ldb-samba: Explain the current behaviour of ldif_canonicalise_objectCategory
[samba.git] / lib / ldb-samba / ldif_handlers.c
1 /* 
2    ldb database library - ldif handlers for Samba
3
4    Copyright (C) Andrew Tridgell 2005
5    Copyright (C) Andrew Bartlett 2006-2009
6    Copyright (C) Matthias Dieter Wallnöfer 2009
7      ** NOTE! The following LGPL license applies to the ldb
8      ** library. This does NOT imply that all of Samba is released
9      ** under the LGPL
10    
11    This library is free software; you can redistribute it and/or
12    modify it under the terms of the GNU Lesser General Public
13    License as published by the Free Software Foundation; either
14    version 3 of the License, or (at your option) any later version.
15
16    This library is distributed in the hope that it will be useful,
17    but WITHOUT ANY WARRANTY; without even the implied warranty of
18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
19    Lesser General Public License for more details.
20
21    You should have received a copy of the GNU Lesser General Public
22    License along with this library; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include <ldb.h>
27 #include <ldb_module.h>
28 #include "ldb_handlers.h"
29 #include "dsdb/samdb/samdb.h"
30 #include "librpc/gen_ndr/ndr_security.h"
31 #include "librpc/gen_ndr/ndr_misc.h"
32 #include "librpc/gen_ndr/ndr_drsblobs.h"
33 #include "librpc/gen_ndr/ndr_dnsp.h"
34 #include "librpc/ndr/libndr.h"
35 #include "libcli/security/security.h"
36 #include "param/param.h"
37 #include "../lib/util/asn1.h"
38
39 /*
40   use ndr_print_* to convert a NDR formatted blob to a ldif formatted blob
41
42   If mask_errors is true, then function succeeds but out data
43   is set to "<Unable to decode binary data>" message
44
45   \return 0 on success; -1 on error
46 */
47 static int ldif_write_NDR(struct ldb_context *ldb, void *mem_ctx,
48                           const struct ldb_val *in, struct ldb_val *out,
49                           size_t struct_size,
50                           ndr_pull_flags_fn_t pull_fn,
51                           ndr_print_fn_t print_fn,
52                           bool mask_errors)
53 {
54         uint8_t *p;
55         enum ndr_err_code err;
56         if (!(ldb_get_flags(ldb) & LDB_FLG_SHOW_BINARY)) {
57                 return ldb_handler_copy(ldb, mem_ctx, in, out);
58         }
59         p = talloc_size(mem_ctx, struct_size);
60         err = ndr_pull_struct_blob(in, mem_ctx, 
61                                    p, pull_fn);
62         if (err != NDR_ERR_SUCCESS) {
63                 /* fail in not in mask_error mode */
64                 if (!mask_errors) {
65                         return -1;
66                 }
67                 talloc_free(p);
68                 out->data = (uint8_t *)talloc_strdup(mem_ctx, "<Unable to decode binary data>");
69                 out->length = strlen((const char *)out->data);
70                 return 0;
71         }
72         out->data = (uint8_t *)ndr_print_struct_string(mem_ctx, print_fn, "NDR", p);
73         talloc_free(p);
74         if (out->data == NULL) {
75                 return ldb_handler_copy(ldb, mem_ctx, in, out);         
76         }
77         out->length = strlen((char *)out->data);
78         return 0;
79 }
80
81 /*
82   convert a ldif formatted objectSid to a NDR formatted blob
83 */
84 static int ldif_read_objectSid(struct ldb_context *ldb, void *mem_ctx,
85                                const struct ldb_val *in, struct ldb_val *out)
86 {
87         enum ndr_err_code ndr_err;
88         struct dom_sid *sid;
89         sid = dom_sid_parse_length(mem_ctx, in);
90         if (sid == NULL) {
91                 return -1;
92         }
93         ndr_err = ndr_push_struct_blob(out, mem_ctx, sid,
94                                        (ndr_push_flags_fn_t)ndr_push_dom_sid);
95         talloc_free(sid);
96         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
97                 return -1;
98         }
99         return 0;
100 }
101
102 /*
103   convert a NDR formatted blob to a ldif formatted objectSid
104 */
105 int ldif_write_objectSid(struct ldb_context *ldb, void *mem_ctx,
106                                 const struct ldb_val *in, struct ldb_val *out)
