?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ldap_server: Log access without a bind
[Samba.git] / source4 / ldap_server / ldap_backend.c
blobb023eb4dd7c192f3586954940f4a7a74e154eeef
1 /*
2 Unix SMB/CIFS implementation.
3 LDAP server
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Matthias Dieter Wallnöfer 2009
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "ldap_server/ldap_server.h"
23 #include "../lib/util/dlinklist.h"
24 #include "auth/credentials/credentials.h"
25 #include "auth/gensec/gensec.h"
26 #include "auth/gensec/gensec_internal.h" /* TODO: remove this */
27 #include "auth/common_auth.h"
28 #include "param/param.h"
29 #include "smbd/service_stream.h"
30 #include "dsdb/samdb/samdb.h"
31 #include <ldb_errors.h>
32 #include <ldb_module.h>
33 #include "ldb_wrap.h"
34
35 static int map_ldb_error(TALLOC_CTX *mem_ctx, int ldb_err,
36 const char *add_err_string, const char **errstring)
37 {
38 WERROR err;
39
40 /* Certain LDB modules need to return very special WERROR codes. Proof
41 * for them here and if they exist skip the rest of the mapping. */
42 if (add_err_string != NULL) {
43 char *endptr;
44 strtol(add_err_string, &endptr, 16);
45 if (endptr != add_err_string) {
46 *errstring = add_err_string;
47 return ldb_err;
48 }
49 }
50
51 /* Otherwise we calculate here a generic, but appropriate WERROR. */
52
53 switch (ldb_err) {
54 case LDB_SUCCESS:
55 err = WERR_OK;
56 break;
57 case LDB_ERR_OPERATIONS_ERROR:
58 err = WERR_DS_OPERATIONS_ERROR;
59 break;
60 case LDB_ERR_PROTOCOL_ERROR:
61 err = WERR_DS_PROTOCOL_ERROR;
62 break;
63 case LDB_ERR_TIME_LIMIT_EXCEEDED:
64 err = WERR_DS_TIMELIMIT_EXCEEDED;
65 break;
66 case LDB_ERR_SIZE_LIMIT_EXCEEDED:
67 err = WERR_DS_SIZELIMIT_EXCEEDED;
68 break;
69 case LDB_ERR_COMPARE_FALSE:
70 err = WERR_DS_COMPARE_FALSE;
71 break;
72 case LDB_ERR_COMPARE_TRUE:
73 err = WERR_DS_COMPARE_TRUE;
74 break;
75 case LDB_ERR_AUTH_METHOD_NOT_SUPPORTED:
76 err = WERR_DS_AUTH_METHOD_NOT_SUPPORTED;
77 break;
78 case LDB_ERR_STRONG_AUTH_REQUIRED:
79 err = WERR_DS_STRONG_AUTH_REQUIRED;
80 break;
81 case LDB_ERR_REFERRAL:
82 err = WERR_DS_REFERRAL;
83 break;
84 case LDB_ERR_ADMIN_LIMIT_EXCEEDED:
85 err = WERR_DS_ADMIN_LIMIT_EXCEEDED;
86 break;
87 case LDB_ERR_UNSUPPORTED_CRITICAL_EXTENSION:
88 err = WERR_DS_UNAVAILABLE_CRIT_EXTENSION;
89 break;
90 case LDB_ERR_CONFIDENTIALITY_REQUIRED:
91 err = WERR_DS_CONFIDENTIALITY_REQUIRED;
92 break;
93 case LDB_ERR_SASL_BIND_IN_PROGRESS:
94 err = WERR_DS_BUSY;
95 break;
96 case LDB_ERR_NO_SUCH_ATTRIBUTE:
97 err = WERR_DS_NO_ATTRIBUTE_OR_VALUE;
98 break;
99 case LDB_ERR_UNDEFINED_ATTRIBUTE_TYPE:
100 err = WERR_DS_ATTRIBUTE_TYPE_UNDEFINED;
101 break;
102 case LDB_ERR_INAPPROPRIATE_MATCHING:
103 err = WERR_DS_INAPPROPRIATE_MATCHING;
104 break;
105 case LDB_ERR_CONSTRAINT_VIOLATION:
106 err = WERR_DS_CONSTRAINT_VIOLATION;
107 break;
108 case LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS:
109 err = WERR_DS_ATTRIBUTE_OR_VALUE_EXISTS;
110 break;
111 case LDB_ERR_INVALID_ATTRIBUTE_SYNTAX:
112 err = WERR_DS_INVALID_ATTRIBUTE_SYNTAX;
113 break;
114 case LDB_ERR_NO_SUCH_OBJECT:
115 err = WERR_DS_NO_SUCH_OBJECT;
116 break;
117 case LDB_ERR_ALIAS_PROBLEM:
118 err = WERR_DS_ALIAS_PROBLEM;
119 break;
120 case LDB_ERR_INVALID_DN_SYNTAX:
121 err = WERR_DS_INVALID_DN_SYNTAX;
122 break;
123 case LDB_ERR_ALIAS_DEREFERENCING_PROBLEM:
124 err = WERR_DS_ALIAS_DEREF_PROBLEM;
125 break;
126 case LDB_ERR_INAPPROPRIATE_AUTHENTICATION:
127 err = WERR_DS_INAPPROPRIATE_AUTH;
128 break;
129 case LDB_ERR_INVALID_CREDENTIALS:
130 err = WERR_ACCESS_DENIED;
131 break;
132 case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
133 err = WERR_DS_INSUFF_ACCESS_RIGHTS;
134 break;
135 case LDB_ERR_BUSY:
136 err = WERR_DS_BUSY;
137 break;
138 case LDB_ERR_UNAVAILABLE:
139 err = WERR_DS_UNAVAILABLE;
140 break;
141 case LDB_ERR_UNWILLING_TO_PERFORM:
142 err = WERR_DS_UNWILLING_TO_PERFORM;
143 break;
144 case LDB_ERR_LOOP_DETECT:
145 err = WERR_DS_LOOP_DETECT;
146 break;
147 case LDB_ERR_NAMING_VIOLATION:
148 err = WERR_DS_NAMING_VIOLATION;
149 break;
150 case LDB_ERR_OBJECT_CLASS_VIOLATION:
151 err = WERR_DS_OBJ_CLASS_VIOLATION;
152 break;
153 case LDB_ERR_NOT_ALLOWED_ON_NON_LEAF:
154 err = WERR_DS_CANT_ON_NON_LEAF;
155 break;
156 case LDB_ERR_NOT_ALLOWED_ON_RDN:
157 err = WERR_DS_CANT_ON_RDN;
158 break;
159 case LDB_ERR_ENTRY_ALREADY_EXISTS:
160 err = WERR_DS_OBJ_STRING_NAME_EXISTS;
161 break;
162 case LDB_ERR_OBJECT_CLASS_MODS_PROHIBITED:
163 err = WERR_DS_CANT_MOD_OBJ_CLASS;
164 break;
165 case LDB_ERR_AFFECTS_MULTIPLE_DSAS:
166 err = WERR_DS_AFFECTS_MULTIPLE_DSAS;
167 break;
168 default:
169 err = WERR_DS_GENERIC_ERROR;
170 break;
171 }
172
173 *errstring = talloc_asprintf(mem_ctx, "%08X: %s", W_ERROR_V(err),
174 add_err_string != NULL ? add_err_string : ldb_strerror(ldb_err));
175
176 /* result is 1:1 for now */
177 return ldb_err;
178 }
179
180 /*
