lib/ldb-samba/ldb_ildap.c

   1 /*
   2    ldb database library - ildap backend
   3
   4    Copyright (C) Andrew Tridgell  2005
   5    Copyright (C) Simo Sorce       2008
   6
   7      ** NOTE! The following LGPL license applies to the ldb
   8      ** library. This does NOT imply that all of Samba is released
   9      ** under the LGPL
  10
  11    This library is free software; you can redistribute it and/or
  12    modify it under the terms of the GNU Lesser General Public
  13    License as published by the Free Software Foundation; either
  14    version 3 of the License, or (at your option) any later version.
  15
  16    This library is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  19    Lesser General Public License for more details.
  20
  21    You should have received a copy of the GNU Lesser General Public
  22    License along with this library; if not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 /*
  26  *  Name: ldb_ildap
  27  *
  28  *  Component: ldb ildap backend
  29  *
  30  *  Description: This is a ldb backend for the internal ldap
  31  *  client library in Samba4. By using this backend we are
  32  *  independent of a system ldap library
  33  *
  34  *  Author: Andrew Tridgell
  35  *
  36  *  Modifications:
  37  *
  38  *  - description: make the module use asynchronous calls
  39  *    date: Feb 2006
  40  *    author: Simo Sorce
  41  */
  42
  43 #include "includes.h"
  44 #include "ldb_module.h"
  45 #include "util/dlinklist.h"
  46
  47 #include "libcli/ldap/libcli_ldap.h"
  48 #include "libcli/ldap/ldap_client.h"
  49 #include "auth/auth.h"
  50 #include "auth/credentials/credentials.h"
  51
  52 struct ildb_private {
  53         struct ldap_connection *ldap;
  54         struct tevent_context *event_ctx;
  55 };
  56
  57 struct ildb_context {
  58         struct ldb_module *module;
  59         struct ldb_request *req;
  60
  61         struct ildb_private *ildb;
  62         struct ldap_request *ireq;
  63
  64         /* indicate we are already processing
  65          * the ldap_request in ildb_callback() */
  66         bool in_ildb_callback;
  67
  68         bool done;
  69
  70         struct ildb_destructor_ctx *dc;
  71 };
  72
  73 static void ildb_request_done(struct ildb_context *ctx,
  74                               struct ldb_control **ctrls, int error)
  75 {
  76         struct ldb_context *ldb;
  77         struct ldb_reply *ares;
  78
  79         ldb = ldb_module_get_ctx(ctx->module);
  80
  81         ctx->done = true;
  82
  83         if (ctx->req == NULL) {
  84                 /* if the req has been freed already just return */
  85                 return;
  86         }
  87
  88         ares = talloc_zero(ctx->req, struct ldb_reply);
  89         if (!ares) {
  90                 ldb_oom(ldb);
  91                 ctx->req->callback(ctx->req, NULL);
  92                 return;
  93         }
  94         ares->type = LDB_REPLY_DONE;
  95         ares->controls = talloc_steal(ares, ctrls);
  96         ares->error = error;
  97
  98         ctx->req->callback(ctx->req, ares);
  99 }
 100
 101 static void ildb_auto_done_callback(struct tevent_context *ev,
 102                                     struct tevent_timer *te,
 103                                     struct timeval t,
 104                                     void *private_data)
 105 {
 106         struct ildb_context *ac;
 107
 108         ac = talloc_get_type(private_data, struct ildb_context);
 109         ildb_request_done(ac, NULL, LDB_SUCCESS);
 110 }
 111
 112 /*
 113   convert a ldb_message structure to a list of ldap_mod structures
 114   ready for ildap_add() or ildap_modify()
 115 */
 116 static struct ldap_mod **ildb_msg_to_mods(void *mem_ctx, int *num_mods,
 117                                           const struct ldb_message *msg,
 118                                           int use_flags)
 119 {
 120         struct ldap_mod **mods;
 121         unsigned int i;
 122         int n = 0;
 123
 124         /* allocate maximum number of elements needed */
 125         mods = talloc_array(mem_ctx, struct ldap_mod *, msg->num_elements+1);