107 {
108         struct dom_sid *sid;
109         enum ndr_err_code ndr_err;
110
111         sid = talloc(mem_ctx, struct dom_sid);
112         if (sid == NULL) {
113                 return -1;
114         }
115         ndr_err = ndr_pull_struct_blob_all(in, sid, sid,
116                                            (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
117         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
118                 talloc_free(sid);
119                 return -1;
120         }
121         *out = data_blob_string_const(dom_sid_string(mem_ctx, sid));
122         talloc_free(sid);
123         if (out->data == NULL) {
124                 return -1;
125         }
126         return 0;
127 }
128
129 bool ldif_comparision_objectSid_isString(const struct ldb_val *v)
130 {
131         if (v->length < 3) {
132                 return false;
133         }
134
135         if (strncmp("S-", (const char *)v->data, 2) != 0) return false;
136         
137         return true;
138 }
139
140 /*
141   compare two objectSids
142 */
143 static int ldif_comparison_objectSid(struct ldb_context *ldb, void *mem_ctx,
144                                     const struct ldb_val *v1, const struct ldb_val *v2)
145 {
146         if (ldif_comparision_objectSid_isString(v1) && ldif_comparision_objectSid_isString(v2)) {
147                 return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
148         } else if (ldif_comparision_objectSid_isString(v1)
149                    && !ldif_comparision_objectSid_isString(v2)) {
150                 struct ldb_val v;
151                 int ret;
152                 if (ldif_read_objectSid(ldb, mem_ctx, v1, &v) != 0) {
153                         /* Perhaps not a string after all */
154                         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
155                 }
156                 ret = ldb_comparison_binary(ldb, mem_ctx, &v, v2);
157                 talloc_free(v.data);
158                 return ret;
159         } else if (!ldif_comparision_objectSid_isString(v1)
160                    && ldif_comparision_objectSid_isString(v2)) {
161                 struct ldb_val v;
162                 int ret;
163                 if (ldif_read_objectSid(ldb, mem_ctx, v2, &v) != 0) {
164                         /* Perhaps not a string after all */
165                         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
166                 }
167                 ret = ldb_comparison_binary(ldb, mem_ctx, v1, &v);
168                 talloc_free(v.data);
169                 return ret;
170         }
171         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
172 }
173
174 /*
175   canonicalise a objectSid
176 */
177 static int ldif_canonicalise_objectSid(struct ldb_context *ldb, void *mem_ctx,
178                                       const struct ldb_val *in, struct ldb_val *out)
179 {
180         if (ldif_comparision_objectSid_isString(in)) {
181                 if (ldif_read_objectSid(ldb, mem_ctx, in, out) != 0) {
182                         /* Perhaps not a string after all */
183                         return ldb_handler_copy(ldb, mem_ctx, in, out);
184                 }
185                 return 0;
186         }
187         return ldb_handler_copy(ldb, mem_ctx, in, out);
188 }
189
190 static int extended_dn_read_SID(struct ldb_context *ldb, void *mem_ctx,
191                               const struct ldb_val *in, struct ldb_val *out)
192 {
193         struct dom_sid sid;
194         enum ndr_err_code ndr_err;
195         if (ldif_comparision_objectSid_isString(in)) {
196                 if (ldif_read_objectSid(ldb, mem_ctx, in, out) == 0) {
197                         return 0;
198                 }
199         }
200         
201         /* Perhaps not a string after all */
202         *out = data_blob_talloc(mem_ctx, NULL, in->length/2+1);
203
204         if (!out->data) {
205                 return -1;
206         }
207
208         (*out).length = strhex_to_str((char *)out->data, out->length,
209                                      (const char *)in->data, in->length);
210
211         /* Check it looks like a SID */
212         ndr_err = ndr_pull_struct_blob_all(out, mem_ctx, &sid,