181 connect to the sam database
182 */
183 NTSTATUS ldapsrv_backend_Init(struct ldapsrv_connection *conn)
184 {
185 conn->ldb = samdb_connect(conn,
186 conn->connection->event.ctx,
187 conn->lp_ctx,
188 conn->session_info,
189 conn->global_catalog ? LDB_FLG_RDONLY : 0);
190 if (conn->ldb == NULL) {
191 return NT_STATUS_INTERNAL_DB_CORRUPTION;
192 }
193
194 if (conn->server_credentials) {
195 char **sasl_mechs = NULL;
196 const struct gensec_security_ops * const *backends = gensec_security_all();
197 const struct gensec_security_ops **ops
198 = gensec_use_kerberos_mechs(conn, backends, conn->server_credentials);
199 unsigned int i, j = 0;
200 for (i = 0; ops && ops[i]; i++) {
201 if (!lpcfg_parm_bool(conn->lp_ctx, NULL, "gensec", ops[i]->name, ops[i]->enabled))
202 continue;
203
204 if (ops[i]->sasl_name && ops[i]->server_start) {
205 char *sasl_name = talloc_strdup(conn, ops[i]->sasl_name);
206
207 if (!sasl_name) {
208 return NT_STATUS_NO_MEMORY;
209 }
210 sasl_mechs = talloc_realloc(conn, sasl_mechs, char *, j + 2);
211 if (!sasl_mechs) {
212 return NT_STATUS_NO_MEMORY;
213 }
214 sasl_mechs[j] = sasl_name;
215 talloc_steal(sasl_mechs, sasl_name);
216 sasl_mechs[j+1] = NULL;
217 j++;
218 }
219 }
220 talloc_unlink(conn, ops);
221
222 /* ldb can have a different lifetime to conn, so we
223 need to ensure that sasl_mechs lives as long as the
224 ldb does */
225 talloc_steal(conn->ldb, sasl_mechs);
226
227 ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs);
228 }
229
230 ldb_set_opaque(conn->ldb, "remoteAddress",
231 conn->connection->remote_address);
232
233 return NT_STATUS_OK;
234 }
235
236 struct ldapsrv_reply *ldapsrv_init_reply(struct ldapsrv_call *call, uint8_t type)
237 {
238 struct ldapsrv_reply *reply;
239
240 reply = talloc(call, struct ldapsrv_reply);
241 if (!reply) {
242 return NULL;
243 }
244 reply->msg = talloc(reply, struct ldap_message);
245 if (reply->msg == NULL) {
246 talloc_free(reply);
247 return NULL;
248 }
249
250 reply->msg->messageid = call->request->messageid;
251 reply->msg->type = type;
252 reply->msg->controls = NULL;
253
254 return reply;
255 }
256
257 void ldapsrv_queue_reply(struct ldapsrv_call *call, struct ldapsrv_reply *reply)
258 {
259 DLIST_ADD_END(call->replies, reply);
260 }
261
262 static NTSTATUS ldapsrv_unwilling(struct ldapsrv_call *call, int error)
263 {
264 struct ldapsrv_reply *reply;
265 struct ldap_ExtendedResponse *r;
266
267 DEBUG(10,("Unwilling type[%d] id[%d]\n", call->request->type, call->request->messageid));
268
269 reply = ldapsrv_init_reply(call, LDAP_TAG_ExtendedResponse);
270 if (!reply) {
271 return NT_STATUS_NO_MEMORY;
272 }
273
274 r = &reply->msg->r.ExtendedResponse;
275 r->response.resultcode = error;
276 r->response.dn = NULL;
277 r->response.errormessage = NULL;
278 r->response.referral = NULL;
279 r->oid = NULL;
280 r->value = NULL;
281
282 ldapsrv_queue_reply(call, reply);
283 return NT_STATUS_OK;
284 }
285
286 static int ldapsrv_add_with_controls(struct ldapsrv_call *call,
287 const struct ldb_message *message,
288 struct ldb_control **controls,
289 struct ldb_result *res)
290 {
291 struct ldb_context *ldb = call->conn->ldb;
292 struct ldb_request *req;
293 int ret;
294
295 ret = ldb_msg_sanity_check(ldb, message);
296 if (ret != LDB_SUCCESS) {
297 return ret;
298 }
299
300 ret = ldb_build_add_req(&req, ldb, ldb,
301 message,
302 controls,
303 res,
304 ldb_modify_default_callback,
305 NULL);
306
307 if (ret != LDB_SUCCESS) return ret;
308
309 if (call->conn->global_catalog) {
310 return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM, "modify forbidden on global catalog port");
311 }
312 ldb_request_add_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
313
314 ret = ldb_transaction_start(ldb);
315 if (ret != LDB_SUCCESS) {
316 return ret;
317 }
318
319 if (!call->conn->is_privileged) {
320 ldb_req_mark_untrusted(req);
321 }
322
323 LDB_REQ_SET_LOCATION(req);
324
325 ret = ldb_request(ldb, req);
326 if (ret == LDB_SUCCESS) {
327 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
328 }
329
330 if (ret == LDB_SUCCESS) {
331 ret = ldb_transaction_commit(ldb);
332 }
333 else {
334 ldb_transaction_cancel(ldb);
335 }
336
337 talloc_free(req);
338 return ret;
339 }
340
341 /* create and execute a modify request */
342 static int ldapsrv_mod_with_controls(struct ldapsrv_call *call,
343 const struct ldb_message *message,
344 struct ldb_control **controls,
345 struct ldb_result *res)
346 {
347 struct ldb_context *ldb = call->conn->ldb;
348 struct ldb_request *req;
349 int ret;
350
351 ret = ldb_msg_sanity_check(ldb, message);
352 if (ret != LDB_SUCCESS) {
353 return ret;
354 }
355
356 ret = ldb_build_mod_req(&req, ldb, ldb,
357 message,
358 controls,
359 res,
360 ldb_modify_default_callback,
361 NULL);
362
363 if (ret != LDB_SUCCESS) {
364 return ret;
365 }
366
367 if (call->conn->global_catalog) {
