source4/ldap_server/ldap_extended.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    LDAP server
   4    Copyright (C) Stefan Metzmacher 2004
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "ldap_server/ldap_server.h"
  22 #include "../lib/util/dlinklist.h"
  23 #include "libcli/ldap/ldap.h"
  24 #include "lib/tls/tls.h"
  25 #include "smbd/service_stream.h"
  26
  27 struct ldapsrv_starttls_context {
  28         struct ldapsrv_connection *conn;
  29         struct socket_context *tls_socket;
  30 };
  31
  32 static void ldapsrv_start_tls(void *private_data)
  33 {
  34         struct ldapsrv_starttls_context *ctx = talloc_get_type(private_data, struct ldapsrv_starttls_context);
  35         talloc_steal(ctx->conn->connection, ctx->tls_socket);
  36         talloc_unlink(ctx->conn->connection, ctx->conn->connection->socket);
  37
  38         ctx->conn->sockets.tls = ctx->tls_socket;
  39         ctx->conn->connection->socket = ctx->tls_socket;
  40         packet_set_socket(ctx->conn->packet, ctx->conn->connection->socket);
  41         packet_set_unreliable_select(ctx->conn->packet);
  42 }
  43
  44 static NTSTATUS ldapsrv_StartTLS(struct ldapsrv_call *call,
  45                                  struct ldapsrv_reply *reply,
  46                                  const char **errstr)
  47 {
  48         struct ldapsrv_starttls_context *ctx;
  49
  50         (*errstr) = NULL;
  51
  52         /*
  53          * TODO: give LDAP_OPERATIONS_ERROR also when
  54          *       there're pending requests or there's
  55          *       a SASL bind in progress
  56          *       (see rfc4513 section 3.1.1)
  57          */
  58         if (call->conn->sockets.tls) {
  59                 (*errstr) = talloc_asprintf(reply, "START-TLS: TLS is already enabled on this LDAP session");
  60                 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
  61         }
  62
  63         ctx = talloc(call, struct ldapsrv_starttls_context);
  64         NT_STATUS_HAVE_NO_MEMORY(ctx);
  65
  66         ctx->conn = call->conn;
  67         ctx->tls_socket = tls_init_server(call->conn->service->tls_params,
  68                                           call->conn->connection->socket,
  69                                           call->conn->connection->event.fde,
  70                                           NULL);
  71         if (!ctx->tls_socket) {
  72                 (*errstr) = talloc_asprintf(reply, "START-TLS: Failed to setup TLS socket");
  73                 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
  74         }
  75
  76         call->send_callback = ldapsrv_start_tls;
  77         call->send_private  = ctx;
  78
  79         reply->msg->r.ExtendedResponse.response.resultcode = LDAP_SUCCESS;
  80         reply->msg->r.ExtendedResponse.response.errormessage = NULL;
  81
  82         ldapsrv_queue_reply(call, reply);
  83         return NT_STATUS_OK;
  84 }
  85
  86 struct ldapsrv_extended_operation {
  87         const char *oid;
  88         NTSTATUS (*fn)(struct ldapsrv_call *call, struct ldapsrv_reply *reply, const char **errorstr);
  89 };
  90
  91 static struct ldapsrv_extended_operation extended_ops[] = {
  92         {
  93                 .oid    = LDB_EXTENDED_START_TLS_OID,
  94                 .fn     = ldapsrv_StartTLS,
  95         },{
  96                 .oid    = NULL,
  97                 .fn     = NULL,
  98         }
  99 };
 100
 101 NTSTATUS ldapsrv_ExtendedRequest(struct ldapsrv_call *call)
 102 {
 103         struct ldap_ExtendedRequest *req = &call->request->r.ExtendedRequest;
 104         struct ldapsrv_reply *reply;
 105         int result = LDAP_PROTOCOL_ERROR;
 106         const char *error_str = NULL;
 107         NTSTATUS status = NT_STATUS_OK;
 108         uint32_t i;
 109
 110         DEBUG(10, ("Extended\n"));
 111
 112         reply = ldapsrv_init_reply(call, LDAP_TAG_ExtendedResponse);
 113         NT_STATUS_HAVE_NO_MEMORY(reply);
 114
 115         ZERO_STRUCT(reply->msg->r);
 116         reply->msg->r.ExtendedResponse.oid = talloc_steal(reply, req->oid);
 117         reply->msg->r.ExtendedResponse.response.resultcode = LDAP_PROTOCOL_ERROR;
 118         reply->msg->r.ExtendedResponse.response.errormessage = NULL;
 119
 120         for (i=0; extended_ops[i].oid; i++) {
 121                 if (strcmp(extended_ops[i].oid,req->oid) != 0) continue;
 122
 123                 /*
 124                  * if the backend function returns an error we
 125                  * need to send the reply otherwise the reply is already
 126                  * send and we need to return directly
 127                  */
 128                 status = extended_ops[i].fn(call, reply, &error_str);
 129                 NT_STATUS_IS_OK_RETURN(status);
 130
 131                 if (NT_STATUS_IS_LDAP(status)) {
 132                         result = NT_STATUS_LDAP_CODE(status);
 133                 } else {
 134                         result = LDAP_OPERATIONS_ERROR;
 135                         error_str = talloc_asprintf(reply, "Extended Operation(%s) failed: %s",
 136                                                     req->oid, nt_errstr(status));
 137                 }
 138         }
 139         /* if we haven't found the oid, then status is still NT_STATUS_OK */
 140         if (NT_STATUS_IS_OK(status)) {
 141                 error_str = talloc_asprintf(reply, "Extended Operation(%s) not supported",
 142                                             req->oid);
 143         }
 144
 145         reply->msg->r.ExtendedResponse.response.resultcode = result;
 146         reply->msg->r.ExtendedResponse.response.errormessage = error_str;
 147
 148         ldapsrv_queue_reply(call, reply);
 149         return NT_STATUS_OK;
 150 }