213                                            (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
214         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
215                 return -1;
216         }
217         return 0;
218 }
219
220 /*
221   convert a ldif formatted objectGUID to a NDR formatted blob
222 */
223 static int ldif_read_objectGUID(struct ldb_context *ldb, void *mem_ctx,
224                                 const struct ldb_val *in, struct ldb_val *out)
225 {
226         struct GUID guid;
227         NTSTATUS status;
228
229         status = GUID_from_data_blob(in, &guid);
230         if (!NT_STATUS_IS_OK(status)) {
231                 return -1;
232         }
233
234         status = GUID_to_ndr_blob(&guid, mem_ctx, out);
235         if (!NT_STATUS_IS_OK(status)) {
236                 return -1;
237         }
238         return 0;
239 }
240
241 /*
242   convert a NDR formatted blob to a ldif formatted objectGUID
243 */
244 static int ldif_write_objectGUID(struct ldb_context *ldb, void *mem_ctx,
245                                  const struct ldb_val *in, struct ldb_val *out)
246 {
247         struct GUID guid;
248         NTSTATUS status;
249
250         status = GUID_from_ndr_blob(in, &guid);
251         if (!NT_STATUS_IS_OK(status)) {
252                 return -1;
253         }
254         out->data = (uint8_t *)GUID_string(mem_ctx, &guid);
255         if (out->data == NULL) {
256                 return -1;
257         }
258         out->length = strlen((const char *)out->data);
259         return 0;
260 }
261
262 static bool ldif_comparision_objectGUID_isString(const struct ldb_val *v)
263 {
264         if (v->length != 36 && v->length != 38) return false;
265
266         /* Might be a GUID string, can't be a binary GUID (fixed 16 bytes) */
267         return true;
268 }
269
270 static int extended_dn_read_GUID(struct ldb_context *ldb, void *mem_ctx,
271                               const struct ldb_val *in, struct ldb_val *out)
272 {
273         struct GUID guid;
274         NTSTATUS status;
275
276         if (in->length == 36 && ldif_read_objectGUID(ldb, mem_ctx, in, out) == 0) {
277                 return 0;
278         }
279
280         /* Try as 'hex' form */
281         if (in->length != 32) {
282                 return -1;
283         }
284                 
285         *out = data_blob_talloc(mem_ctx, NULL, in->length/2+1);
286         
287         if (!out->data) {
288                 return -1;
289         }
290         
291         (*out).length = strhex_to_str((char *)out->data, out->length,
292                                       (const char *)in->data, in->length);
293         
294         /* Check it looks like a GUID */
295         status = GUID_from_ndr_blob(out, &guid);
296         if (!NT_STATUS_IS_OK(status)) {
297                 data_blob_free(out);
298                 return -1;
299         }
300         return 0;
301 }
302
303 /*
304   compare two objectGUIDs
305 */
306 static int ldif_comparison_objectGUID(struct ldb_context *ldb, void *mem_ctx,
307                                      const struct ldb_val *v1, const struct ldb_val *v2)
308 {
309         if (ldif_comparision_objectGUID_isString(v1) && ldif_comparision_objectGUID_isString(v2)) {
310                 return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
311         } else if (ldif_comparision_objectGUID_isString(v1)
312                    && !ldif_comparision_objectGUID_isString(v2)) {
313                 struct ldb_val v;
314                 int ret;
315                 if (ldif_read_objectGUID(ldb, mem_ctx, v1, &v) != 0) {
316                         /* Perhaps it wasn't a valid string after all */
317                         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
318                 }
319                 ret = ldb_comparison_binary(ldb, mem_ctx, &v, v2);
320                 talloc_free(v.data);
321                 return ret;
322         } else if (!ldif_comparision_objectGUID_isString(v1)
323                    && ldif_comparision_objectGUID_isString(v2)) {
324                 struct ldb_val v;
325                 int ret;
326                 if (ldif_read_objectGUID(ldb, mem_ctx, v2, &v) != 0) {