 126         if (!mods) {
 127                 errno = ENOMEM;
 128                 return NULL;
 129         }
 130         mods[0] = NULL;
 131
 132         for (i = 0; i < msg->num_elements; i++) {
 133                 const struct ldb_message_element *el = &msg->elements[i];
 134
 135                 mods[n] = talloc(mods, struct ldap_mod);
 136                 if (!mods[n]) {
 137                         goto failed;
 138                 }
 139                 mods[n + 1] = NULL;
 140                 mods[n]->type = 0;
 141                 mods[n]->attrib = *el;
 142                 if (use_flags) {
 143                         switch (el->flags & LDB_FLAG_MOD_MASK) {
 144                         case LDB_FLAG_MOD_ADD:
 145                                 mods[n]->type = LDAP_MODIFY_ADD;
 146                                 break;
 147                         case LDB_FLAG_MOD_DELETE:
 148                                 mods[n]->type = LDAP_MODIFY_DELETE;
 149                                 break;
 150                         case LDB_FLAG_MOD_REPLACE:
 151                                 mods[n]->type = LDAP_MODIFY_REPLACE;
 152                                 break;
 153                         }
 154                 }
 155                 n++;
 156         }
 157
 158         *num_mods = n;
 159         return mods;
 160
 161 failed:
 162         talloc_free(mods);
 163         return NULL;
 164 }
 165
 166
 167 /*
 168   map an ildap NTSTATUS to a ldb error code
 169 */
 170 static int ildb_map_error(struct ldb_module *module, NTSTATUS status)
 171 {
 172         struct ildb_private *ildb;
 173         struct ldb_context *ldb;
 174         TALLOC_CTX *mem_ctx;
 175
 176         ildb = talloc_get_type(ldb_module_get_private(module), struct ildb_private);
 177         ldb = ldb_module_get_ctx(module);
 178
 179         if (NT_STATUS_IS_OK(status)) {
 180                 return LDB_SUCCESS;
 181         }
 182
 183         mem_ctx = talloc_new(ildb);
 184         if (!mem_ctx) {
 185                 ldb_oom(ldb);
 186                 return LDB_ERR_OPERATIONS_ERROR;
 187         }
 188         ldb_set_errstring(ldb,
 189                           ldap_errstr(ildb->ldap, mem_ctx, status));
 190         talloc_free(mem_ctx);
 191         if (NT_STATUS_IS_LDAP(status)) {
 192                 return NT_STATUS_LDAP_CODE(status);
 193         }
 194         return LDB_ERR_OPERATIONS_ERROR;
 195 }
 196
 197 static void ildb_request_timeout(struct tevent_context *ev, struct tevent_timer *te,
 198                                  struct timeval t, void *private_data)
 199 {
 200         struct ildb_context *ac = talloc_get_type(private_data, struct ildb_context);
 201
 202         if (ac->ireq->state == LDAP_REQUEST_PENDING) {
 203                 DLIST_REMOVE(ac->ireq->conn->pending, ac->ireq);
 204         }
 205
 206         ildb_request_done(ac, NULL, LDB_ERR_TIME_LIMIT_EXCEEDED);
 207 }
 208
 209 static void ildb_callback(struct ldap_request *req)
 210 {
 211         struct ldb_context *ldb;
 212         struct ildb_context *ac;
 213         NTSTATUS status;
 214         struct ldap_SearchResEntry *search;
 215         struct ldap_message *msg;
 216         struct ldb_control **controls;
 217         struct ldb_message *ldbmsg;
 218         char *referral;
 219         bool callback_failed;
 220         bool request_done;
 221         int ret;
 222         int i;
 223
 224         ac = talloc_get_type(req->async.private_data, struct ildb_context);
 225         ldb = ldb_module_get_ctx(ac->module);
 226         callback_failed = false;
 227         request_done = false;
 228         controls = NULL;
 229
 230         /* check if we are already processing this request */
 231         if (ac->in_ildb_callback) {
 232                 return;
 233         }
 234         /* mark the request as being in process */
 235         ac->in_ildb_callback = true;
 236
 237         if (!NT_STATUS_IS_OK(req->status)) {
 238                 ret = ildb_map_error(ac->module, req->status);
 239                 ildb_request_done(ac, NULL, ret);
 240                 return;
 241         }
 242
 243         if (req->num_replies < 1) {
