->values[attrib->num_values].length = value->length;
48 attrib->num_values += 1;
49 return true;
50 }
51
52 static bool add_attrib_to_array_talloc(TALLOC_CTX *mem_ctx,
53 const struct ldb_message_element *attrib,
54 struct ldb_message_element **attribs,
55 int *num_attribs)
56 {
57 *attribs = talloc_realloc(mem_ctx,
58 *attribs,
59 struct ldb_message_element,
60 *num_attribs+1);
61
62 if (*attribs == NULL)
63 return false;
64
65 (*attribs)[*num_attribs] = *attrib;
66 talloc_steal(*attribs, attrib->values);
67 talloc_steal(*attribs, attrib->name);
68 *num_attribs += 1;
69 return true;
70 }
71
72 static bool add_mod_to_array_talloc(TALLOC_CTX *mem_ctx,
73 struct ldap_mod *mod,
74 struct ldap_mod **mods,
75 int *num_mods)
76 {
77 *mods = talloc_realloc(mem_ctx, *mods, struct ldap_mod, (*num_mods)+1);
78
79 if (*mods == NULL)
80 return false;
81
82 (*mods)[*num_mods] = *mod;
83 *num_mods += 1;
84 return true;
85 }
86
87 static bool ldap_decode_control_value(void *mem_ctx, DATA_BLOB value,
88 const struct ldap_control_handler *handlers,
89 struct ldb_control *ctrl)
90 {
91 int i;
92
93 if (!handlers) {
94 return true;
95 }
96
97 for (i = 0; handlers[i].oid != NULL; i++) {
98 if (strcmp(handlers[i].oid, ctrl->oid) == 0) {
99 if (!handlers[i].decode || !handlers[i].decode(mem_ctx, value, &ctrl->data)) {
100 return false;
101 }
102 break;
103 }
104 }
105 if (handlers[i].oid == NULL) {
106 return false;
107 }
108
109 return true;
110 }
111
112 static bool ldap_decode_control_wrapper(void *mem_ctx, struct asn1_data *data,
113 struct ldb_control *ctrl, DATA_BLOB *value)
114 {
115 DATA_BLOB oid;
116
117 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
118 return false;
119 }
120
121 if (!asn1_read_OctetString(data, mem_ctx, &oid)) {
122 return false;
123 }
124 ctrl->oid = talloc_strndup(mem_ctx, (char *)oid.data, oid.length);
125 if (!ctrl->oid) {
126 return false;
127 }
128
129 if (asn1_peek_tag(data, ASN1_BOOLEAN)) {
130 bool critical;
131 if (!asn1_read_BOOLEAN(data, &critical)) {
132 return false;
133 }
134 ctrl->critical = critical;
135 } else {
136 ctrl->critical = false;
137 }
138
139 ctrl->data = NULL;
140
141 if (!asn1_peek_tag(data, ASN1_OCTET_STRING)) {
142 *value = data_blob(NULL, 0);
143 goto end_tag;
144 }
145
146 if (!asn1_read_OctetString(data, mem_ctx, value)) {
147 return false;
148 }
149
150 end_tag:
151 if (!asn1_end_tag(data)) {
152 return false;
153 }
154
155 return true;
156 }
157
158 static bool ldap_encode_control(void *mem_ctx, struct asn1_data *data,
159 const struct ldap_control_handler *handlers,
160 struct ldb_control *ctrl)
161 {
162 DATA_BLOB value;
163 int i;
164
165 if (!handlers) {
166 return false;
167 }
168
169 for (i = 0; handlers[i].oid != NULL; i++) {
170 if (!ctrl->oid) {
171 /* not encoding this control, the OID has been
172 * set to NULL indicating it isn't really
173 * here */
174 return true;
175 }
176 if (strcmp(handlers[i].oid, ctrl->oid) == 0) {
177 if (!handlers[i].encode) {
178 if (ctrl->critical) {
179 return false;
180 } else {
181 /* not encoding this control */
182 return true;
183 }
184 }
185 if (!handlers[i].encode(mem_ctx, ctrl->data, &value)) {
186 return false;
187 }
188 break;
189 }
190 }
191 if (handlers[i].oid == NULL) {
192 return false;
193 }
194
195 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) {
196 return false;
197 }
198
199 if (!asn1_write_OctetString(data, ctrl->oid, strlen(ctrl->oid))) {
200 return false;
201 }
202
203 if (ctrl->critical) {
204 if (!asn1_write_BOOLEAN(data, ctrl->critical)) {
205 return false;
206 }
207 }
208
209 if (!ctrl->data) {
210 goto pop_tag;
211 }
212
213 if (!asn1_write_OctetString(data, value.data, value.length)) {
214 return false;
215 }
216
217 pop_tag:
218 if (!asn1_pop_tag(data)) {
219 return false;
220 }
221
222 return true;
223 }
224
225 static bool ldap_push_filter(struct asn1_data *data, struct ldb_parse_tree *tree)
226 {
227 int i;
228
229 switch (tree->operation) {
230 case LDB_OP_AND:
231 case LDB_OP_OR:
232 if (!asn1_push_tag(data, ASN1_CONTEXT(tree->operation==LDB_OP_AND?0:1))) return false;
233 for (i=0; i<tree->u.list.num_elements; i++) {
234 if (!ldap_push_filter(data, tree->u.list.elements[i])) {
235 return false;
236 }
237 }
238 if (!asn1_pop_tag(data)) return false;
239 break;
240
241 case LDB_OP_NOT:
242 if (!asn1_push_tag(data, ASN1_CONTEXT(2))) return false;
243 if (!ldap_push_filter(data, tree->u.isnot.child)) {
244 return false;
245 }
246 if (!asn1_pop_tag(data)) return false;
247 break;
248
249 case LDB_OP_EQUALITY:
250 /* equality test */
251 if (!asn1_push_tag(data, ASN1_CONTEXT(3))) return false;
252 if (!asn1_write_OctetString(data, tree->u.equality.attr,
253 strlen(tree->u.equality.attr))) return false;
254 if (!asn1_write_OctetString(data, tree->u.equality.value.data,
255 tree->u.equality.value.length)) return false;
256 if (!asn1_pop_tag(data)) return false;
257 break;
258
259 case LDB_OP_SUBSTRING:
260 /*
261 SubstringFilter ::= SEQUENCE {
262 type AttributeDescription,
263 -- at least one must be present
264 substrings SEQUENCE OF CHOICE {
265 initial [0] LDAPString,
266 any [1] LDAPString,
267 final [2] LDAPString } }
268 */
269 if (!asn1_push_tag(data, ASN1_CONTEXT(4))) return false;
270 if (!asn1_write_OctetString(data, tree->u.substring.attr, strlen(tree->u.substring.attr))) return false;
271 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) return false;
272
273 if (tree->u.substring.chunks && tree->u.substring.chunks[0]) {
274 i = 0;
275 if (!tree->u.substring.start_with_wildcard) {
276 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0))) return false;
277 if (!asn1_write_DATA_BLOB_LDAPString(data, tree->u.substring.chunks[i])) return false;
278 if (!asn1_pop_tag(data)) return false;
279 i++;
280 }
281 while (tree->u.substring.chunks[i]) {
282 int ctx;
283
284 if (( ! tree->u.substring.chunks[i + 1]) &&
285 (tree->u.substring.end_with_wildcard == 0)) {
286 ctx = 2;
287 } else {
288 ctx = 1;
289 }
290 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(ctx))) return false;
291 if (!asn1_write_DATA_BLOB_LDAPString(data, tree->u.substring.chunks[i])) return false;
292 if (!asn1_pop_tag(data)) return false;
293 i++;
294 }
295 }
296 if (!asn1_pop_tag(data)) return false;
297 if (!asn1_pop_tag(data)) return false;
298 break;
299
300 case LDB_OP_GREATER:
301 /* greaterOrEqual test */
302 if (!asn1_push_tag(data, ASN1_CONTEXT(5))) return false;
303 if (!asn1_write_OctetString(data, tree->u.comparison.attr,