368 return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM, "modify forbidden on global catalog port");
369 }
370 ldb_request_add_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
371
372 ret = ldb_transaction_start(ldb);
373 if (ret != LDB_SUCCESS) {
374 return ret;
375 }
376
377 if (!call->conn->is_privileged) {
378 ldb_req_mark_untrusted(req);
379 }
380
381 LDB_REQ_SET_LOCATION(req);
382
383 ret = ldb_request(ldb, req);
384 if (ret == LDB_SUCCESS) {
385 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
386 }
387
388 if (ret == LDB_SUCCESS) {
389 ret = ldb_transaction_commit(ldb);
390 }
391 else {
392 ldb_transaction_cancel(ldb);
393 }
394
395 talloc_free(req);
396 return ret;
397 }
398
399 /* create and execute a delete request */
400 static int ldapsrv_del_with_controls(struct ldapsrv_call *call,
401 struct ldb_dn *dn,
402 struct ldb_control **controls,
403 struct ldb_result *res)
404 {
405 struct ldb_context *ldb = call->conn->ldb;
406 struct ldb_request *req;
407 int ret;
408
409 ret = ldb_build_del_req(&req, ldb, ldb,
410 dn,
411 controls,
412 res,
413 ldb_modify_default_callback,
414 NULL);
415
416 if (ret != LDB_SUCCESS) return ret;
417
418 if (call->conn->global_catalog) {
419 return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM, "modify forbidden on global catalog port");
420 }
421 ldb_request_add_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
422
423 ret = ldb_transaction_start(ldb);
424 if (ret != LDB_SUCCESS) {
425 return ret;
426 }
427
428 if (!call->conn->is_privileged) {
429 ldb_req_mark_untrusted(req);
430 }
431
432 LDB_REQ_SET_LOCATION(req);
433
434 ret = ldb_request(ldb, req);
435 if (ret == LDB_SUCCESS) {
436 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
437 }
438
439 if (ret == LDB_SUCCESS) {
440 ret = ldb_transaction_commit(ldb);
441 }
442 else {
443 ldb_transaction_cancel(ldb);
444 }
445
446 talloc_free(req);
447 return ret;
448 }
449
450 static int ldapsrv_rename_with_controls(struct ldapsrv_call *call,
451 struct ldb_dn *olddn,
452 struct ldb_dn *newdn,
453 struct ldb_control **controls,
454 struct ldb_result *res)
455 {
456 struct ldb_context *ldb = call->conn->ldb;
457 struct ldb_request *req;
458 int ret;
459
460 ret = ldb_build_rename_req(&req, ldb, ldb,
461 olddn,
462 newdn,
463 controls,
464 res,
465 ldb_modify_default_callback,
466 NULL);
467
468 if (ret != LDB_SUCCESS) return ret;
469
470 if (call->conn->global_catalog) {
471 return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM, "modify forbidden on global catalog port");
472 }
473 ldb_request_add_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
474
475 ret = ldb_transaction_start(ldb);
476 if (ret != LDB_SUCCESS) {
477 return ret;
478 }
479
480 if (!call->conn->is_privileged) {
481 ldb_req_mark_untrusted(req);
482 }
483
484 LDB_REQ_SET_LOCATION(req);
485
486 ret = ldb_request(ldb, req);
487 if (ret == LDB_SUCCESS) {
488 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
489 }
490
491 if (ret == LDB_SUCCESS) {
492 ret = ldb_transaction_commit(ldb);
493 }
494 else {
495 ldb_transaction_cancel(ldb);
496 }
497
498 talloc_free(req);
499 return ret;
500 }
501
502 static NTSTATUS ldapsrv_SearchRequest(struct ldapsrv_call *call)
503 {
504 struct ldap_SearchRequest *req = &call->request->r.SearchRequest;
505 struct ldap_SearchResEntry *ent;
506 struct ldap_Result *done;
507 struct ldapsrv_reply *ent_r, *done_r;
508 TALLOC_CTX *local_ctx;
509 struct ldb_context *samdb = talloc_get_type(call->conn->ldb, struct ldb_context);
510 struct ldb_dn *basedn;
511 struct ldb_result *res = NULL;
512 struct ldb_request *lreq;
513 struct ldb_control *search_control;
514 struct ldb_search_options_control *search_options;
515 struct ldb_control *extended_dn_control;
516 struct ldb_extended_dn_control *extended_dn_decoded = NULL;
517 struct ldb_control *notification_control = NULL;
518 enum ldb_scope scope = LDB_SCOPE_DEFAULT;
519 const char **attrs = NULL;
520 const char *scope_str, *errstr = NULL;
521 int success_limit = 1;
522 int result = -1;
523 int ldb_ret = -1;
524 unsigned int i, j;
525 int extended_type = 1;
526
527 DEBUG(10, ("SearchRequest"));
528 DEBUGADD(10, (" basedn: %s", req->basedn));
529 DEBUGADD(10, (" filter: %s\n", ldb_filter_from_tree(call, req->tree)));
530
531 local_ctx = talloc_new(call);
532 NT_STATUS_HAVE_NO_MEMORY(local_ctx);
533
534 basedn = ldb_dn_new(local_ctx, samdb, req->basedn);
535 NT_STATUS_HAVE_NO_MEMORY(basedn);
536
537 DEBUG(10, ("SearchRequest: basedn: [%s]\n", req->basedn));
538 DEBUG(10, ("SearchRequest: filter: [%s]\n", ldb_filter_from_tree(call, req->tree)));
539
540 switch (req->scope) {
541 case LDAP_SEARCH_SCOPE_BASE:
542 scope_str = "BASE";
543 scope = LDB_SCOPE_BASE;
544 success_limit = 0;
545 break;
546 case LDAP_SEARCH_SCOPE_SINGLE:
547 scope_str = "ONE";
548 scope = LDB_SCOPE_ONELEVEL;
549 success_limit = 0;
550 break;
551 case LDAP_SEARCH_SCOPE_SUB:
552 scope_str = "SUB";
553 scope = LDB_SCOPE_SUBTREE;