 244                 ret = LDB_ERR_OPERATIONS_ERROR;
 245                 ildb_request_done(ac, NULL, ret);
 246                 return;
 247         }
 248
 249         switch (req->type) {
 250
 251         case LDAP_TAG_ModifyRequest:
 252                 if (req->replies[0]->type != LDAP_TAG_ModifyResponse) {
 253                         ret = LDB_ERR_PROTOCOL_ERROR;
 254                         break;
 255                 }
 256                 status = ldap_check_response(ac->ireq->conn, &req->replies[0]->r.GeneralResult);
 257                 ret = ildb_map_error(ac->module, status);
 258                 request_done = true;
 259                 break;
 260
 261         case LDAP_TAG_AddRequest:
 262                 if (req->replies[0]->type != LDAP_TAG_AddResponse) {
 263                         ret = LDB_ERR_PROTOCOL_ERROR;
 264                         return;
 265                 }
 266                 status = ldap_check_response(ac->ireq->conn, &req->replies[0]->r.GeneralResult);
 267                 ret = ildb_map_error(ac->module, status);
 268                 request_done = true;
 269                 break;
 270
 271         case LDAP_TAG_DelRequest:
 272                 if (req->replies[0]->type != LDAP_TAG_DelResponse) {
 273                         ret = LDB_ERR_PROTOCOL_ERROR;
 274                         return;
 275                 }
 276                 status = ldap_check_response(ac->ireq->conn, &req->replies[0]->r.GeneralResult);
 277                 ret = ildb_map_error(ac->module, status);
 278                 request_done = true;
 279                 break;
 280
 281         case LDAP_TAG_ModifyDNRequest:
 282                 if (req->replies[0]->type != LDAP_TAG_ModifyDNResponse) {
 283                         ret = LDB_ERR_PROTOCOL_ERROR;
 284                         return;
 285                 }
 286                 status = ldap_check_response(ac->ireq->conn, &req->replies[0]->r.GeneralResult);
 287                 ret = ildb_map_error(ac->module, status);
 288                 request_done = true;
 289                 break;
 290
 291         case LDAP_TAG_SearchRequest:
 292                 /* loop over all messages */
 293                 for (i = 0; i < req->num_replies; i++) {
 294
 295                         msg = req->replies[i];
 296                         switch (msg->type) {
 297
 298                         case LDAP_TAG_SearchResultDone:
 299
 300                                 status = ldap_check_response(ac->ireq->conn, &msg->r.GeneralResult);
 301                                 if (!NT_STATUS_IS_OK(status)) {
 302                                         ret = ildb_map_error(ac->module, status);
 303                                         break;
 304                                 }
 305
 306                                 controls = talloc_steal(ac, msg->controls);
 307                                 if (msg->r.SearchResultDone.resultcode) {
 308                                         if (msg->r.SearchResultDone.errormessage) {
 309                                                 ldb_set_errstring(ldb, msg->r.SearchResultDone.errormessage);
 310                                         }
 311                                 }
 312
 313                                 ret = msg->r.SearchResultDone.resultcode;
 314                                 request_done = true;
 315                                 break;
 316
 317                         case LDAP_TAG_SearchResultEntry:
 318
 319                                 ldbmsg = ldb_msg_new(ac);
 320                                 if (!ldbmsg) {
 321                                         ret = LDB_ERR_OPERATIONS_ERROR;
 322                                         break;
 323                                 }
 324
 325                                 search = &(msg->r.SearchResultEntry);
 326
 327                                 ldbmsg->dn = ldb_dn_new(ldbmsg, ldb, search->dn);
 328                                 if ( ! ldb_dn_validate(ldbmsg->dn)) {
 329                                         ret = LDB_ERR_OPERATIONS_ERROR;
 330                                         break;