304 strlen(tree->u.comparison.attr))) return false;
305 if (!asn1_write_OctetString(data, tree->u.comparison.value.data,
306 tree->u.comparison.value.length)) return false;
307 if (!asn1_pop_tag(data)) return false;
308 break;
309
310 case LDB_OP_LESS:
311 /* lessOrEqual test */
312 if (!asn1_push_tag(data, ASN1_CONTEXT(6))) return false;
313 if (!asn1_write_OctetString(data, tree->u.comparison.attr,
314 strlen(tree->u.comparison.attr))) return false;
315 if (!asn1_write_OctetString(data, tree->u.comparison.value.data,
316 tree->u.comparison.value.length)) return false;
317 if (!asn1_pop_tag(data)) return false;
318 break;
319
320 case LDB_OP_PRESENT:
321 /* present test */
322 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(7))) return false;
323 if (!asn1_write_LDAPString(data, tree->u.present.attr)) return false;
324 if (!asn1_pop_tag(data)) return false;
325 return !asn1_has_error(data);
326
327 case LDB_OP_APPROX:
328 /* approx test */
329 if (!asn1_push_tag(data, ASN1_CONTEXT(8))) return false;
330 if (!asn1_write_OctetString(data, tree->u.comparison.attr,
331 strlen(tree->u.comparison.attr))) return false;
332 if (!asn1_write_OctetString(data, tree->u.comparison.value.data,
333 tree->u.comparison.value.length)) return false;
334 if (!asn1_pop_tag(data)) return false;
335 break;
336
337 case LDB_OP_EXTENDED:
338 /*
339 MatchingRuleAssertion ::= SEQUENCE {
340 matchingRule [1] MatchingRuleID OPTIONAL,
341 type [2] AttributeDescription OPTIONAL,
342 matchValue [3] AssertionValue,
343 dnAttributes [4] BOOLEAN DEFAULT FALSE
344 }
345 */
346 if (!asn1_push_tag(data, ASN1_CONTEXT(9))) return false;
347 if (tree->u.extended.rule_id) {
348 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(1))) return false;
349 if (!asn1_write_LDAPString(data, tree->u.extended.rule_id)) return false;
350 if (!asn1_pop_tag(data)) return false;
351 }
352 if (tree->u.extended.attr) {
353 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(2))) return false;
354 if (!asn1_write_LDAPString(data, tree->u.extended.attr)) return false;
355 if (!asn1_pop_tag(data)) return false;
356 }
357 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(3))) return false;
358 if (!asn1_write_DATA_BLOB_LDAPString(data, &tree->u.extended.value)) return false;
359 if (!asn1_pop_tag(data)) return false;
360 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(4))) return false;
361 if (!asn1_write_uint8(data, tree->u.extended.dnAttributes)) return false;
362 if (!asn1_pop_tag(data)) return false;
363 if (!asn1_pop_tag(data)) return false;
364 break;
365
366 default:
367 return false;
368 }
369 return !asn1_has_error(data);
370 }
371
372 static bool ldap_encode_response(struct asn1_data *data, struct ldap_Result *result)
373 {
374 if (!asn1_write_enumerated(data, result->resultcode)) return false;
375 if (!asn1_write_OctetString(data, result->dn,
376 (result->dn) ? strlen(result->dn) : 0)) return false;
377 if (!asn1_write_OctetString(data, result->errormessage,
378 (result->errormessage) ?
379 strlen(result->errormessage) : 0)) return false;
380 if (result->referral) {
381 if (!asn1_push_tag(data, ASN1_CONTEXT(3))) return false;
382 if (!asn1_write_OctetString(data, result->referral,
383 strlen(result->referral))) return false;
384 if (!asn1_pop_tag(data)) return false;
385 }
386 return true;
387 }
388
389 _PUBLIC_ bool ldap_encode(struct ldap_message *msg,
390 const struct ldap_control_handler *control_handlers,
391 DATA_BLOB *result, TALLOC_CTX *mem_ctx)
392 {
393 struct asn1_data *data = asn1_init(mem_ctx);
394 int i, j;
395
396 if (!data) return false;
397
398 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
399 if (!asn1_write_Integer(data, msg->messageid)) goto err;
400
401 switch (msg->type) {
402 case LDAP_TAG_BindRequest: {
403 struct ldap_BindRequest *r = &msg->r.BindRequest;
404 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
405 if (!asn1_write_Integer(data, r->version)) goto err;
406 if (!asn1_write_OctetString(data, r->dn,
407 (r->dn != NULL) ? strlen(r->dn) : 0)) goto err;
408
409 switch (r->mechanism) {
410 case LDAP_AUTH_MECH_SIMPLE:
411 /* context, primitive */
412 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0))) goto err;
413 if (!asn1_write(data, r->creds.password,
414 strlen(r->creds.password))) goto err;
415 if (!asn1_pop_tag(data)) goto err;
416 break;
417 case LDAP_AUTH_MECH_SASL:
418 /* context, constructed */
419 if (!asn1_push_tag(data, ASN1_CONTEXT(3))) goto err;
420 if (!asn1_write_OctetString(data, r->creds.SASL.mechanism,
421 strlen(r->creds.SASL.mechanism))) goto err;
422 if (r->creds.SASL.secblob) {
423 if (!asn1_write_OctetString(data, r->creds.SASL.secblob->data,
424 r->creds.SASL.secblob->length)) goto err;
425 }
426 if (!asn1_pop_tag(data)) goto err;
427 break;
428 default:
429 goto err;
430 }
431
432 if (!asn1_pop_tag(data)) goto err;
433 break;
434 }
435 case LDAP_TAG_BindResponse: {
436 struct ldap_BindResponse *r = &msg->r.BindResponse;
437 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
438 if (!ldap_encode_response(data, &r->response)) goto err;
439 if (r->SASL.secblob) {
440 if (!asn1_write_ContextSimple(data, 7, r->SASL.secblob)) goto err;
441 }
442 if (!asn1_pop_tag(data)) goto err;
443 break;
444 }
445 case LDAP_TAG_UnbindRequest: {
446 /* struct ldap_UnbindRequest *r = &msg->r.UnbindRequest; */
447 if (!asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type))) goto err;
448 if (!asn1_pop_tag(data)) goto err;
449 break;
450 }
451 case LDAP_TAG_SearchRequest: {
452 struct ldap_SearchRequest *r = &msg->r.SearchRequest;
453 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
454 if (!asn1_write_OctetString(data, r->basedn, strlen(r->basedn))) goto err;
455 if (!asn1_write_enumerated(data, r->scope)) goto err;
456 if (!asn1_write_enumerated(data, r->deref)) goto err;
457 if (!asn1_write_Integer(data, r->sizelimit)) goto err;
458 if (!asn1_write_Integer(data, r->timelimit)) goto err;
459 if (!asn1_write_BOOLEAN(data, r->attributesonly)) goto err;
460
461 if (!ldap_push_filter(data, r->tree)) {
462 goto err;
463 }
464
465 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
466 for (i=0; i<r->num_attributes; i++) {
467 if (!asn1_write_OctetString(data, r->attributes[i],
468 strlen(r->attributes[i]))) goto err;
469 }
470 if (!asn1_pop_tag(data)) goto err;
471 if (!asn1_pop_tag(data)) goto err;
472 break;
473 }
474 case LDAP_TAG_SearchResultEntry: {
475 struct ldap_SearchResEntry *r = &msg->r.SearchResultEntry;