554 success_limit = 0;
555 break;
556 default:
557 result = LDAP_PROTOCOL_ERROR;
558 map_ldb_error(local_ctx, LDB_ERR_PROTOCOL_ERROR, NULL,
559 &errstr);
560 errstr = talloc_asprintf(local_ctx,
561 "%s. Invalid scope", errstr);
562 goto reply;
563 }
564 DEBUG(10,("SearchRequest: scope: [%s]\n", scope_str));
565
566 if (req->num_attributes >= 1) {
567 attrs = talloc_array(local_ctx, const char *, req->num_attributes+1);
568 NT_STATUS_HAVE_NO_MEMORY(attrs);
569
570 for (i=0; i < req->num_attributes; i++) {
571 DEBUG(10,("SearchRequest: attrs: [%s]\n",req->attributes[i]));
572 attrs[i] = req->attributes[i];
573 }
574 attrs[i] = NULL;
575 }
576
577 DEBUG(5,("ldb_request %s dn=%s filter=%s\n",
578 scope_str, req->basedn, ldb_filter_from_tree(call, req->tree)));
579
580 res = talloc_zero(local_ctx, struct ldb_result);
581 NT_STATUS_HAVE_NO_MEMORY(res);
582
583 ldb_ret = ldb_build_search_req_ex(&lreq, samdb, local_ctx,
584 basedn, scope,
585 req->tree, attrs,
586 call->request->controls,
587 res, ldb_search_default_callback,
588 NULL);
589
590 if (ldb_ret != LDB_SUCCESS) {
591 goto reply;
592 }
593
594 if (call->conn->global_catalog) {
595 search_control = ldb_request_get_control(lreq, LDB_CONTROL_SEARCH_OPTIONS_OID);
596
597 search_options = NULL;
598 if (search_control) {
599 search_options = talloc_get_type(search_control->data, struct ldb_search_options_control);
600 search_options->search_options |= LDB_SEARCH_OPTION_PHANTOM_ROOT;
601 } else {
602 search_options = talloc(lreq, struct ldb_search_options_control);
603 NT_STATUS_HAVE_NO_MEMORY(search_options);
604 search_options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
605 ldb_request_add_control(lreq, LDB_CONTROL_SEARCH_OPTIONS_OID, false, search_options);
606 }
607 } else {
608 ldb_request_add_control(lreq, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
609 }
610
611 extended_dn_control = ldb_request_get_control(lreq, LDB_CONTROL_EXTENDED_DN_OID);
612
613 if (extended_dn_control) {
614 if (extended_dn_control->data) {
615 extended_dn_decoded = talloc_get_type(extended_dn_control->data, struct ldb_extended_dn_control);
616 extended_type = extended_dn_decoded->type;
617 } else {
618 extended_type = 0;
619 }
620 }
621
622 notification_control = ldb_request_get_control(lreq, LDB_CONTROL_NOTIFICATION_OID);
623 if (notification_control != NULL) {
624 const struct ldapsrv_call *pc = NULL;
625 size_t count = 0;
626
627 for (pc = call->conn->pending_calls; pc != NULL; pc = pc->next) {
628 count += 1;
629 }
630
631 if (count >= call->conn->limits.max_notifications) {
632 DEBUG(10,("SearchRequest: error MaxNotificationPerConn\n"));
633 result = map_ldb_error(local_ctx,
634 LDB_ERR_ADMIN_LIMIT_EXCEEDED,
635 "MaxNotificationPerConn reached",
636 &errstr);
637 goto reply;
638 }
639
640 /*
641 * For now we need to do periodic retries on our own.
642 * As the dsdb_notification module will return after each run.
643 */
644 call->notification.busy = true;
645 }
646
647 ldb_set_timeout(samdb, lreq, req->timelimit);
648
649 if (!call->conn->is_privileged) {
650 ldb_req_mark_untrusted(lreq);
651 }
652
653 LDB_REQ_SET_LOCATION(lreq);
654
655 ldb_ret = ldb_request(samdb, lreq);
656
657 if (ldb_ret != LDB_SUCCESS) {
658 goto reply;
659 }
660
661 ldb_ret = ldb_wait(lreq->handle, LDB_WAIT_ALL);
662
663 if (ldb_ret == LDB_SUCCESS) {
664 for (i = 0; i < res->count; i++) {
665 ent_r = ldapsrv_init_reply(call, LDAP_TAG_SearchResultEntry);
666 NT_STATUS_HAVE_NO_MEMORY(ent_r);
667
668 /* Better to have the whole message kept here,
669 * than to find someone further up didn't put
670 * a value in the right spot in the talloc tree */
671 talloc_steal(ent_r, res->msgs[i]);
672
673 ent = &ent_r->msg->r.SearchResultEntry;
674 ent->dn = ldb_dn_get_extended_linearized(ent_r, res->msgs[i]->dn, extended_type);
675 ent->num_attributes = 0;
676 ent->attributes = NULL;
677 if (res->msgs[i]->num_elements == 0) {
678 goto queue_reply;
679 }
680 ent->num_attributes = res->msgs[i]->num_elements;
681 ent->attributes = talloc_array(ent_r, struct ldb_message_element, ent->num_attributes);
682 NT_STATUS_HAVE_NO_MEMORY(ent->attributes);
683 for (j=0; j < ent->num_attributes; j++) {
684 ent->attributes[j].name = res->msgs[i]->elements[j].name;
685 ent->attributes[j].num_values = 0;
686 ent->attributes[j].values = NULL;
687 if (req->attributesonly && (res->msgs[i]->elements[j].num_values == 0)) {
688 continue;
689 }
690 ent->attributes[j].num_values = res->msgs[i]->elements[j].num_values;
691 ent->attributes[j].values = res->msgs[i]->elements[j].values;
692 }
693 queue_reply:
694 ldapsrv_queue_reply(call, ent_r);
695 }
696
697 if (call->notification.busy) {
698 /* Move/Add it to the end */
699 DLIST_DEMOTE(call->conn->pending_calls, call);
700 call->notification.generation =
701 call->conn->service->notification.generation;
702
703 if (res->count != 0) {
704 call->notification.generation += 1;