 331                                 }
 332                                 ldbmsg->num_elements = search->num_attributes;
 333                                 ldbmsg->elements = talloc_move(ldbmsg, &search->attributes);
 334
 335                                 controls = talloc_steal(ac, msg->controls);
 336
 337                                 ret = ldb_module_send_entry(ac->req, ldbmsg, controls);
 338                                 if (ret != LDB_SUCCESS) {
 339                                         callback_failed = true;
 340                                 }
 341
 342                                 break;
 343
 344                         case LDAP_TAG_SearchResultReference:
 345
 346                                 referral = talloc_strdup(ac, msg->r.SearchResultReference.referral);
 347
 348                                 ret = ldb_module_send_referral(ac->req, referral);
 349                                 if (ret != LDB_SUCCESS) {
 350                                         callback_failed = true;
 351                                 }
 352
 353                                 break;
 354
 355                         default:
 356                                 /* TAG not handled, fail ! */
 357                                 ret = LDB_ERR_PROTOCOL_ERROR;
 358                                 break;
 359                         }
 360
 361                         if (ret != LDB_SUCCESS) {
 362                                 break;
 363                         }
 364                 }
 365
 366                 talloc_free(req->replies);
 367                 req->replies = NULL;
 368                 req->num_replies = 0;
 369
 370                 break;
 371
 372         default:
 373                 ret = LDB_ERR_PROTOCOL_ERROR;
 374                 break;
 375         }
 376
 377         if (ret != LDB_SUCCESS) {
 378
 379                 /* if the callback failed the caller will have freed the
 380                  * request. Just return and don't try to use it */
 381                 if ( ! callback_failed) {
 382                         request_done = true;
 383                 }
 384         }
 385
 386         /* mark the request as not being in progress */
 387         ac->in_ildb_callback = false;
 388
 389         if (request_done) {
 390                 ildb_request_done(ac, controls, ret);
 391         }
 392
 393         return;
 394 }
 395
 396 static int ildb_request_send(struct ildb_context *ac, struct ldap_message *msg)
 397 {
 398         struct ldb_context *ldb;
 399         struct ldap_request *req;
 400
 401         if (!ac) {
 402                 return LDB_ERR_OPERATIONS_ERROR;
 403         }
 404
 405         ldb = ldb_module_get_ctx(ac->module);
 406
 407         ldb_request_set_state(ac->req, LDB_ASYNC_PENDING);
 408
 409         req = ldap_request_send(ac->ildb->ldap, msg);
 410         if (req == NULL) {
 411                 ldb_set_errstring(ldb, "async send request failed");
 412                 return LDB_ERR_OPERATIONS_ERROR;
 413         }
 414         ac->ireq = talloc_reparent(ac->ildb->ldap, ac, req);
 415
 416         if (!ac->ireq->conn) {
 417                 ldb_set_errstring(ldb, "connection to remote LDAP server dropped?");
 418                 return LDB_ERR_OPERATIONS_ERROR;
 419         }
 420
 421         TALLOC_FREE(req->time_event);
 422         if (ac->req->timeout > 0) {
 423                 struct timeval tv = {
 424                         .tv_sec = ac->req->starttime + ac->req->timeout,
 425                 };
 426
 427                 req->time_event = tevent_add_timer(ac->ildb->event_ctx, ac, tv,
 428                                                    ildb_request_timeout, ac);
 429         }
 430
 431         req->async.fn = ildb_callback;
 432         req->async.private_data = ac;
 433
 434         return LDB_SUCCESS;
 435 }
 436
 437 /*
 438   search for matching records using an asynchronous function
 439  */
 440 static int ildb_search(struct ildb_context *ac)
 441 {
 442         struct ldb_context *ldb;
 443         struct ldb_request *req = ac->req;
 444         struct ldap_message *msg;
 445         int n;
 446