476 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
477 if (!asn1_write_OctetString(data, r->dn, strlen(r->dn))) goto err;
478 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
479 for (i=0; i<r->num_attributes; i++) {
480 struct ldb_message_element *attr = &r->attributes[i];
481 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
482 if (!asn1_write_OctetString(data, attr->name,
483 strlen(attr->name))) goto err;
484 if (!asn1_push_tag(data, ASN1_SEQUENCE(1))) goto err;
485 for (j=0; j<attr->num_values; j++) {
486 if (!asn1_write_OctetString(data,
487 attr->values[j].data,
488 attr->values[j].length)) goto err;
489 }
490 if (!asn1_pop_tag(data)) goto err;
491 if (!asn1_pop_tag(data)) goto err;
492 }
493 if (!asn1_pop_tag(data)) goto err;
494 if (!asn1_pop_tag(data)) goto err;
495 break;
496 }
497 case LDAP_TAG_SearchResultDone: {
498 struct ldap_Result *r = &msg->r.SearchResultDone;
499 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
500 if (!ldap_encode_response(data, r)) goto err;
501 if (!asn1_pop_tag(data)) goto err;
502 break;
503 }
504 case LDAP_TAG_ModifyRequest: {
505 struct ldap_ModifyRequest *r = &msg->r.ModifyRequest;
506 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
507 if (!asn1_write_OctetString(data, r->dn, strlen(r->dn))) goto err;
508 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
509
510 for (i=0; i<r->num_mods; i++) {
511 struct ldb_message_element *attrib = &r->mods[i].attrib;
512 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
513 if (!asn1_write_enumerated(data, r->mods[i].type)) goto err;
514 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
515 if (!asn1_write_OctetString(data, attrib->name,
516 strlen(attrib->name))) goto err;
517 if (!asn1_push_tag(data, ASN1_SET)) goto err;
518 for (j=0; j<attrib->num_values; j++) {
519 if (!asn1_write_OctetString(data,
520 attrib->values[j].data,
521 attrib->values[j].length)) goto err;
522
523 }
524 if (!asn1_pop_tag(data)) goto err;
525 if (!asn1_pop_tag(data)) goto err;
526 if (!asn1_pop_tag(data)) goto err;
527 }
528
529 if (!asn1_pop_tag(data)) goto err;
530 if (!asn1_pop_tag(data)) goto err;
531 break;
532 }
533 case LDAP_TAG_ModifyResponse: {
534 struct ldap_Result *r = &msg->r.ModifyResponse;
535 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
536 if (!ldap_encode_response(data, r)) goto err;
537 if (!asn1_pop_tag(data)) goto err;
538 break;
539 }
540 case LDAP_TAG_AddRequest: {
541 struct ldap_AddRequest *r = &msg->r.AddRequest;
542 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
543 if (!asn1_write_OctetString(data, r->dn, strlen(r->dn))) goto err;
544 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
545
546 for (i=0; i<r->num_attributes; i++) {
547 struct ldb_message_element *attrib = &r->attributes[i];
548 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
549 if (!asn1_write_OctetString(data, attrib->name,
550 strlen(attrib->name))) goto err;
551 if (!asn1_push_tag(data, ASN1_SET)) goto err;
552 for (j=0; j<r->attributes[i].num_values; j++) {
553 if (!asn1_write_OctetString(data,
554 attrib->values[j].data,
555 attrib->values[j].length)) goto err;
556 }
557 if (!asn1_pop_tag(data)) goto err;
558 if (!asn1_pop_tag(data)) goto err;
559 }
560 if (!asn1_pop_tag(data)) goto err;
561 if (!asn1_pop_tag(data)) goto err;
562 break;
563 }
564 case LDAP_TAG_AddResponse: {
565 struct ldap_Result *r = &msg->r.AddResponse;
566 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
567 if (!ldap_encode_response(data, r)) goto err;
568 if (!asn1_pop_tag(data)) goto err;
569 break;
570 }
571 case LDAP_TAG_DelRequest: {
572 struct ldap_DelRequest *r = &msg->r.DelRequest;
573 if (!asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type))) goto err;
574 if (!asn1_write(data, r->dn, strlen(r->dn))) goto err;
575 if (!asn1_pop_tag(data)) goto err;
576 break;
577 }
578 case LDAP_TAG_DelResponse: {
579 struct ldap_Result *r = &msg->r.DelResponse;
580 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
581 if (!ldap_encode_response(data, r)) goto err;
582 if (!asn1_pop_tag(data)) goto err;
583 break;
584 }
585 case LDAP_TAG_ModifyDNRequest: {
586 struct ldap_ModifyDNRequest *r = &msg->r.ModifyDNRequest;
587 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
588 if (!asn1_write_OctetString(data, r->dn, strlen(r->dn))) goto err;
589 if (!asn1_write_OctetString(data, r->newrdn, strlen(r->newrdn))) goto err;
590 if (!asn1_write_BOOLEAN(data, r->deleteolddn)) goto err;
591 if (r->newsuperior) {
592 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0))) goto err;
593 if (!asn1_write(data, r->newsuperior,
594 strlen(r->newsuperior))) goto err;
595 if (!asn1_pop_tag(data)) goto err;
596 }
597 if (!asn1_pop_tag(data)) goto err;
598 break;
599 }
600 case LDAP_TAG_ModifyDNResponse: {
601 struct ldap_Result *r = &msg->r.ModifyDNResponse;
602 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
603 if (!ldap_encode_response(data, r)) goto err;
604 if (!asn1_pop_tag(data)) goto err;
605 break;
606 }
607 case LDAP_TAG_CompareRequest: {
608 struct ldap_CompareRequest *r = &msg->r.CompareRequest;
609 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
610 if (!asn1_write_OctetString(data, r->dn, strlen(r->dn))) goto err;
611 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) goto err;
612 if (!asn1_write_OctetString(data, r->attribute,
613 strlen(r->attribute))) goto err;
614 if (!asn1_write_OctetString(data, r->value.data,
615 r->value.length)) goto err;
616 if (!asn1_pop_tag(data)) goto err;
617 if (!asn1_pop_tag(data)) goto err;
618 break;
619 }
620 case LDAP_TAG_CompareResponse: {
621 struct ldap_Result *r = &msg->r.ModifyDNResponse;
622 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
623 if (!ldap_encode_response(data, r)) goto err;
624 if (!asn1_pop_tag(data)) goto err;
625 break;
626 }
627 case LDAP_TAG_AbandonRequest: {
628 struct ldap_AbandonRequest *r = &msg->r.AbandonRequest;
629 if (!asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type))) goto err;
630 if (!asn1_write_implicit_Integer(data, r->messageid)) goto err;
631 if (!asn1_pop_tag(data)) goto err;
632 break;
633 }
634 case LDAP_TAG_SearchResultReference: {
635 struct ldap_SearchResRef *r = &msg->r.SearchResultReference;
636 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
637 if (!asn1_write_OctetString(data, r->referral, strlen(r->referral))) goto err;
638 if (!asn1_pop_tag(data)) goto err;
639 break;
640 }
641 case LDAP_TAG_ExtendedRequest: {