705 ldapsrv_notification_retry_setup(call->conn->service,
706 true);
707 }
708
709 talloc_free(local_ctx);
710 return NT_STATUS_OK;
711 }
712
713 /* Send back referrals if they do exist (search operations) */
714 if (res->refs != NULL) {
715 char **ref;
716 struct ldap_SearchResRef *ent_ref;
717
718 for (ref = res->refs; *ref != NULL; ++ref) {
719 ent_r = ldapsrv_init_reply(call, LDAP_TAG_SearchResultReference);
720 NT_STATUS_HAVE_NO_MEMORY(ent_r);
721
722 /* Better to have the whole referrals kept here,
723 * than to find someone further up didn't put
724 * a value in the right spot in the talloc tree
725 */
726 talloc_steal(ent_r, *ref);
727
728 ent_ref = &ent_r->msg->r.SearchResultReference;
729 ent_ref->referral = *ref;
730
731 ldapsrv_queue_reply(call, ent_r);
732 }
733 }
734 }
735
736 reply:
737 DLIST_REMOVE(call->conn->pending_calls, call);
738 call->notification.busy = false;
739
740 done_r = ldapsrv_init_reply(call, LDAP_TAG_SearchResultDone);
741 NT_STATUS_HAVE_NO_MEMORY(done_r);
742
743 done = &done_r->msg->r.SearchResultDone;
744 done->dn = NULL;
745 done->referral = NULL;
746
747 if (result != -1) {
748 } else if (ldb_ret == LDB_SUCCESS) {
749 if (res->count >= success_limit) {
750 DEBUG(10,("SearchRequest: results: [%d]\n", res->count));
751 result = LDAP_SUCCESS;
752 errstr = NULL;
753 }
754 if (res->controls) {
755 done_r->msg->controls = res->controls;
756 talloc_steal(done_r, res->controls);
757 }
758 } else {
759 DEBUG(10,("SearchRequest: error\n"));
760 result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
761 &errstr);
762 }
763
764 done->resultcode = result;
765 done->errormessage = (errstr?talloc_strdup(done_r, errstr):NULL);
766
767 talloc_free(local_ctx);
768
769 ldapsrv_queue_reply(call, done_r);
770 return NT_STATUS_OK;
771 }
772
773 static NTSTATUS ldapsrv_ModifyRequest(struct ldapsrv_call *call)
774 {
775 struct ldap_ModifyRequest *req = &call->request->r.ModifyRequest;
776 struct ldap_Result *modify_result;
777 struct ldapsrv_reply *modify_reply;
778 TALLOC_CTX *local_ctx;
779 struct ldb_context *samdb = call->conn->ldb;
780 struct ldb_message *msg = NULL;
781 struct ldb_dn *dn;
782 const char *errstr = NULL;
783 int result = LDAP_SUCCESS;
784 int ldb_ret;
785 unsigned int i,j;
786 struct ldb_result *res = NULL;
787
788 DEBUG(10, ("ModifyRequest"));
789 DEBUGADD(10, (" dn: %s\n", req->dn));
790
791 local_ctx = talloc_named(call, 0, "ModifyRequest local memory context");
792 NT_STATUS_HAVE_NO_MEMORY(local_ctx);
793
794 dn = ldb_dn_new(local_ctx, samdb, req->dn);
795 NT_STATUS_HAVE_NO_MEMORY(dn);
796
797 DEBUG(10, ("ModifyRequest: dn: [%s]\n", req->dn));
798
799 msg = talloc(local_ctx, struct ldb_message);
800 NT_STATUS_HAVE_NO_MEMORY(msg);
801
802 msg->dn = dn;
803 msg->num_elements = 0;
804 msg->elements = NULL;
805
806 if (req->num_mods > 0) {
807 msg->num_elements = req->num_mods;
808 msg->elements = talloc_array(msg, struct ldb_message_element, req->num_mods);
809 NT_STATUS_HAVE_NO_MEMORY(msg->elements);
810
811 for (i=0; i < msg->num_elements; i++) {
812 msg->elements[i].name = discard_const_p(char, req->mods[i].attrib.name);
813 msg->elements[i].num_values = 0;
814 msg->elements[i].values = NULL;
815
816 switch (req->mods[i].type) {
817 default:
818 result = LDAP_PROTOCOL_ERROR;
819 map_ldb_error(local_ctx,
820 LDB_ERR_PROTOCOL_ERROR, NULL, &errstr);
821 errstr = talloc_asprintf(local_ctx,
822 "%s. Invalid LDAP_MODIFY_* type", errstr);
823 goto reply;
824 case LDAP_MODIFY_ADD:
825 msg->elements[i].flags = LDB_FLAG_MOD_ADD;
826 break;
827 case LDAP_MODIFY_DELETE:
828 msg->elements[i].flags = LDB_FLAG_MOD_DELETE;
829 break;
830 case LDAP_MODIFY_REPLACE:
831 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
832 break;
833 }
834
835 msg->elements[i].num_values = req->mods[i].attrib.num_values;
836 if (msg->elements[i].num_values > 0) {
837 msg->elements[i].values = talloc_array(msg->elements, struct ldb_val,
838 msg->elements[i].num_values);
839 NT_STATUS_HAVE_NO_MEMORY(msg->elements[i].values);
840
841 for (j=0; j < msg->elements[i].num_values; j++) {
842 msg->elements[i].values[j].length = req->mods[i].attrib.values[j].length;
843 msg->elements[i].values[j].data = req->mods[i].attrib.values[j].data;
844 }
845 }
846 }
847 }
848
849 reply:
850 modify_reply = ldapsrv_init_reply(call, LDAP_TAG_ModifyResponse);
851 NT_STATUS_HAVE_NO_MEMORY(modify_reply);
852
853 if (result == LDAP_SUCCESS) {
854 res = talloc_zero(local_ctx, struct ldb_result);
855 NT_STATUS_HAVE_NO_MEMORY(res);
856 ldb_ret = ldapsrv_mod_with_controls(call, msg, call->request->controls, res);
857 result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
858 &errstr);
859 }
860
861 modify_result = &modify_reply->msg->r.ModifyResponse;
862 modify_result->dn = NULL;
863 if ((res != NULL) && (res->refs != NULL)) {
864 modify_result->resultcode = map_ldb_error(local_ctx,
865 LDB_ERR_REFERRAL,
866 NULL, &errstr);