 447         ldb = ldb_module_get_ctx(ac->module);
 448
 449         if (!req->callback || !req->context) {
 450                 ldb_set_errstring(ldb, "Async interface called with NULL callback function or NULL context");
 451                 return LDB_ERR_OPERATIONS_ERROR;
 452         }
 453
 454         if (req->op.search.tree == NULL) {
 455                 ldb_set_errstring(ldb, "Invalid expression parse tree");
 456                 return LDB_ERR_OPERATIONS_ERROR;
 457         }
 458
 459         msg = new_ldap_message(req);
 460         if (msg == NULL) {
 461                 ldb_set_errstring(ldb, "Out of Memory");
 462                 return LDB_ERR_OPERATIONS_ERROR;
 463         }
 464
 465         msg->type = LDAP_TAG_SearchRequest;
 466
 467         if (req->op.search.base == NULL) {
 468                 msg->r.SearchRequest.basedn = talloc_strdup(msg, "");
 469         } else {
 470                 msg->r.SearchRequest.basedn  = ldb_dn_get_extended_linearized(msg, req->op.search.base, 0);
 471         }
 472         if (msg->r.SearchRequest.basedn == NULL) {
 473                 ldb_set_errstring(ldb, "Unable to determine baseDN");
 474                 talloc_free(msg);
 475                 return LDB_ERR_OPERATIONS_ERROR;
 476         }
 477
 478         if (req->op.search.scope == LDB_SCOPE_DEFAULT) {
 479                 msg->r.SearchRequest.scope = LDAP_SEARCH_SCOPE_SUB;
 480         } else {
 481                 msg->r.SearchRequest.scope = req->op.search.scope;
 482         }
 483
 484         msg->r.SearchRequest.deref  = LDAP_DEREFERENCE_NEVER;
 485         msg->r.SearchRequest.timelimit = 0;
 486         msg->r.SearchRequest.sizelimit = 0;
 487         msg->r.SearchRequest.attributesonly = 0;
 488         msg->r.SearchRequest.tree = discard_const(req->op.search.tree);
 489
 490         for (n = 0; req->op.search.attrs && req->op.search.attrs[n]; n++) /* noop */ ;
 491         msg->r.SearchRequest.num_attributes = n;
 492         msg->r.SearchRequest.attributes = req->op.search.attrs;
 493         msg->controls = req->controls;
 494
 495         return ildb_request_send(ac, msg);
 496 }
 497
 498 /*
 499   add a record
 500 */
 501 static int ildb_add(struct ildb_context *ac)
 502 {
 503         struct ldb_request *req = ac->req;
 504         struct ldap_message *msg;
 505         struct ldap_mod **mods;
 506         int i,n;
 507
 508         msg = new_ldap_message(req);
 509         if (msg == NULL) {
 510                 return LDB_ERR_OPERATIONS_ERROR;
 511         }
 512
 513         msg->type = LDAP_TAG_AddRequest;
 514
 515         msg->r.AddRequest.dn = ldb_dn_get_extended_linearized(msg, req->op.add.message->dn, 0);
 516         if (msg->r.AddRequest.dn == NULL) {
 517                 talloc_free(msg);
 518                 return LDB_ERR_INVALID_DN_SYNTAX;
 519         }
 520
 521         mods = ildb_msg_to_mods(msg, &n, req->op.add.message, 0);
 522         if (mods == NULL) {
 523                 talloc_free(msg);
 524                 return LDB_ERR_OPERATIONS_ERROR;
 525         }
 526
 527         msg->r.AddRequest.num_attributes = n;
 528         msg->r.AddRequest.attributes = talloc_array(msg, struct ldb_message_element, n);
 529         if (msg->r.AddRequest.attributes == NULL) {
 530                 talloc_free(msg);
 531                 return LDB_ERR_OPERATIONS_ERROR;
 532         }
 533
 534         for (i = 0; i < n; i++) {
 535                 msg->r.AddRequest.attributes[i] = mods[i]->attrib;
 536         }
 537         msg->controls = req->controls;
 538
 539         return ildb_request_send(ac, msg);
 540 }
 541
 542 /*
 543   modify a record
 544 */
 545 static int ildb_modify(struct ildb_context *ac)
 546 {
 547         struct ldb_request *req = ac->req;
 548         struct ldap_message *msg;
 549         struct ldap_mod **mods;
 550         int i,n;
 551
 552         msg = new_ldap_message(req);
 553         if (msg == NULL) {
 554                 return LDB_ERR_OPERATIONS_ERROR;
 555         }
 556
 557         msg->type = LDAP_TAG_ModifyRequest;
 558
 559         msg->r.ModifyRequest.dn = ldb_dn_get_extended_linearized(msg, req->op.mod.message->dn, 0);