642 struct ldap_ExtendedRequest *r = &msg->r.ExtendedRequest;
643 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
644 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0))) goto err;
645 if (!asn1_write(data, r->oid, strlen(r->oid))) goto err;
646 if (!asn1_pop_tag(data)) goto err;
647 if (r->value) {
648 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(1))) goto err;
649 if (!asn1_write(data, r->value->data, r->value->length)) goto err;
650 if (!asn1_pop_tag(data)) goto err;
651 }
652 if (!asn1_pop_tag(data)) goto err;
653 break;
654 }
655 case LDAP_TAG_ExtendedResponse: {
656 struct ldap_ExtendedResponse *r = &msg->r.ExtendedResponse;
657 if (!asn1_push_tag(data, ASN1_APPLICATION(msg->type))) goto err;
658 if (!ldap_encode_response(data, &r->response)) goto err;
659 if (r->oid) {
660 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(10))) goto err;
661 if (!asn1_write(data, r->oid, strlen(r->oid))) goto err;
662 if (!asn1_pop_tag(data)) goto err;
663 }
664 if (r->value) {
665 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(11))) goto err;
666 if (!asn1_write(data, r->value->data, r->value->length)) goto err;
667 if (!asn1_pop_tag(data)) goto err;
668 }
669 if (!asn1_pop_tag(data)) goto err;
670 break;
671 }
672 default:
673 goto err;
674 }
675
676 if (msg->controls != NULL) {
677 if (!asn1_push_tag(data, ASN1_CONTEXT(0))) goto err;
678
679 for (i = 0; msg->controls[i] != NULL; i++) {
680 if (!ldap_encode_control(mem_ctx, data,
681 control_handlers,
682 msg->controls[i])) {
683 DEBUG(0,("Unable to encode control %s\n",
684 msg->controls[i]->oid));
685 goto err;
686 }
687 }
688
689 if (!asn1_pop_tag(data)) goto err;
690 }
691
692 if (!asn1_pop_tag(data)) goto err;
693
694 if (!asn1_extract_blob(data, mem_ctx, result)) {
695 goto err;
696 }
697
698 asn1_free(data);
699
700 return true;
701
702 err:
703
704 asn1_free(data);
705 return false;
706 }
707
708 static const char *blob2string_talloc(TALLOC_CTX *mem_ctx,
709 DATA_BLOB blob)
710 {
711 char *result = talloc_array(mem_ctx, char, blob.length+1);
712 if (result == NULL) {
713 return NULL;
714 }
715 memcpy(result, blob.data, blob.length);
716 result[blob.length] = '\0';
717 return result;
718 }
719
720 bool asn1_read_OctetString_talloc(TALLOC_CTX *mem_ctx,
721 struct asn1_data *data,
722 const char **result)
723 {
724 DATA_BLOB string;
725 if (!asn1_read_OctetString(data, mem_ctx, &string))
726 return false;
727 *result = blob2string_talloc(mem_ctx, string);
728 data_blob_free(&string);
729 return *result ? true : false;
730 }
731
732 static bool ldap_decode_response(TALLOC_CTX *mem_ctx,
733 struct asn1_data *data,
734 struct ldap_Result *result)
735 {
736 if (!asn1_read_enumerated(data, &result->resultcode)) return false;
737 if (!asn1_read_OctetString_talloc(mem_ctx, data, &result->dn)) return false;
738 if (!asn1_read_OctetString_talloc(mem_ctx, data, &result->errormessage)) return false;
739 if (asn1_peek_tag(data, ASN1_CONTEXT(3))) {
740 if (!asn1_start_tag(data, ASN1_CONTEXT(3))) return false;
741 if (!asn1_read_OctetString_talloc(mem_ctx, data, &result->referral)) return false;
742 if (!asn1_end_tag(data)) return false;
743 } else {
744 result->referral = NULL;
745 }
746 return true;
747 }
748
749 static struct ldb_val **ldap_decode_substring(TALLOC_CTX *mem_ctx, struct ldb_val **chunks, int chunk_num, char *value)
750 {
751
752 chunks = talloc_realloc(mem_ctx, chunks, struct ldb_val *, chunk_num + 2);
753 if (chunks == NULL) {
754 return NULL;
755 }
756
757 chunks[chunk_num] = talloc(mem_ctx, struct ldb_val);
758 if (chunks[chunk_num] == NULL) {
759 return NULL;
760 }
761
762 chunks[chunk_num]->data = (uint8_t *)talloc_strdup(mem_ctx, value);
763 if (chunks[chunk_num]->data == NULL) {
764 return NULL;
765 }
766 chunks[chunk_num]->length = strlen(value);
767
768 chunks[chunk_num + 1] = NULL;
769
770 return chunks;
771 }
772
773
774 /*
775 parse the ASN.1 formatted search string into a ldb_parse_tree
776 */
777 static struct ldb_parse_tree *ldap_decode_filter_tree(TALLOC_CTX *mem_ctx,
778 struct asn1_data *data)
779 {
780 uint8_t filter_tag;
781 struct ldb_parse_tree *ret;
782
783 if (!asn1_peek_uint8(data, &filter_tag)) {
784 return NULL;
785 }
786
787 filter_tag &= 0x1f; /* strip off the asn1 stuff */
788
789 ret = talloc(mem_ctx, struct ldb_parse_tree);
790 if (ret == NULL) return NULL;
791
792 switch(filter_tag) {
793 case 0:
794 case 1:
795 /* AND or OR of one or more filters */
796 ret->operation = (filter_tag == 0)?LDB_OP_AND:LDB_OP_OR;
797 ret->u.list.num_elements = 0;
798 ret->u.list.elements = NULL;
799
800 if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) {
801 goto failed;
802 }
803
804 while (asn1_tag_remaining(data) > 0) {
805 struct ldb_parse_tree *subtree;
806 subtree = ldap_decode_filter_tree(ret, data);
807 if (subtree == NULL) {
808 goto failed;
809 }
810 ret->u.list.elements =
811 talloc_realloc(ret, ret->u.list.elements,
812 struct ldb_parse_tree *,
813 ret->u.list.num_elements+1);
814 if (ret->u.list.elements == NULL) {
815 goto failed;
816 }
817 talloc_steal(ret->u.list.elements, subtree);
818 ret->u.list.elements[ret->u.list.num_elements] = subtree;
819 ret->u.list.num_elements++;
820 }
821 if (!asn1_end_tag(data)) {
822 goto failed;
823 }
824 break;
825
826 case 2:
827 /* 'not' operation */
828 if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) {
829 goto failed;
830 }
831
832 ret->operation = LDB_OP_NOT;
833 ret->u.isnot.child = ldap_decode_filter_tree(ret, data);
834 if (ret->u.isnot.child == NULL) {
835 goto failed;
836 }
837 if (!asn1_end_tag(data)) {
838 goto failed;
839 }
840 break;
841
842 case 3: {
843 /* equalityMatch */
844 const char *attrib;
845 DATA_BLOB value;
846
847 if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) goto failed;
848 if (!asn1_read_OctetString_talloc(mem_ctx, data, &attrib)) goto failed;
849 if (!asn1_read_OctetString(data, mem_ctx, &value)) goto failed;
850 if (!asn1_end_tag(data)) goto failed;
851 if (asn1_has_error(data) || (attrib == NULL) ||
852 (value.data == NULL)) {
853 goto failed;
854 }
855
856 ret->operation = LDB_OP_EQUALITY;
857 ret->u.equality.attr = talloc_steal(ret, attrib);
858 ret->u.equality.value.data = talloc_steal(ret, value.data);
859 ret->u.equality.value.length = value.length;
860 break;
861 }
862 case 4: {
863 /* substrings */
864 DATA_BLOB attr;
865 uint8_t subs_tag;
866 char *value;
867 int chunk_num = 0;
868
869 if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) {
870 goto failed;
871 }