327                         /* Perhaps it wasn't a valid string after all */
328                         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
329                 }
330                 ret = ldb_comparison_binary(ldb, mem_ctx, v1, &v);
331                 talloc_free(v.data);
332                 return ret;
333         }
334         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
335 }
336
337 /*
338   canonicalise a objectGUID
339 */
340 static int ldif_canonicalise_objectGUID(struct ldb_context *ldb, void *mem_ctx,
341                                        const struct ldb_val *in, struct ldb_val *out)
342 {
343         if (ldif_comparision_objectGUID_isString(in)) {
344                 if (ldif_read_objectGUID(ldb, mem_ctx, in, out) != 0) {
345                         /* Perhaps it wasn't a valid string after all */
346                         return ldb_handler_copy(ldb, mem_ctx, in, out);
347                 }
348                 return 0;
349         }
350         return ldb_handler_copy(ldb, mem_ctx, in, out);
351 }
352
353
354 /*
355   convert a ldif (SDDL) formatted ntSecurityDescriptor to a NDR formatted blob
356 */
357 static int ldif_read_ntSecurityDescriptor(struct ldb_context *ldb, void *mem_ctx,
358                                           const struct ldb_val *in, struct ldb_val *out)
359 {
360         struct security_descriptor *sd;
361         enum ndr_err_code ndr_err;
362
363         sd = talloc(mem_ctx, struct security_descriptor);
364         if (sd == NULL) {
365                 return -1;
366         }
367
368         ndr_err = ndr_pull_struct_blob(in, sd, sd,
369                                        (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
370         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
371                 /* If this does not parse, then it is probably SDDL, and we should try it that way */
372
373                 const struct dom_sid *sid = samdb_domain_sid(ldb);
374                 talloc_free(sd);
375                 sd = sddl_decode(mem_ctx, (const char *)in->data, sid);
376                 if (sd == NULL) {
377                         return -1;
378                 }
379         }
380
381         ndr_err = ndr_push_struct_blob(out, mem_ctx, sd,
382                                        (ndr_push_flags_fn_t)ndr_push_security_descriptor);
383         talloc_free(sd);
384         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
385                 return -1;
386         }
387
388         return 0;
389 }
390
391 /*
392   convert a NDR formatted blob to a ldif formatted ntSecurityDescriptor (SDDL format)
393 */
394 static int ldif_write_ntSecurityDescriptor(struct ldb_context *ldb, void *mem_ctx,
395                                            const struct ldb_val *in, struct ldb_val *out)
396 {
397         struct security_descriptor *sd;
398         enum ndr_err_code ndr_err;
399
400         if (ldb_get_flags(ldb) & LDB_FLG_SHOW_BINARY) {
401                 return ldif_write_NDR(ldb, mem_ctx, in, out, 
402                                       sizeof(struct security_descriptor),
403                                       (ndr_pull_flags_fn_t)ndr_pull_security_descriptor,
404                                       (ndr_print_fn_t)ndr_print_security_descriptor,
405                                       true);
406                                       
407         }
408
409         sd = talloc(mem_ctx, struct security_descriptor);
410         if (sd == NULL) {
411                 return -1;
412         }
413         /* We can't use ndr_pull_struct_blob_all because this contains relative pointers */
414         ndr_err = ndr_pull_struct_blob(in, sd, sd,
415                                            (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
416         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
417                 talloc_free(sd);
418                 return -1;
419         }
420         out->data = (uint8_t *)sddl_encode(mem_ctx, sd, samdb_domain_sid_cache_only(ldb));
421         talloc_free(sd);
422         if (out->data == NULL) {
423                 return -1;
424         }
425         out->length = strlen((const char *)out->data);
426         return 0;
427 }
428
429 /*