 560         if (msg->r.ModifyRequest.dn == NULL) {
 561                 talloc_free(msg);
 562                 return LDB_ERR_INVALID_DN_SYNTAX;
 563         }
 564
 565         mods = ildb_msg_to_mods(msg, &n, req->op.mod.message, 1);
 566         if (mods == NULL) {
 567                 talloc_free(msg);
 568                 return LDB_ERR_OPERATIONS_ERROR;
 569         }
 570
 571         msg->r.ModifyRequest.num_mods = n;
 572         msg->r.ModifyRequest.mods = talloc_array(msg, struct ldap_mod, n);
 573         if (msg->r.ModifyRequest.mods == NULL) {
 574                 talloc_free(msg);
 575                 return LDB_ERR_OPERATIONS_ERROR;
 576         }
 577
 578         for (i = 0; i < n; i++) {
 579                 msg->r.ModifyRequest.mods[i] = *mods[i];
 580         }
 581         msg->controls = req->controls;
 582         return ildb_request_send(ac, msg);
 583 }
 584
 585 /*
 586   delete a record
 587 */
 588 static int ildb_delete(struct ildb_context *ac)
 589 {
 590         struct ldb_request *req = ac->req;
 591         struct ldap_message *msg;
 592
 593         msg = new_ldap_message(req);
 594         if (msg == NULL) {
 595                 return LDB_ERR_OPERATIONS_ERROR;
 596         }
 597
 598         msg->type = LDAP_TAG_DelRequest;
 599
 600         msg->r.DelRequest.dn = ldb_dn_get_extended_linearized(msg, req->op.del.dn, 0);
 601         if (msg->r.DelRequest.dn == NULL) {
 602                 talloc_free(msg);
 603                 return LDB_ERR_INVALID_DN_SYNTAX;
 604         }
 605         msg->controls = req->controls;
 606
 607         return ildb_request_send(ac, msg);
 608 }
 609
 610 /*
 611   rename a record
 612 */
 613 static int ildb_rename(struct ildb_context *ac)
 614 {
 615         struct ldb_request *req = ac->req;
 616         struct ldap_message *msg;
 617         const char *rdn_name;
 618         const struct ldb_val *rdn_val;
 619
 620         msg = new_ldap_message(req);
 621         if (msg == NULL) {
 622                 return LDB_ERR_OPERATIONS_ERROR;
 623         }
 624
 625         msg->type = LDAP_TAG_ModifyDNRequest;
 626         msg->r.ModifyDNRequest.dn = ldb_dn_get_extended_linearized(msg, req->op.rename.olddn, 0);
 627         if (msg->r.ModifyDNRequest.dn == NULL) {
 628                 talloc_free(msg);
 629                 return LDB_ERR_INVALID_DN_SYNTAX;
 630         }
 631
 632         rdn_name = ldb_dn_get_rdn_name(req->op.rename.newdn);
 633         rdn_val = ldb_dn_get_rdn_val(req->op.rename.newdn);
 634
 635         if ((rdn_name != NULL) && (rdn_val != NULL)) {
 636                 msg->r.ModifyDNRequest.newrdn =
 637                         talloc_asprintf(msg, "%s=%s", rdn_name,
 638                                         rdn_val->length > 0 ? ldb_dn_escape_value(msg, *rdn_val) : "");
 639         } else {
 640                 msg->r.ModifyDNRequest.newrdn = talloc_strdup(msg, "");
 641         }
 642         if (msg->r.ModifyDNRequest.newrdn == NULL) {
 643                 talloc_free(msg);
 644                 return LDB_ERR_OPERATIONS_ERROR;
 645         }
 646
 647         msg->r.ModifyDNRequest.newsuperior =
 648                 ldb_dn_alloc_linearized(msg, ldb_dn_get_parent(msg, req->op.rename.newdn));
 649         if (msg->r.ModifyDNRequest.newsuperior == NULL) {
 650                 talloc_free(msg);
 651                 return LDB_ERR_INVALID_DN_SYNTAX;
 652         }
 653
 654         msg->r.ModifyDNRequest.deleteolddn = true;
 655         msg->controls = req->controls;
 656
 657         return ildb_request_send(ac, msg);
 658 }
 659
 660 static int ildb_start_trans(struct ldb_module *module)
 661 {
 662         /* TODO implement a local locking mechanism here */
 663
 664         return LDB_SUCCESS;
 665 }
 666
 667 static int ildb_end_trans(struct ldb_module *module)
 668 {
 669         /* TODO implement a local transaction mechanism here */
 670
 671         return LDB_SUCCESS;
 672 }
 673
 674 static int ildb_del_trans(struct ldb_module *module)
 675 {
 676         /* TODO implement a local locking mechanism here */
 677
 678         return LDB_SUCCESS;
 679 }
 680
 681 static bool ildb_dn_is_special(struct ldb_request *req)