872 if (!asn1_read_OctetString(data, mem_ctx, &attr)) {
873 goto failed;
874 }
875
876 ret->operation = LDB_OP_SUBSTRING;
877 ret->u.substring.attr = talloc_strndup(ret, (char *)attr.data, attr.length);
878 if (ret->u.substring.attr == NULL) {
879 goto failed;
880 }
881 ret->u.substring.chunks = NULL;
882 ret->u.substring.start_with_wildcard = 1;
883 ret->u.substring.end_with_wildcard = 1;
884
885 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) {
886 goto failed;
887 }
888
889 while (asn1_tag_remaining(data)) {
890 if (!asn1_peek_uint8(data, &subs_tag)) goto failed;
891 subs_tag &= 0x1f; /* strip off the asn1 stuff */
892 if (subs_tag > 2) goto failed;
893
894 if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(subs_tag))) goto failed;
895 if (!asn1_read_LDAPString(data, mem_ctx, &value)) goto failed;
896 if (!asn1_end_tag(data)) goto failed;
897
898 switch (subs_tag) {
899 case 0:
900 if (ret->u.substring.chunks != NULL) {
901 /* initial value found in the middle */
902 goto failed;
903 }
904
905 ret->u.substring.chunks = ldap_decode_substring(ret, NULL, 0, value);
906 if (ret->u.substring.chunks == NULL) {
907 goto failed;
908 }
909
910 ret->u.substring.start_with_wildcard = 0;
911 chunk_num = 1;
912 break;
913
914 case 1:
915 if (ret->u.substring.end_with_wildcard == 0) {
916 /* "any" value found after a "final" value */
917 goto failed;
918 }
919
920 ret->u.substring.chunks = ldap_decode_substring(ret,
921 ret->u.substring.chunks,
922 chunk_num,
923 value);
924 if (ret->u.substring.chunks == NULL) {
925 goto failed;
926 }
927
928 chunk_num++;
929 break;
930
931 case 2:
932 ret->u.substring.chunks = ldap_decode_substring(ret,
933 ret->u.substring.chunks,
934 chunk_num,
935 value);
936 if (ret->u.substring.chunks == NULL) {
937 goto failed;
938 }
939
940 ret->u.substring.end_with_wildcard = 0;
941 break;
942
943 default:
944 goto failed;
945 }
946
947 }
948
949 if (!asn1_end_tag(data)) { /* SEQUENCE */
950 goto failed;
951 }
952
953 if (!asn1_end_tag(data)) {
954 goto failed;
955 }
956 break;
957 }
958 case 5: {
959 /* greaterOrEqual */
960 const char *attrib;
961 DATA_BLOB value;
962
963 if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) goto failed;
964 if (!asn1_read_OctetString_talloc(mem_ctx, data, &attrib)) goto failed;
965 if (!asn1_read_OctetString(data, mem_ctx, &value)) goto failed;
966 if (!asn1_end_tag(data)) goto failed;
967 if (asn1_has_error(data) || (attrib == NULL) ||
968 (value.data == NULL)) {
969 goto failed;
970 }
971
972 ret->operation = LDB_OP_GREATER;
973 ret->u.comparison.attr = talloc_steal(ret, attrib);
974 ret->u.comparison.value.data = talloc_steal(ret, value.data);
975 ret->u.comparison.value.length = value.length;
976 break;
977 }
978 case 6: {
979 /* lessOrEqual */
980 const char *attrib;
981 DATA_BLOB value;
982
983 if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) goto failed;
984 if (!asn1_read_OctetString_talloc(mem_ctx, data, &attrib)) goto failed;
985 if (!asn1_read_OctetString(data, mem_ctx, &value)) goto failed;
986 if (!asn1_end_tag(data)) goto failed;
987 if (asn1_has_error(data) || (attrib == NULL) ||
988 (value.data == NULL)) {
989 goto failed;
990 }
991
992 ret->operation = LDB_OP_LESS;
993 ret->u.comparison.attr = talloc_steal(ret, attrib);
994 ret->u.comparison.value.data = talloc_steal(ret, value.data);
995 ret->u.comparison.value.length = value.length;
996 break;
997 }
998 case 7: {
999 /* Normal presence, "attribute=*" */
1000 char *attr;
1001
1002 if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(filter_tag))) {
1003 goto failed;
1004 }
1005 if (!asn1_read_LDAPString(data, ret, &attr)) {
1006 goto failed;
1007 }
1008
1009 ret->operation = LDB_OP_PRESENT;
1010 ret->u.present.attr = talloc_steal(ret, attr);
1011
1012 if (!asn1_end_tag(data)) {
1013 goto failed;
1014 }
1015 break;
1016 }
1017 case 8: {
1018 /* approx */
1019 const char *attrib;
1020 DATA_BLOB value;
1021
1022 if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) goto failed;
1023 if (!asn1_read_OctetString_talloc(mem_ctx, data, &attrib)) goto failed;
1024 if (!asn1_read_OctetString(data, mem_ctx, &value)) goto failed;
1025 if (!asn1_end_tag(data)) goto failed;
1026 if (asn1_has_error(data) || (attrib == NULL) ||
1027 (value.data == NULL)) {
1028 goto failed;
1029 }
1030
1031 ret->operation = LDB_OP_APPROX;
1032 ret->u.comparison.attr = talloc_steal(ret, attrib);
1033 ret->u.comparison.value.data = talloc_steal(ret, value.data);
1034 ret->u.comparison.value.length = value.length;
1035 break;
1036 }
1037 case 9: {
1038 char *oid = NULL, *attr = NULL, *value;
1039 uint8_t dnAttributes;
1040 /* an extended search */
1041 if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) {
1042 goto failed;
1043 }
1044
1045 /* FIXME: read carefully rfc2251.txt there are a number of 'MUST's
1046 we need to check we properly implement --SSS */
1047 /* either oid or type must be defined */
1048 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(1))) { /* optional */
1049 if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(1))) goto failed;
1050 if (!asn1_read_LDAPString(data, ret, &oid)) goto failed;
1051 if (!asn1_end_tag(data)) goto failed;
1052 }
1053 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(2))) { /* optional */
1054 if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(2))) goto failed;
1055 if (!asn1_read_LDAPString(data, ret, &attr)) goto failed;
1056 if (!asn1_end_tag(data)) goto failed;
1057 }
1058 if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(3))) goto failed;
1059 if (!asn1_read_LDAPString(data, ret, &value)) goto failed;
1060 if (!asn1_end_tag(data)) goto failed;
1061 /* dnAttributes is marked as BOOLEAN DEFAULT FALSE
1062 it is not marked as OPTIONAL but openldap tools
1063 do not set this unless it is to be set as TRUE
1064 NOTE: openldap tools do not work with AD as it
1065 seems that AD always requires the dnAttributes
1066 boolean value to be set */
1067 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(4))) {
1068 if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(4))) goto failed;
1069 if (!asn1_read_uint8(data, &dnAttributes)) goto failed;
1070 if (!asn1_end_tag(data)) goto failed;
1071 } else {
1072 dnAttributes = 0;
1073 }
1074 if ((oid == NULL && attr == NULL) || (value == NULL)) {
1075 goto failed;
1076 }
1077
1078 if (oid) {
1079 ret->operation = LDB_OP_EXTENDED;
1080
1081 /* From the RFC2251: If the type field is
1082 absent and matchingRule is present, the matchValue is compared