430   convert a string formatted SDDL to a ldif formatted ntSecurityDescriptor (SDDL format)
431 */
432 static int ldif_write_sddlSecurityDescriptor(struct ldb_context *ldb, void *mem_ctx,
433                                            const struct ldb_val *in, struct ldb_val *out)
434 {
435         if (ldb_get_flags(ldb) & LDB_FLG_SHOW_BINARY) {
436                 struct security_descriptor *sd;
437                 const struct dom_sid *sid = samdb_domain_sid(ldb);
438
439                 sd = sddl_decode(mem_ctx, (const char *)in->data, sid);
440                 out->data = (uint8_t *)ndr_print_struct_string(mem_ctx,
441                                         (ndr_print_fn_t)ndr_print_security_descriptor,
442                                         "SDDL", sd);
443                 out->length = strlen((const char *)out->data);
444                 talloc_free(sd);
445                 return 0;
446         }
447
448         return ldb_handler_copy(ldb, mem_ctx, in, out);
449 }
450
451 /* 
452    canonicalise an objectCategory.  We use the long form as the canonical form:
453    'person' becomes cn=Person,cn=Schema,cn=Configuration,<basedn>
454
455    Also any short name of an objectClass that points to a different
456    class (such as user) has the canonical form of the class it's
457    defaultObjectCategory points to (eg
458    cn=Person,cn=Schema,cn=Configuration,<basedn>)
459 */
460
461 static int ldif_canonicalise_objectCategory(struct ldb_context *ldb, void *mem_ctx,
462                                             const struct ldb_val *in, struct ldb_val *out)
463 {
464         struct ldb_dn *dn1 = NULL;
465         const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
466         const struct dsdb_class *sclass;
467         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
468         if (!tmp_ctx) {
469                 return LDB_ERR_OPERATIONS_ERROR;
470         }
471
472         if (!schema) {
473                 talloc_free(tmp_ctx);
474                 *out = data_blob_talloc(mem_ctx, in->data, in->length);
475                 if (in->data && !out->data) {
476                         return LDB_ERR_OPERATIONS_ERROR;
477                 }
478                 return LDB_SUCCESS;
479         }
480         dn1 = ldb_dn_from_ldb_val(tmp_ctx, ldb, in);
481         if ( ! ldb_dn_validate(dn1)) {
482                 const char *lDAPDisplayName = talloc_strndup(tmp_ctx, (char *)in->data, in->length);
483                 sclass = dsdb_class_by_lDAPDisplayName(schema, lDAPDisplayName);
484                 if (sclass) {
485                         struct ldb_dn *dn = ldb_dn_new(mem_ctx, ldb,  
486                                                        sclass->defaultObjectCategory);
487                         *out = data_blob_string_const(ldb_dn_alloc_casefold(mem_ctx, dn));
488                         talloc_free(tmp_ctx);
489
490                         if (!out->data) {
491                                 return LDB_ERR_OPERATIONS_ERROR;
492                         }
493                         return LDB_SUCCESS;
494                 } else {
495                         *out = data_blob_talloc(mem_ctx, in->data, in->length);
496                         talloc_free(tmp_ctx);
497
498                         if (in->data && !out->data) {
499                                 return LDB_ERR_OPERATIONS_ERROR;
500                         }
501                         return LDB_SUCCESS;
502                 }
503         }
504         *out = data_blob_string_const(ldb_dn_alloc_casefold(mem_ctx, dn1));
505         talloc_free(tmp_ctx);
506
507         if (!out->data) {
508                 return LDB_ERR_OPERATIONS_ERROR;
509         }
510         return LDB_SUCCESS;
511 }
512
513 static int ldif_comparison_objectCategory(struct ldb_context *ldb, void *mem_ctx,
514                                           const struct ldb_val *v1,
515                                           const struct ldb_val *v2)
516 {
517         return ldb_any_comparison(ldb, mem_ctx, ldif_canonicalise_objectCategory,
518                                   v1, v2);
519 }
520
521 /*
522   convert a NDR formatted blob to a ldif formatted schemaInfo
523 */
524 static int ldif_write_schemaInfo(struct ldb_context *ldb, void *mem_ctx,