867 modify_result->errormessage = (errstr?talloc_strdup(modify_reply, errstr):NULL);
868 modify_result->referral = talloc_strdup(call, *res->refs);
869 } else {
870 modify_result->resultcode = result;
871 modify_result->errormessage = (errstr?talloc_strdup(modify_reply, errstr):NULL);
872 modify_result->referral = NULL;
873 }
874 talloc_free(local_ctx);
875
876 ldapsrv_queue_reply(call, modify_reply);
877 return NT_STATUS_OK;
878
879 }
880
881 static NTSTATUS ldapsrv_AddRequest(struct ldapsrv_call *call)
882 {
883 struct ldap_AddRequest *req = &call->request->r.AddRequest;
884 struct ldap_Result *add_result;
885 struct ldapsrv_reply *add_reply;
886 TALLOC_CTX *local_ctx;
887 struct ldb_context *samdb = call->conn->ldb;
888 struct ldb_message *msg = NULL;
889 struct ldb_dn *dn;
890 const char *errstr = NULL;
891 int result = LDAP_SUCCESS;
892 int ldb_ret;
893 unsigned int i,j;
894 struct ldb_result *res = NULL;
895
896 DEBUG(10, ("AddRequest"));
897 DEBUGADD(10, (" dn: %s\n", req->dn));
898
899 local_ctx = talloc_named(call, 0, "AddRequest local memory context");
900 NT_STATUS_HAVE_NO_MEMORY(local_ctx);
901
902 dn = ldb_dn_new(local_ctx, samdb, req->dn);
903 NT_STATUS_HAVE_NO_MEMORY(dn);
904
905 DEBUG(10, ("AddRequest: dn: [%s]\n", req->dn));
906
907 msg = talloc(local_ctx, struct ldb_message);
908 NT_STATUS_HAVE_NO_MEMORY(msg);
909
910 msg->dn = dn;
911 msg->num_elements = 0;
912 msg->elements = NULL;
913
914 if (req->num_attributes > 0) {
915 msg->num_elements = req->num_attributes;
916 msg->elements = talloc_array(msg, struct ldb_message_element, msg->num_elements);
917 NT_STATUS_HAVE_NO_MEMORY(msg->elements);
918
919 for (i=0; i < msg->num_elements; i++) {
920 msg->elements[i].name = discard_const_p(char, req->attributes[i].name);
921 msg->elements[i].flags = 0;
922 msg->elements[i].num_values = 0;
923 msg->elements[i].values = NULL;
924
925 if (req->attributes[i].num_values > 0) {
926 msg->elements[i].num_values = req->attributes[i].num_values;
927 msg->elements[i].values = talloc_array(msg->elements, struct ldb_val,
928 msg->elements[i].num_values);
929 NT_STATUS_HAVE_NO_MEMORY(msg->elements[i].values);
930
931 for (j=0; j < msg->elements[i].num_values; j++) {
932 msg->elements[i].values[j].length = req->attributes[i].values[j].length;
933 msg->elements[i].values[j].data = req->attributes[i].values[j].data;
934 }
935 }
936 }
937 }
938
939 add_reply = ldapsrv_init_reply(call, LDAP_TAG_AddResponse);
940 NT_STATUS_HAVE_NO_MEMORY(add_reply);
941
942 if (result == LDAP_SUCCESS) {
943 res = talloc_zero(local_ctx, struct ldb_result);
944 NT_STATUS_HAVE_NO_MEMORY(res);
945 ldb_ret = ldapsrv_add_with_controls(call, msg, call->request->controls, res);
946 result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
947 &errstr);
948 }
949
950 add_result = &add_reply->msg->r.AddResponse;
951 add_result->dn = NULL;
952 if ((res != NULL) && (res->refs != NULL)) {
953 add_result->resultcode = map_ldb_error(local_ctx,
954 LDB_ERR_REFERRAL, NULL,
955 &errstr);
956 add_result->errormessage = (errstr?talloc_strdup(add_reply,errstr):NULL);
957 add_result->referral = talloc_strdup(call, *res->refs);
958 } else {
959 add_result->resultcode = result;
960 add_result->errormessage = (errstr?talloc_strdup(add_reply,errstr):NULL);
961 add_result->referral = NULL;
962 }
963 talloc_free(local_ctx);
964
965 ldapsrv_queue_reply(call, add_reply);
966 return NT_STATUS_OK;
967
968 }
969
970 static NTSTATUS ldapsrv_DelRequest(struct ldapsrv_call *call)
971 {
972 struct ldap_DelRequest *req = &call->request->r.DelRequest;
973 struct ldap_Result *del_result;
974 struct ldapsrv_reply *del_reply;
975 TALLOC_CTX *local_ctx;
976 struct ldb_context *samdb = call->conn->ldb;
977 struct ldb_dn *dn;
978 const char *errstr = NULL;
979 int result = LDAP_SUCCESS;
980 int ldb_ret;
981 struct ldb_result *res = NULL;
982
983 DEBUG(10, ("DelRequest"));
984 DEBUGADD(10, (" dn: %s\n", req->dn));
985
986 local_ctx = talloc_named(call, 0, "DelRequest local memory context");
987 NT_STATUS_HAVE_NO_MEMORY(local_ctx);
988
989 dn = ldb_dn_new(local_ctx, samdb, req->dn);
990 NT_STATUS_HAVE_NO_MEMORY(dn);
991
992 DEBUG(10, ("DelRequest: dn: [%s]\n", req->dn));
993
994 del_reply = ldapsrv_init_reply(call, LDAP_TAG_DelResponse);
995 NT_STATUS_HAVE_NO_MEMORY(del_reply);
996
997 if (result == LDAP_SUCCESS) {
998 res = talloc_zero(local_ctx, struct ldb_result);
999 NT_STATUS_HAVE_NO_MEMORY(res);
1000 ldb_ret = ldapsrv_del_with_controls(call, dn, call->request->controls, res);
1001 result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
1002 &errstr);
1003 }
1004
1005 del_result = &del_reply->msg->r.DelResponse;
1006 del_result->dn = NULL;
1007 if ((res != NULL) && (res->refs != NULL)) {
1008 del_result->resultcode = map_ldb_error(local_ctx,
1009 LDB_ERR_REFERRAL, NULL,
1010 &errstr);
1011 del_result->errormessage = (errstr?talloc_strdup(del_reply,errstr):NULL);