1083 against all attributes in an entry which support that matchingRule
1084 */
1085 if (attr) {
1086 ret->u.extended.attr = talloc_steal(ret, attr);
1087 } else {
1088 ret->u.extended.attr = talloc_strdup(ret, "*");
1089 if (ret->u.extended.attr == NULL) {
1090 goto failed;
1091 }
1092 }
1093 ret->u.extended.rule_id = talloc_steal(ret, oid);
1094 ret->u.extended.value.data = (uint8_t *)talloc_steal(ret, value);
1095 ret->u.extended.value.length = strlen(value);
1096 ret->u.extended.dnAttributes = dnAttributes;
1097 } else {
1098 ret->operation = LDB_OP_EQUALITY;
1099 ret->u.equality.attr = talloc_steal(ret, attr);
1100 ret->u.equality.value.data = (uint8_t *)talloc_steal(ret, value);
1101 ret->u.equality.value.length = strlen(value);
1102 }
1103 if (!asn1_end_tag(data)) {
1104 goto failed;
1105 }
1106 break;
1107 }
1108
1109 default:
1110 goto failed;
1111 }
1112
1113 return ret;
1114
1115 failed:
1116 talloc_free(ret);
1117 return NULL;
1118 }
1119
1120 /* Decode a single LDAP attribute, possibly containing multiple values */
1121 static bool ldap_decode_attrib(TALLOC_CTX *mem_ctx, struct asn1_data *data,
1122 struct ldb_message_element *attrib)
1123 {
1124 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) return false;
1125 if (!asn1_read_OctetString_talloc(mem_ctx, data, &attrib->name)) return false;
1126 if (!asn1_start_tag(data, ASN1_SET)) return false;
1127 while (asn1_peek_tag(data, ASN1_OCTET_STRING)) {
1128 DATA_BLOB blob;
1129 if (!asn1_read_OctetString(data, mem_ctx, &blob)) return false;
1130 add_value_to_attrib(mem_ctx, &blob, attrib);
1131 }
1132 if (!asn1_end_tag(data)) return false;
1133 return asn1_end_tag(data);
1134 }
1135
1136 /* Decode a set of LDAP attributes, as found in the dereference control */
1137 bool ldap_decode_attribs_bare(TALLOC_CTX *mem_ctx, struct asn1_data *data,
1138 struct ldb_message_element **attributes,
1139 int *num_attributes)
1140 {
1141 while (asn1_peek_tag(data, ASN1_SEQUENCE(0))) {
1142 struct ldb_message_element attrib;
1143 ZERO_STRUCT(attrib);
1144 if (!ldap_decode_attrib(mem_ctx, data, &attrib)) return false;
1145 add_attrib_to_array_talloc(mem_ctx, &attrib,
1146 attributes, num_attributes);
1147 }
1148 return true;
1149 }
1150
1151 /* Decode a set of LDAP attributes, as found in a search entry */
1152 static bool ldap_decode_attribs(TALLOC_CTX *mem_ctx, struct asn1_data *data,
1153 struct ldb_message_element **attributes,
1154 int *num_attributes)
1155 {
1156 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) return false;
1157 if (!ldap_decode_attribs_bare(mem_ctx, data,
1158 attributes, num_attributes)) return false;
1159 return asn1_end_tag(data);
1160 }
1161
1162 /* This routine returns LDAP status codes */
1163
1164 _PUBLIC_ NTSTATUS ldap_decode(struct asn1_data *data,
1165 const struct ldap_control_handler *control_handlers,
1166 struct ldap_message *msg)
1167 {
1168 uint8_t tag;
1169
1170 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto prot_err;
1171 if (!asn1_read_Integer(data, &msg->messageid)) goto prot_err;
1172
1173 if (!asn1_peek_uint8(data, &tag)) goto prot_err;
1174
1175 switch(tag) {
1176
1177 case ASN1_APPLICATION(LDAP_TAG_BindRequest): {
1178 struct ldap_BindRequest *r = &msg->r.BindRequest;
1179 msg->type = LDAP_TAG_BindRequest;
1180 if (!asn1_start_tag(data, tag)) goto prot_err;
1181 if (!asn1_read_Integer(data, &r->version)) goto prot_err;
1182 if (!asn1_read_OctetString_talloc(msg, data, &r->dn)) goto prot_err;
1183 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(0))) {
1184 int pwlen;
1185 r->creds.password = "";
1186 r->mechanism = LDAP_AUTH_MECH_SIMPLE;
1187 if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(0))) goto prot_err;
1188 pwlen = asn1_tag_remaining(data);
1189 if (pwlen == -1) {
1190 goto prot_err;
1191 }
1192 if (pwlen != 0) {
1193 char *pw = talloc_array(msg, char, pwlen+1);
1194 if (!pw) {
1195 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
1196 }
1197 if (!asn1_read(data, pw, pwlen)) goto prot_err;
1198 pw[pwlen] = '\0';
1199 r->creds.password = pw;
1200 }
1201 if (!asn1_end_tag(data)) goto prot_err;
1202 } else if (asn1_peek_tag(data, ASN1_CONTEXT(3))){
1203 if (!asn1_start_tag(data, ASN1_CONTEXT(3))) goto prot_err;
1204 r->mechanism = LDAP_AUTH_MECH_SASL;
1205 if (!asn1_read_OctetString_talloc(msg, data, &r->creds.SASL.mechanism)) goto prot_err;
1206 if (asn1_peek_tag(data, ASN1_OCTET_STRING)) { /* optional */
1207 DATA_BLOB tmp_blob = data_blob(NULL, 0);
1208 if (!asn1_read_OctetString(data, msg, &tmp_blob)) goto prot_err;
1209 r->creds.SASL.secblob = talloc(msg, DATA_BLOB);
1210 if (!r->creds.SASL.secblob) {
1211 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
1212 }
1213 *r->creds.SASL.secblob = data_blob_talloc(r->creds.SASL.secblob,
1214 tmp_blob.data, tmp_blob.length);
1215 data_blob_free(&tmp_blob);
1216 } else {
1217 r->creds.SASL.secblob = NULL;
1218 }
1219 if (!asn1_end_tag(data)) goto prot_err;
1220 } else {
1221 /* Neither Simple nor SASL bind */
1222 goto prot_err;
1223 }
1224 if (!asn1_end_tag(data)) goto prot_err;
1225 break;
1226 }
1227
1228 case ASN1_APPLICATION(LDAP_TAG_BindResponse): {
1229 struct ldap_BindResponse *r = &msg->r.BindResponse;
1230 msg->type = LDAP_TAG_BindResponse;
1231 if (!asn1_start_tag(data, tag)) goto prot_err;
1232 if (!ldap_decode_response(msg, data, &r->response)) goto prot_err;
1233 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(7))) {
1234 DATA_BLOB tmp_blob = data_blob(NULL, 0);
1235 if (!asn1_read_ContextSimple(data, 7, &tmp_blob)) goto prot_err;
1236 r->SASL.secblob = talloc(msg, DATA_BLOB);
1237 if (!r->SASL.secblob) {
1238 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
1239 }
1240 *r->SASL.secblob = data_blob_talloc(r->SASL.secblob,
1241 tmp_blob.data, tmp_blob.length);
1242 data_blob_free(&tmp_blob);
1243 } else {
1244 r->SASL.secblob = NULL;
1245 }
1246 if (!asn1_end_tag(data)) goto prot_err;
1247 break;
1248 }
1249
1250 case ASN1_APPLICATION_SIMPLE(LDAP_TAG_UnbindRequest): {
1251 msg->type = LDAP_TAG_UnbindRequest;
1252 if (!asn1_start_tag(data, tag)) goto prot_err;
1253 if (!asn1_end_tag(data)) goto prot_err;
1254 break;
1255 }
1256
1257 case ASN1_APPLICATION(LDAP_TAG_SearchRequest): {
1258 struct ldap_SearchRequest *r = &msg->r.SearchRequest;
1259 int sizelimit, timelimit;
1260 const char **attrs = NULL;
1261 msg->type = LDAP_TAG_SearchRequest;
1262 if (!asn1_start_tag(data, tag)) goto prot_err;
1263 if (!asn1_read_OctetString_talloc(msg, data, &r->basedn)) goto prot_err;