525                                  const struct ldb_val *in, struct ldb_val *out)
526 {
527         return ldif_write_NDR(ldb, mem_ctx, in, out,
528                               sizeof(struct repsFromToBlob),
529                               (ndr_pull_flags_fn_t)ndr_pull_schemaInfoBlob,
530                               (ndr_print_fn_t)ndr_print_schemaInfoBlob,
531                               true);
532 }
533
534 /*
535   convert a ldif formatted prefixMap to a NDR formatted blob
536 */
537 static int ldif_read_prefixMap(struct ldb_context *ldb, void *mem_ctx,
538                                const struct ldb_val *in, struct ldb_val *out)
539 {
540         struct prefixMapBlob *blob;
541         enum ndr_err_code ndr_err;
542         char *string, *line, *p, *oid;
543         DATA_BLOB oid_blob;
544
545         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
546
547         if (tmp_ctx == NULL) {
548                 return -1;
549         }
550
551         blob = talloc_zero(tmp_ctx, struct prefixMapBlob);
552         if (blob == NULL) {
553                 talloc_free(tmp_ctx);
554                 return -1;
555         }
556
557         /* use the switch value to detect if this is in the binary
558          * format
559          */
560         if (in->length >= 4 && IVAL(in->data, 0) == PREFIX_MAP_VERSION_DSDB) {
561                 ndr_err = ndr_pull_struct_blob(in, tmp_ctx, blob,
562                                                (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob);
563                 if (NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
564                         ndr_err = ndr_push_struct_blob(out, mem_ctx,
565                                                        blob,
566                                                        (ndr_push_flags_fn_t)ndr_push_prefixMapBlob);
567                         talloc_free(tmp_ctx);
568                         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
569                                 return -1;
570                         }
571                         return 0;
572                 }
573         }
574
575         /* If this does not parse, then it is probably the text version, and we should try it that way */
576         blob->version = PREFIX_MAP_VERSION_DSDB;
577         
578         string = talloc_strndup(mem_ctx, (const char *)in->data, in->length);
579         if (string == NULL) {
580                 talloc_free(blob);
581                 return -1;
582         }
583
584         line = string;
585         while (line && line[0]) {
586                 p=strchr(line, ';');
587                 if (p) {
588                         p[0] = '\0';
589                 } else {
590                         p=strchr(line, '\n');
591                         if (p) {
592                                 p[0] = '\0';
593                         }
594                 }
595                 /* allow a trailing separator */
596                 if (line == p) {
597                         break;
598                 }
599                 
600                 blob->ctr.dsdb.mappings = talloc_realloc(blob, 
601                                                          blob->ctr.dsdb.mappings, 
602                                                          struct drsuapi_DsReplicaOIDMapping,
603                                                          blob->ctr.dsdb.num_mappings+1);
604                 if (!blob->ctr.dsdb.mappings) {
605                         talloc_free(tmp_ctx);
606                         return -1;
607                 }
608
609                 blob->ctr.dsdb.mappings[blob->ctr.dsdb.num_mappings].id_prefix = strtoul(line, &oid, 10);
610
611                 if (oid[0] != ':') {
612                         talloc_free(tmp_ctx);
613                         return -1;
614                 }
615
616                 /* we know there must be at least ":" */
617                 oid++;
618
619                 if (!ber_write_partial_OID_String(blob->ctr.dsdb.mappings, &oid_blob, oid)) {
620                         talloc_free(tmp_ctx);
621                         return -1;
622                 }
623                 blob->ctr.dsdb.mappings[blob->ctr.dsdb.num_mappings].oid.length = oid_blob.length;