 682 {
 683         struct ldb_dn *dn = NULL;
 684
 685         switch (req->operation) {
 686         case LDB_SEARCH:
 687                 dn = req->op.search.base;
 688                 break;
 689         case LDB_ADD:
 690                 dn = req->op.add.message->dn;
 691                 break;
 692         case LDB_MODIFY:
 693                 dn = req->op.mod.message->dn;
 694                 break;
 695         case LDB_DELETE:
 696                 dn = req->op.del.dn;
 697                 break;
 698         case LDB_RENAME:
 699                 dn = req->op.rename.olddn;
 700                 break;
 701         default:
 702                 break;
 703         }
 704
 705         if (dn && ldb_dn_is_special(dn)) {
 706                 return true;
 707         }
 708         return false;
 709 }
 710
 711 static int ildb_handle_request(struct ldb_module *module, struct ldb_request *req)
 712 {
 713         struct ldb_context *ldb;
 714         struct ildb_private *ildb;
 715         struct ildb_context *ac;
 716         struct tevent_timer *te;
 717         int ret;
 718
 719         ildb = talloc_get_type(ldb_module_get_private(module), struct ildb_private);
 720         ldb = ldb_module_get_ctx(module);
 721
 722         if (req->starttime == 0 || req->timeout == 0) {
 723                 ldb_set_errstring(ldb, "Invalid timeout settings");
 724                 return LDB_ERR_TIME_LIMIT_EXCEEDED;
 725         }
 726
 727         ac = talloc_zero(req, struct ildb_context);
 728         if (ac == NULL) {
 729                 ldb_set_errstring(ldb, "Out of Memory");
 730                 return LDB_ERR_OPERATIONS_ERROR;
 731         }
 732
 733         ac->module = module;
 734         ac->req = req;
 735         ac->ildb = ildb;
 736
 737         if (ildb_dn_is_special(req)) {
 738
 739                 te = tevent_add_timer(ac->ildb->event_ctx,
 740                                       ac, timeval_zero(),
 741                                       ildb_auto_done_callback, ac);
 742                 if (NULL == te) {
 743                         return LDB_ERR_OPERATIONS_ERROR;
 744                 }
 745
 746                 return LDB_SUCCESS;
 747         }
 748
 749         switch (ac->req->operation) {
 750         case LDB_SEARCH:
 751                 ret = ildb_search(ac);
 752                 break;
 753         case LDB_ADD:
 754                 ret = ildb_add(ac);
 755                 break;
 756         case LDB_MODIFY:
 757                 ret = ildb_modify(ac);
 758                 break;
 759         case LDB_DELETE:
 760                 ret = ildb_delete(ac);
 761                 break;
 762         case LDB_RENAME:
 763                 ret = ildb_rename(ac);
 764                 break;
 765         default:
 766                 /* no other op supported */
 767                 ret = LDB_ERR_PROTOCOL_ERROR;
 768                 break;
 769         }
 770
 771         return ret;
 772 }
 773
 774 static const struct ldb_module_ops ildb_ops = {
 775         .name              = "ldap",
 776         .search            = ildb_handle_request,
 777         .add               = ildb_handle_request,
 778         .modify            = ildb_handle_request,
 779         .del               = ildb_handle_request,
 780         .rename            = ildb_handle_request,
 781 /*      .request           = ildb_handle_request, */
 782         .start_transaction = ildb_start_trans,
 783         .end_transaction   = ildb_end_trans,
 784         .del_transaction   = ildb_del_trans,
 785 };
 786
 787 /*
 788   connect to the database
 789 */
 790 static int ildb_connect(struct ldb_context *ldb, const char *url,
 791                         unsigned int flags, const char *options[],
 792                         struct ldb_module **_module)
 793 {
 794         struct ldb_module *module;
 795         struct ildb_private *ildb;
 796         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 797         struct cli_credentials *creds;
 798         struct loadparm_context *lp_ctx;
 799
 800         module = ldb_module_new(ldb, ldb, "ldb_ildap backend", &ildb_ops);