1264 if (!asn1_read_enumerated(data, (int *)(void *)&(r->scope))) goto prot_err;
1265 if (!asn1_read_enumerated(data, (int *)(void *)&(r->deref))) goto prot_err;
1266 if (!asn1_read_Integer(data, &sizelimit)) goto prot_err;
1267 r->sizelimit = sizelimit;
1268 if (!asn1_read_Integer(data, &timelimit)) goto prot_err;
1269 r->timelimit = timelimit;
1270 if (!asn1_read_BOOLEAN(data, &r->attributesonly)) goto prot_err;
1271
1272 r->tree = ldap_decode_filter_tree(msg, data);
1273 if (r->tree == NULL) {
1274 goto prot_err;
1275 }
1276
1277 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto prot_err;
1278
1279 r->num_attributes = 0;
1280 r->attributes = NULL;
1281
1282 while (asn1_tag_remaining(data) > 0) {
1283
1284 const char *attr;
1285 if (!asn1_read_OctetString_talloc(msg, data,
1286 &attr))
1287 goto prot_err;
1288 if (!add_string_to_array(msg, attr,
1289 &attrs,
1290 &r->num_attributes))
1291 goto prot_err;
1292 }
1293 r->attributes = attrs;
1294
1295 if (!asn1_end_tag(data)) goto prot_err;
1296 if (!asn1_end_tag(data)) goto prot_err;
1297 break;
1298 }
1299
1300 case ASN1_APPLICATION(LDAP_TAG_SearchResultEntry): {
1301 struct ldap_SearchResEntry *r = &msg->r.SearchResultEntry;
1302 msg->type = LDAP_TAG_SearchResultEntry;
1303 r->attributes = NULL;
1304 r->num_attributes = 0;
1305 if (!asn1_start_tag(data, tag)) goto prot_err;
1306 if (!asn1_read_OctetString_talloc(msg, data, &r->dn)) goto prot_err;
1307 if (!ldap_decode_attribs(msg, data, &r->attributes,
1308 &r->num_attributes)) goto prot_err;
1309 if (!asn1_end_tag(data)) goto prot_err;
1310 break;
1311 }
1312
1313 case ASN1_APPLICATION(LDAP_TAG_SearchResultDone): {
1314 struct ldap_Result *r = &msg->r.SearchResultDone;
1315 msg->type = LDAP_TAG_SearchResultDone;
1316 if (!asn1_start_tag(data, tag)) goto prot_err;
1317 if (!ldap_decode_response(msg, data, r)) goto prot_err;
1318 if (!asn1_end_tag(data)) goto prot_err;
1319 break;
1320 }
1321
1322 case ASN1_APPLICATION(LDAP_TAG_SearchResultReference): {
1323 struct ldap_SearchResRef *r = &msg->r.SearchResultReference;
1324 msg->type = LDAP_TAG_SearchResultReference;
1325 if (!asn1_start_tag(data, tag)) goto prot_err;
1326 if (!asn1_read_OctetString_talloc(msg, data, &r->referral)) goto prot_err;
1327 if (!asn1_end_tag(data)) goto prot_err;
1328 break;
1329 }
1330
1331 case ASN1_APPLICATION(LDAP_TAG_ModifyRequest): {
1332 struct ldap_ModifyRequest *r = &msg->r.ModifyRequest;
1333 msg->type = LDAP_TAG_ModifyRequest;
1334 if (!asn1_start_tag(data, ASN1_APPLICATION(LDAP_TAG_ModifyRequest))) goto prot_err;
1335 if (!asn1_read_OctetString_talloc(msg, data, &r->dn)) goto prot_err;
1336 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto prot_err;
1337
1338 r->num_mods = 0;
1339 r->mods = NULL;
1340
1341 while (asn1_tag_remaining(data) > 0) {
1342 struct ldap_mod mod;
1343 int v;
1344 ZERO_STRUCT(mod);
1345 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto prot_err;
1346 if (!asn1_read_enumerated(data, &v)) goto prot_err;
1347 mod.type = v;
1348 if (!ldap_decode_attrib(msg, data, &mod.attrib)) goto prot_err;
1349 if (!asn1_end_tag(data)) goto prot_err;
1350 if (!add_mod_to_array_talloc(msg, &mod,
1351 &r->mods, &r->num_mods)) {
1352 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
1353 }
1354 }
1355
1356 if (!asn1_end_tag(data)) goto prot_err;
1357 if (!asn1_end_tag(data)) goto prot_err;
1358 break;
1359 }
1360
1361 case ASN1_APPLICATION(LDAP_TAG_ModifyResponse): {
1362 struct ldap_Result *r = &msg->r.ModifyResponse;
1363 msg->type = LDAP_TAG_ModifyResponse;
1364 if (!asn1_start_tag(data, tag)) goto prot_err;
1365 if (!ldap_decode_response(msg, data, r)) goto prot_err;
1366 if (!asn1_end_tag(data)) goto prot_err;
1367 break;
1368 }
1369
1370 case ASN1_APPLICATION(LDAP_TAG_AddRequest): {
1371 struct ldap_AddRequest *r = &msg->r.AddRequest;
1372 msg->type = LDAP_TAG_AddRequest;
1373 if (!asn1_start_tag(data, tag)) goto prot_err;
1374 if (!asn1_read_OctetString_talloc(msg, data, &r->dn)) goto prot_err;
1375
1376 r->attributes = NULL;
1377 r->num_attributes = 0;
1378 if (!ldap_decode_attribs(msg, data, &r->attributes,
1379 &r->num_attributes)) goto prot_err;
1380
1381 if (!asn1_end_tag(data)) goto prot_err;
1382 break;
1383 }
1384
1385 case ASN1_APPLICATION(LDAP_TAG_AddResponse): {
1386 struct ldap_Result *r = &msg->r.AddResponse;
1387 msg->type = LDAP_TAG_AddResponse;
1388 if (!asn1_start_tag(data, tag)) goto prot_err;
1389 if (!ldap_decode_response(msg, data, r)) goto prot_err;
1390 if (!asn1_end_tag(data)) goto prot_err;
1391 break;
1392 }
1393
1394 case ASN1_APPLICATION_SIMPLE(LDAP_TAG_DelRequest): {
1395 struct ldap_DelRequest *r = &msg->r.DelRequest;
1396 int len;
1397 char *dn;
1398 msg->type = LDAP_TAG_DelRequest;
1399 if (!asn1_start_tag(data,
1400 ASN1_APPLICATION_SIMPLE(LDAP_TAG_DelRequest))) goto prot_err;
1401 len = asn1_tag_remaining(data);
1402 if (len == -1) {
1403 goto prot_err;
1404 }
1405 dn = talloc_array(msg, char, len+1);
1406 if (dn == NULL)
1407 break;
1408 if (!asn1_read(data, dn, len)) goto prot_err;
1409 dn[len] = '\0';
1410 r->dn = dn;
1411 if (!asn1_end_tag(data)) goto prot_err;
1412 break;
1413 }
1414
1415 case ASN1_APPLICATION(LDAP_TAG_DelResponse): {
1416 struct ldap_Result *r = &msg->r.DelResponse;
1417 msg->type = LDAP_TAG_DelResponse;
1418 if (!asn1_start_tag(data, tag)) goto prot_err;
1419 if (!ldap_decode_response(msg, data, r)) goto prot_err;
1420 if (!asn1_end_tag(data)) goto prot_err;
1421 break;
1422 }
1423
1424 case ASN1_APPLICATION(LDAP_TAG_ModifyDNRequest): {
1425 struct ldap_ModifyDNRequest *r = &msg->r.ModifyDNRequest;
1426 msg->type = LDAP_TAG_ModifyDNRequest;
1427 if (!asn1_start_tag(data,
1428 ASN1_APPLICATION(LDAP_TAG_ModifyDNRequest))) goto prot_err;
1429 if (!asn1_read_OctetString_talloc(msg, data, &r->dn)) goto prot_err;
1430 if (!asn1_read_OctetString_talloc(msg, data, &r->newrdn)) goto prot_err;
1431 if (!asn1_read_BOOLEAN(data, &r->deleteolddn)) goto prot_err;
1432 r->newsuperior = NULL;
1433 if (asn1_tag_remaining(data) > 0) {
1434 int len;
1435 char *newsup;
1436 if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(0))) goto prot_err;
1437 len = asn1_tag_remaining(data);
1438 if (len == -1) {
1439 goto prot_err;
1440 }
1441 newsup = talloc_array(msg, char, len+1);
1442 if (newsup == NULL) {
1443 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
1444 }
1445 if (!asn1_read(data, newsup, len)) goto prot_err;
1446 newsup[len] = '\0';
1447 r->newsuperior = newsup;