624                 blob->ctr.dsdb.mappings[blob->ctr.dsdb.num_mappings].oid.binary_oid = oid_blob.data;
625
626                 blob->ctr.dsdb.num_mappings++;
627
628                 /* Now look past the terminator we added above */
629                 if (p) {
630                         line = p + 1;
631                 } else {
632                         line = NULL;
633                 }
634         }
635
636         ndr_err = ndr_push_struct_blob(out, mem_ctx, 
637                                        blob,
638                                        (ndr_push_flags_fn_t)ndr_push_prefixMapBlob);
639         talloc_free(tmp_ctx);
640         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
641                 return -1;
642         }
643         return 0;
644 }
645
646 /*
647   convert a NDR formatted blob to a ldif formatted prefixMap
648 */
649 static int ldif_write_prefixMap(struct ldb_context *ldb, void *mem_ctx,
650                                 const struct ldb_val *in, struct ldb_val *out)
651 {
652         struct prefixMapBlob *blob;
653         enum ndr_err_code ndr_err;
654         char *string;
655         uint32_t i;
656
657         if (ldb_get_flags(ldb) & LDB_FLG_SHOW_BINARY) {
658                 int err;
659                 /* try to decode the blob as S4 prefixMap */
660                 err = ldif_write_NDR(ldb, mem_ctx, in, out,
661                                      sizeof(struct prefixMapBlob),
662                                      (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob,
663                                      (ndr_print_fn_t)ndr_print_prefixMapBlob,
664                                      false);
665                 if (0 == err) {
666                         return err;
667                 }
668                 /* try parsing it as Windows PrefixMap value */
669                 return ldif_write_NDR(ldb, mem_ctx, in, out,
670                                       sizeof(struct drsuapi_MSPrefixMap_Ctr),
671                                       (ndr_pull_flags_fn_t)ndr_pull_drsuapi_MSPrefixMap_Ctr,
672                                       (ndr_print_fn_t)ndr_print_drsuapi_MSPrefixMap_Ctr,
673                                       true);
674         }
675
676         blob = talloc(mem_ctx, struct prefixMapBlob);
677         if (blob == NULL) {
678                 return -1;
679         }
680         ndr_err = ndr_pull_struct_blob_all(in, blob, 
681                                            blob,
682                                            (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob);
683         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
684                 goto failed;
685         }
686         if (blob->version != PREFIX_MAP_VERSION_DSDB) {
687                 goto failed;
688         }
689         string = talloc_strdup(mem_ctx, "");
690         if (string == NULL) {
691                 goto failed;
692         }
693
694         for (i=0; i < blob->ctr.dsdb.num_mappings; i++) {
695                 DATA_BLOB oid_blob;
696                 char *partial_oid = NULL;
697
698                 if (i > 0) {
699                         string = talloc_asprintf_append(string, ";"); 
700                 }
701
702                 oid_blob = data_blob_const(blob->ctr.dsdb.mappings[i].oid.binary_oid,
703                                            blob->ctr.dsdb.mappings[i].oid.length);
704                 if (!ber_read_partial_OID_String(blob, oid_blob, &partial_oid)) {
705                         DEBUG(0, ("ber_read_partial_OID failed on prefixMap item with id: 0x%X",
706                                   blob->ctr.dsdb.mappings[i].id_prefix));
707                         goto failed;
708                 }
709                 string = talloc_asprintf_append(string, "%u:%s", 
710                                                    blob->ctr.dsdb.mappings[i].id_prefix,
711                                                    partial_oid);
712                 talloc_free(discard_const(partial_oid));
713                 if (string == NULL) {
714                         goto failed;
715                 }
716         }
717
718         talloc_free(blob);
719         *out = data_blob_string_const(string);