1012 del_result->referral = talloc_strdup(call, *res->refs);
1013 } else {
1014 del_result->resultcode = result;
1015 del_result->errormessage = (errstr?talloc_strdup(del_reply,errstr):NULL);
1016 del_result->referral = NULL;
1017 }
1018
1019 talloc_free(local_ctx);
1020
1021 ldapsrv_queue_reply(call, del_reply);
1022 return NT_STATUS_OK;
1023 }
1024
1025 static NTSTATUS ldapsrv_ModifyDNRequest(struct ldapsrv_call *call)
1026 {
1027 struct ldap_ModifyDNRequest *req = &call->request->r.ModifyDNRequest;
1028 struct ldap_Result *modifydn;
1029 struct ldapsrv_reply *modifydn_r;
1030 TALLOC_CTX *local_ctx;
1031 struct ldb_context *samdb = call->conn->ldb;
1032 struct ldb_dn *olddn, *newdn=NULL, *newrdn;
1033 struct ldb_dn *parentdn = NULL;
1034 const char *errstr = NULL;
1035 int result = LDAP_SUCCESS;
1036 int ldb_ret;
1037 struct ldb_result *res = NULL;
1038
1039 DEBUG(10, ("ModifyDNRequest"));
1040 DEBUGADD(10, (" dn: %s", req->dn));
1041 DEBUGADD(10, (" newrdn: %s\n", req->newrdn));
1042
1043 local_ctx = talloc_named(call, 0, "ModifyDNRequest local memory context");
1044 NT_STATUS_HAVE_NO_MEMORY(local_ctx);
1045
1046 olddn = ldb_dn_new(local_ctx, samdb, req->dn);
1047 NT_STATUS_HAVE_NO_MEMORY(olddn);
1048
1049 newrdn = ldb_dn_new(local_ctx, samdb, req->newrdn);
1050 NT_STATUS_HAVE_NO_MEMORY(newrdn);
1051
1052 DEBUG(10, ("ModifyDNRequest: olddn: [%s]\n", req->dn));
1053 DEBUG(10, ("ModifyDNRequest: newrdn: [%s]\n", req->newrdn));
1054
1055 if (ldb_dn_get_comp_num(newrdn) == 0) {
1056 result = LDAP_PROTOCOL_ERROR;
1057 map_ldb_error(local_ctx, LDB_ERR_PROTOCOL_ERROR, NULL,
1058 &errstr);
1059 goto reply;
1060 }
1061
1062 if (ldb_dn_get_comp_num(newrdn) > 1) {
1063 result = LDAP_NAMING_VIOLATION;
1064 map_ldb_error(local_ctx, LDB_ERR_NAMING_VIOLATION, NULL,
1065 &errstr);
1066 goto reply;
1067 }
1068
1069 /* we can't handle the rename if we should not remove the old dn */
1070 if (!req->deleteolddn) {
1071 result = LDAP_UNWILLING_TO_PERFORM;
1072 map_ldb_error(local_ctx, LDB_ERR_UNWILLING_TO_PERFORM, NULL,
1073 &errstr);
1074 errstr = talloc_asprintf(local_ctx,
1075 "%s. Old RDN must be deleted", errstr);
1076 goto reply;
1077 }
1078
1079 if (req->newsuperior) {
1080 DEBUG(10, ("ModifyDNRequest: newsuperior: [%s]\n", req->newsuperior));
1081 parentdn = ldb_dn_new(local_ctx, samdb, req->newsuperior);
1082 }
1083
1084 if (!parentdn) {
1085 parentdn = ldb_dn_get_parent(local_ctx, olddn);
1086 }
1087 if (!parentdn) {
1088 result = LDAP_NO_SUCH_OBJECT;
1089 map_ldb_error(local_ctx, LDB_ERR_NO_SUCH_OBJECT, NULL, &errstr);
1090 goto reply;
1091 }
1092
1093 if ( ! ldb_dn_add_child(parentdn, newrdn)) {
1094 result = LDAP_OTHER;
1095 map_ldb_error(local_ctx, LDB_ERR_OTHER, NULL, &errstr);
1096 goto reply;
1097 }
1098 newdn = parentdn;
1099
1100 reply:
1101 modifydn_r = ldapsrv_init_reply(call, LDAP_TAG_ModifyDNResponse);
1102 NT_STATUS_HAVE_NO_MEMORY(modifydn_r);
1103
1104 if (result == LDAP_SUCCESS) {
1105 res = talloc_zero(local_ctx, struct ldb_result);
1106 NT_STATUS_HAVE_NO_MEMORY(res);
1107 ldb_ret = ldapsrv_rename_with_controls(call, olddn, newdn, call->request->controls, res);
1108 result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
1109 &errstr);
1110 }
1111
1112 modifydn = &modifydn_r->msg->r.ModifyDNResponse;
1113 modifydn->dn = NULL;
1114 if ((res != NULL) && (res->refs != NULL)) {
1115 modifydn->resultcode = map_ldb_error(local_ctx,
1116 LDB_ERR_REFERRAL, NULL,
1117 &errstr);;
1118 modifydn->errormessage = (errstr?talloc_strdup(modifydn_r,errstr):NULL);
1119 modifydn->referral = talloc_strdup(call, *res->refs);
1120 } else {
1121 modifydn->resultcode = result;
1122 modifydn->errormessage = (errstr?talloc_strdup(modifydn_r,errstr):NULL);
1123 modifydn->referral = NULL;
1124 }
1125
1126 talloc_free(local_ctx);
1127
1128 ldapsrv_queue_reply(call, modifydn_r);
1129 return NT_STATUS_OK;
1130 }
1131
1132 static NTSTATUS ldapsrv_CompareRequest(struct ldapsrv_call *call)
1133 {
1134 struct ldap_CompareRequest *req = &call->request->r.CompareRequest;
1135 struct ldap_Result *compare;
1136 struct ldapsrv_reply *compare_r;
1137 TALLOC_CTX *local_ctx;
1138 struct ldb_context *samdb = call->conn->ldb;
1139 struct ldb_result *res = NULL;
1140 struct ldb_dn *dn;
1141 const char *attrs[1];
1142 const char *errstr = NULL;
1143 const char *filter = NULL;
1144 int result = LDAP_SUCCESS;
1145 int ldb_ret;
1146
1147 DEBUG(10, ("CompareRequest"));
1148 DEBUGADD(10, (" dn: %s\n", req->dn));
1149
1150 local_ctx = talloc_named(call, 0, "CompareRequest local_memory_context");
1151 NT_STATUS_HAVE_NO_MEMORY(local_ctx);
1152
1153 dn = ldb_dn_new(local_ctx, samdb, req->dn);
1154 NT_STATUS_HAVE_NO_MEMORY(dn);
1155
1156 DEBUG(10, ("CompareRequest: dn: [%s]\n", req->dn));
1157 filter = talloc_asprintf(local_ctx, "(%s=%*s)", req->attribute,
1158 (int)req->value.length, req->value.data);
1159 NT_STATUS_HAVE_NO_MEMORY(filter);
1160
1161 DEBUGADD(10, ("CompareRequest: attribute: [%s]\n", filter));