 801         if (!module) return LDB_ERR_OPERATIONS_ERROR;
 802
 803         ildb = talloc(module, struct ildb_private);
 804         if (!ildb) {
 805                 ldb_oom(ldb);
 806                 goto failed;
 807         }
 808         ldb_module_set_private(module, ildb);
 809
 810         ildb->event_ctx = ldb_get_event_context(ldb);
 811
 812         lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
 813                                  struct loadparm_context);
 814
 815         ildb->ldap = ldap4_new_connection(ildb, lp_ctx,
 816                                           ildb->event_ctx);
 817         if (!ildb->ldap) {
 818                 ldb_oom(ldb);
 819                 goto failed;
 820         }
 821
 822         if (flags & LDB_FLG_RECONNECT) {
 823                 ldap_set_reconn_params(ildb->ldap, 10);
 824         }
 825
 826         status = ldap_connect(ildb->ldap, url);
 827         if (!NT_STATUS_IS_OK(status)) {
 828                 ldb_debug(ldb, LDB_DEBUG_ERROR, "Failed to connect to ldap URL '%s' - %s",
 829                           url, ldap_errstr(ildb->ldap, module, status));
 830                 goto failed;
 831         }
 832
 833         /* caller can optionally setup credentials using the opaque token 'credentials' */
 834         creds = talloc_get_type(ldb_get_opaque(ldb, "credentials"), struct cli_credentials);
 835         if (creds == NULL) {
 836                 struct auth_session_info *session_info = talloc_get_type(ldb_get_opaque(ldb, "sessionInfo"), struct auth_session_info);
 837                 if (session_info) {
 838                         creds = session_info->credentials;
 839                 }
 840         }
 841
 842         if (creds != NULL && cli_credentials_authentication_requested(creds)) {
 843                 const char *bind_dn = cli_credentials_get_bind_dn(creds);
 844                 if (bind_dn) {
 845                         const char *password = cli_credentials_get_password(creds);
 846                         status = ldap_bind_simple(ildb->ldap, bind_dn, password);
 847                         if (!NT_STATUS_IS_OK(status)) {
 848                                 ldb_debug(ldb, LDB_DEBUG_ERROR, "Failed to bind - %s",
 849                                           ldap_errstr(ildb->ldap, module, status));
 850                                 goto failed;
 851                         }
 852                 } else {
 853                         status = ldap_bind_sasl(ildb->ldap, creds, lp_ctx);
 854                         if (!NT_STATUS_IS_OK(status)) {
 855                                 ldb_debug(ldb, LDB_DEBUG_ERROR, "Failed to bind - %s",
 856                                           ldap_errstr(ildb->ldap, module, status));
 857                                 goto failed;
 858                         }
 859                 }
 860         }
 861
 862         *_module = module;
 863         return LDB_SUCCESS;
 864
 865 failed:
 866         if (ildb != NULL && ildb->ldap != NULL) {
 867                 ldb_set_errstring(ldb, ldap_errstr(ildb->ldap, module, status));
 868         }
 869         talloc_free(module);
 870         if (NT_STATUS_IS_LDAP(status)) {
 871                 return NT_STATUS_LDAP_CODE(status);
 872         } else if (NT_STATUS_EQUAL(status, NT_STATUS_WRONG_PASSWORD)
 873                    || NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)
 874                    || NT_STATUS_EQUAL(status, NT_STATUS_LOGON_FAILURE)
 875                    || NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
 876                 return LDB_ERR_INVALID_CREDENTIALS;
 877         }
 878         return LDB_ERR_OPERATIONS_ERROR;
 879 }
 880
 881 /*
 882   initialise the module
 883  */
 884 _PUBLIC_ int ldb_ildap_init(const char *ldb_version)
 885 {
 886         int ret, i;
 887         const char *names[] = { "ldap", "ldaps", "ldapi", NULL };
 888         for (i=0; names[i]; i++) {
 889                 ret = ldb_register_backend(names[i], ildb_connect, true);
 890                 if (ret != LDB_SUCCESS) {
 891                         return ret;
 892                 }
 893         }
 894         return LDB_SUCCESS;
 895 }