1448 if (!asn1_end_tag(data)) goto prot_err;
1449 }
1450 if (!asn1_end_tag(data)) goto prot_err;
1451 break;
1452 }
1453
1454 case ASN1_APPLICATION(LDAP_TAG_ModifyDNResponse): {
1455 struct ldap_Result *r = &msg->r.ModifyDNResponse;
1456 msg->type = LDAP_TAG_ModifyDNResponse;
1457 if (!asn1_start_tag(data, tag)) goto prot_err;
1458 if (!ldap_decode_response(msg, data, r)) goto prot_err;
1459 if (!asn1_end_tag(data)) goto prot_err;
1460 break;
1461 }
1462
1463 case ASN1_APPLICATION(LDAP_TAG_CompareRequest): {
1464 struct ldap_CompareRequest *r = &msg->r.CompareRequest;
1465 msg->type = LDAP_TAG_CompareRequest;
1466 if (!asn1_start_tag(data,
1467 ASN1_APPLICATION(LDAP_TAG_CompareRequest))) goto prot_err;
1468 if (!asn1_read_OctetString_talloc(msg, data, &r->dn)) goto prot_err;
1469 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto prot_err;
1470 if (!asn1_read_OctetString_talloc(msg, data, &r->attribute)) goto prot_err;
1471 if (!asn1_read_OctetString(data, msg, &r->value)) goto prot_err;
1472 if (r->value.data) {
1473 talloc_steal(msg, r->value.data);
1474 }
1475 if (!asn1_end_tag(data)) goto prot_err;
1476 if (!asn1_end_tag(data)) goto prot_err;
1477 break;
1478 }
1479
1480 case ASN1_APPLICATION(LDAP_TAG_CompareResponse): {
1481 struct ldap_Result *r = &msg->r.CompareResponse;
1482 msg->type = LDAP_TAG_CompareResponse;
1483 if (!asn1_start_tag(data, tag)) goto prot_err;
1484 if (!ldap_decode_response(msg, data, r)) goto prot_err;
1485 if (!asn1_end_tag(data)) goto prot_err;
1486 break;
1487 }
1488
1489 case ASN1_APPLICATION_SIMPLE(LDAP_TAG_AbandonRequest): {
1490 struct ldap_AbandonRequest *r = &msg->r.AbandonRequest;
1491 msg->type = LDAP_TAG_AbandonRequest;
1492 if (!asn1_start_tag(data, tag)) goto prot_err;
1493 if (!asn1_read_implicit_Integer(data, &r->messageid)) goto prot_err;
1494 if (!asn1_end_tag(data)) goto prot_err;
1495 break;
1496 }
1497
1498 case ASN1_APPLICATION(LDAP_TAG_ExtendedRequest): {
1499 struct ldap_ExtendedRequest *r = &msg->r.ExtendedRequest;
1500 DATA_BLOB tmp_blob = data_blob(NULL, 0);
1501
1502 msg->type = LDAP_TAG_ExtendedRequest;
1503 if (!asn1_start_tag(data,tag)) goto prot_err;
1504 if (!asn1_read_ContextSimple(data, 0, &tmp_blob)) {
1505 goto prot_err;
1506 }
1507 r->oid = blob2string_talloc(msg, tmp_blob);
1508 data_blob_free(&tmp_blob);
1509 if (!r->oid) {
1510 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
1511 }
1512
1513 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(1))) {
1514 if (!asn1_read_ContextSimple(data, 1, &tmp_blob)) goto prot_err;
1515 r->value = talloc(msg, DATA_BLOB);
1516 if (!r->value) {
1517 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
1518 }
1519 *r->value = data_blob_talloc(r->value, tmp_blob.data, tmp_blob.length);
1520 data_blob_free(&tmp_blob);
1521 } else {
1522 r->value = NULL;
1523 }
1524
1525 if (!asn1_end_tag(data)) goto prot_err;
1526 break;
1527 }
1528
1529 case ASN1_APPLICATION(LDAP_TAG_ExtendedResponse): {
1530 struct ldap_ExtendedResponse *r = &msg->r.ExtendedResponse;
1531 DATA_BLOB tmp_blob = data_blob(NULL, 0);
1532
1533 msg->type = LDAP_TAG_ExtendedResponse;
1534 if (!asn1_start_tag(data, tag)) goto prot_err;
1535 if (!ldap_decode_response(msg, data, &r->response)) goto prot_err;
1536
1537 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(10))) {
1538 if (!asn1_read_ContextSimple(data, 1, &tmp_blob)) goto prot_err;
1539 r->oid = blob2string_talloc(msg, tmp_blob);
1540 data_blob_free(&tmp_blob);
1541 if (!r->oid) {
1542 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
1543 }
1544 } else {
1545 r->oid = NULL;
1546 }
1547
1548 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(11))) {
1549 if (!asn1_read_ContextSimple(data, 1, &tmp_blob)) goto prot_err;
1550 r->value = talloc(msg, DATA_BLOB);
1551 if (!r->value) {
1552 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
1553 }
1554 *r->value = data_blob_talloc(r->value, tmp_blob.data, tmp_blob.length);
1555 data_blob_free(&tmp_blob);
1556 } else {
1557 r->value = NULL;
1558 }
1559
1560 if (!asn1_end_tag(data)) goto prot_err;
1561 break;
1562 }
1563 default:
1564 goto prot_err;
1565 }
1566
1567 msg->controls = NULL;
1568 msg->controls_decoded = NULL;
1569
1570 if (asn1_peek_tag(data, ASN1_CONTEXT(0))) {
1571 int i = 0;
1572 struct ldb_control **ctrl = NULL;
1573 bool *decoded = NULL;
1574
1575 if (!asn1_start_tag(data, ASN1_CONTEXT(0))) goto prot_err;
1576
1577 while (asn1_peek_tag(data, ASN1_SEQUENCE(0))) {
1578 DATA_BLOB value;
1579 /* asn1_start_tag(data, ASN1_SEQUENCE(0)); */
1580
1581 ctrl = talloc_realloc(msg, ctrl, struct ldb_control *, i+2);
1582 if (!ctrl) {
1583 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
1584 }
1585
1586 decoded = talloc_realloc(msg, decoded, bool, i+1);
1587 if (!decoded) {
1588 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
1589 }
1590
1591 ctrl[i] = talloc(ctrl, struct ldb_control);
1592 if (!ctrl[i]) {
1593 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
1594 }
1595
1596 if (!ldap_decode_control_wrapper(ctrl[i], data, ctrl[i], &value)) {
1597 goto prot_err;
1598 }
1599
1600 if (!ldap_decode_control_value(ctrl[i], value,
1601 control_handlers,
1602 ctrl[i])) {
1603 if (ctrl[i]->critical) {
1604 ctrl[i]->data = NULL;
1605 decoded[i] = false;
1606 i++;
1607 } else {
1608 talloc_free(ctrl[i]);
1609 ctrl[i] = NULL;
1610 }
1611 } else {
1612 decoded[i] = true;
1613 i++;
1614 }
1615 }
1616
1617 if (ctrl != NULL) {
1618 ctrl[i] = NULL;
1619 }
1620
1621 msg->controls = ctrl;
1622 msg->controls_decoded = decoded;
1623
1624 if (!asn1_end_tag(data)) goto prot_err;
1625 }
1626
1627 if (!asn1_end_tag(data)) goto prot_err;
1628 if (asn1_has_error(data) || asn1_has_nesting(data)) {
1629 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
1630 }
1631 return NT_STATUS_OK;
1632
1633 prot_err:
1634
1635 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
1636 }
1637
1638
1639 /*
1640 return NT_STATUS_OK if a blob has enough bytes in it to be a full
1641 ldap packet. Set packet_size if true.
1642 */
1643 NTSTATUS ldap_full_packet(void *private_data, DATA_BLOB blob, size_t *packet_size)
1644 {
1645 int ret;
1646
1647 if (blob.length < 6) {
1648 /*
1649 * We need at least 6 bytes to workout the length
1650 * of the pdu.
1651 */
1652 return STATUS_MORE_ENTRIES;
1653 }
1654
1655 ret = asn1_peek_full_tag(blob, ASN1_SEQUENCE(0), packet_size);
1656 if (ret != 0) {
1657 return map_nt_error_from_unix_common(ret);
1658 }
1659 return NT_STATUS_OK;
1660 }
Samba GIT mirror