1162
1163 attrs[0] = NULL;
1164
1165 compare_r = ldapsrv_init_reply(call, LDAP_TAG_CompareResponse);
1166 NT_STATUS_HAVE_NO_MEMORY(compare_r);
1167
1168 if (result == LDAP_SUCCESS) {
1169 ldb_ret = ldb_search(samdb, local_ctx, &res,
1170 dn, LDB_SCOPE_BASE, attrs, "%s", filter);
1171 if (ldb_ret != LDB_SUCCESS) {
1172 result = map_ldb_error(local_ctx, ldb_ret,
1173 ldb_errstring(samdb), &errstr);
1174 DEBUG(10,("CompareRequest: error: %s\n", errstr));
1175 } else if (res->count == 0) {
1176 DEBUG(10,("CompareRequest: doesn't matched\n"));
1177 result = LDAP_COMPARE_FALSE;
1178 errstr = NULL;
1179 } else if (res->count == 1) {
1180 DEBUG(10,("CompareRequest: matched\n"));
1181 result = LDAP_COMPARE_TRUE;
1182 errstr = NULL;
1183 } else if (res->count > 1) {
1184 result = LDAP_OTHER;
1185 map_ldb_error(local_ctx, LDB_ERR_OTHER, NULL, &errstr);
1186 errstr = talloc_asprintf(local_ctx,
1187 "%s. Too many objects match!", errstr);
1188 DEBUG(10,("CompareRequest: %d results: %s\n", res->count, errstr));
1189 }
1190 }
1191
1192 compare = &compare_r->msg->r.CompareResponse;
1193 compare->dn = NULL;
1194 compare->resultcode = result;
1195 compare->errormessage = (errstr?talloc_strdup(compare_r,errstr):NULL);
1196 compare->referral = NULL;
1197
1198 talloc_free(local_ctx);
1199
1200 ldapsrv_queue_reply(call, compare_r);
1201 return NT_STATUS_OK;
1202 }
1203
1204 static NTSTATUS ldapsrv_AbandonRequest(struct ldapsrv_call *call)
1205 {
1206 struct ldap_AbandonRequest *req = &call->request->r.AbandonRequest;
1207 struct ldapsrv_call *c = NULL;
1208 struct ldapsrv_call *n = NULL;
1209
1210 DEBUG(10, ("AbandonRequest\n"));
1211
1212 for (c = call->conn->pending_calls; c != NULL; c = n) {
1213 n = c->next;
1214
1215 if (c->request->messageid != req->messageid) {
1216 continue;
1217 }
1218
1219 DLIST_REMOVE(call->conn->pending_calls, c);
1220 TALLOC_FREE(c);
1221 }
1222
1223 return NT_STATUS_OK;
1224 }
1225
1226 NTSTATUS ldapsrv_do_call(struct ldapsrv_call *call)
1227 {
1228 unsigned int i;
1229 struct ldap_message *msg = call->request;
1230 NTSTATUS status;
1231 bool log = true;
1232
1233 /* Check for undecoded critical extensions */
1234 for (i=0; msg->controls && msg->controls[i]; i++) {
1235 if (!msg->controls_decoded[i] &&
1236 msg->controls[i]->critical) {
1237 DEBUG(3, ("ldapsrv_do_call: Critical extension %s is not known to this server\n",
1238 msg->controls[i]->oid));
1239 return ldapsrv_unwilling(call, LDAP_UNAVAILABLE_CRITICAL_EXTENSION);
1240 }
1241 }
1242
1243 if (call->conn->authz_logged == false) {
1244
1245 /*
1246 * We do not want to log anonymous access if the query
1247 * is just for the rootDSE, or it is a startTLS or a
1248 * Bind.
1249 *
1250 * A rootDSE search could also be done over
1251 * CLDAP anonymously for example, so these don't
1252 * really count.
1253 * Essentially we want to know about
1254 * access beyond that normally done prior to a
1255 * bind.
1256 */
1257
1258 switch(call->request->type) {
1259 case LDAP_TAG_BindRequest:
1260 log = false;
1261 break;
1262 case LDAP_TAG_ExtendedResponse: {
1263 struct ldap_ExtendedRequest *req = &call->request->r.ExtendedRequest;
1264 if (strcmp(req->oid, LDB_EXTENDED_START_TLS_OID) == 0) {
1265 log = false;
1266 }
1267 break;
1268 }
1269 case LDAP_TAG_SearchRequest: {
1270 struct ldap_SearchRequest *req = &call->request->r.SearchRequest;
1271 if (req->scope == LDAP_SEARCH_SCOPE_BASE) {
1272 if (req->basedn[0] == '\0') {
1273 log = false;
1274 }
1275 }
1276 break;
1277 }
1278 default:
1279 break;
1280 }
1281
1282 if (log) {
1283 log_successful_authz_event(call->conn->connection->remote_address,
1284 call->conn->connection->local_address,
1285 "LDAP",
1286 "no bind",
1287 call->conn->session_info);
1288
1289 call->conn->authz_logged = true;
1290 }
1291 }
1292
1293 switch(call->request->type) {
1294 case LDAP_TAG_BindRequest:
1295 return ldapsrv_BindRequest(call);
1296 case LDAP_TAG_UnbindRequest:
1297 return ldapsrv_UnbindRequest(call);
1298 case LDAP_TAG_SearchRequest:
1299 return ldapsrv_SearchRequest(call);
1300 case LDAP_TAG_ModifyRequest:
1301 status = ldapsrv_ModifyRequest(call);
1302 break;
1303 case LDAP_TAG_AddRequest:
1304 status = ldapsrv_AddRequest(call);
1305 break;
1306 case LDAP_TAG_DelRequest:
1307 status = ldapsrv_DelRequest(call);
1308 break;
1309 case LDAP_TAG_ModifyDNRequest:
1310 status = ldapsrv_ModifyDNRequest(call);
1311 break;
1312 case LDAP_TAG_CompareRequest:
1313 return ldapsrv_CompareRequest(call);
1314 case LDAP_TAG_AbandonRequest:
1315 return ldapsrv_AbandonRequest(call);
1316 case LDAP_TAG_ExtendedRequest:
1317 status = ldapsrv_ExtendedRequest(call);
1318 break;
1319 default:
1320 return ldapsrv_unwilling(call, LDAP_PROTOCOL_ERROR);
1321 }
1322
1323 if (NT_STATUS_IS_OK(status)) {
1324 ldapsrv_notification_retry_setup(call->conn->service, true);
1325 }
1326
1327 return status;
1328 }
Samba GIT mirror