720         return 0;
721
722 failed:
723         talloc_free(blob);
724         return -1;
725 }
726
727 static bool ldif_comparision_prefixMap_isString(const struct ldb_val *v)
728 {
729         if (v->length < 4) {
730                 return true;
731         }
732
733         if (IVAL(v->data, 0) == PREFIX_MAP_VERSION_DSDB) {
734                 return false;
735         }
736         
737         return true;
738 }
739
740 /*
741   canonicalise a prefixMap
742 */
743 static int ldif_canonicalise_prefixMap(struct ldb_context *ldb, void *mem_ctx,
744                                        const struct ldb_val *in, struct ldb_val *out)
745 {
746         if (ldif_comparision_prefixMap_isString(in)) {
747                 return ldif_read_prefixMap(ldb, mem_ctx, in, out);
748         }
749         return ldb_handler_copy(ldb, mem_ctx, in, out);
750 }
751
752 static int ldif_comparison_prefixMap(struct ldb_context *ldb, void *mem_ctx,
753                                      const struct ldb_val *v1,
754                                      const struct ldb_val *v2)
755 {
756         return ldb_any_comparison(ldb, mem_ctx, ldif_canonicalise_prefixMap,
757                                   v1, v2);
758 }
759
760 /* length limited conversion of a ldb_val to a int32_t */
761 static int val_to_int32(const struct ldb_val *in, int32_t *v)
762 {
763         char *end;
764         char buf[64];
765
766         /* make sure we don't read past the end of the data */
767         if (in->length > sizeof(buf)-1) {
768                 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
769         }
770         strncpy(buf, (char *)in->data, in->length);
771         buf[in->length] = 0;
772
773         /* We've to use "strtoll" here to have the intended overflows.
774          * Otherwise we may get "LONG_MAX" and the conversion is wrong. */
775         *v = (int32_t) strtoll(buf, &end, 0);
776         if (*end != 0) {
777                 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
778         }
779         return LDB_SUCCESS;
780 }
781
782 /* length limited conversion of a ldb_val to a int64_t */
783 static int val_to_int64(const struct ldb_val *in, int64_t *v)
784 {
785         char *end;
786         char buf[64];
787
788         /* make sure we don't read past the end of the data */
789         if (in->length > sizeof(buf)-1) {
790                 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
791         }
792         strncpy(buf, (char *)in->data, in->length);
793         buf[in->length] = 0;
794
795         *v = (int64_t) strtoll(buf, &end, 0);
796         if (*end != 0) {
797                 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
798         }
799         return LDB_SUCCESS;
800 }
801
802 /* Canonicalisation of two 32-bit integers */
803 static int ldif_canonicalise_int32(struct ldb_context *ldb, void *mem_ctx,
804                         const struct ldb_val *in, struct ldb_val *out)
805 {
806         int32_t i;
807         int ret;
808
809         ret = val_to_int32(in, &i);
810         if (ret != LDB_SUCCESS) {
811                 return ret;
812         }
813         out->data = (uint8_t *) talloc_asprintf(mem_ctx, "%d", i);
814         if (out->data == NULL) {
815                 ldb_oom(ldb);
816                 return LDB_ERR_OPERATIONS_ERROR;
817         }
818         out->length = strlen((char *)out->data);
819         return 0;
820 }
821
822 /* Comparison of two 32-bit integers */
823 static int ldif_comparison_int32(struct ldb_context *ldb, void *mem_ctx,
824                                  const struct ldb_val *v1, const struct ldb_val *v2)
825 {
826         int32_t i1=0, i2=0;
827         val_to_int32(v1, &i1);
828         val_to_int32(v2, &i2);
829         if (i1 == i2) return 0;
830         return i1 > i2? 1 : -1;
831 }
832
833 /* Canonicalisation of two 64-bit integers */
834 static int ldif_canonicalise_int64(struct ldb_context *ldb, void *mem_ctx,
835                                    const struct ldb_val *in, struct ldb_val *out)
836 {
837         int64_t i;
838         int ret;
839
840         ret = val_to_int64(in, &i);
841         if (ret != LDB_SUCCESS) {
842                 return ret;
843         }
844         out->data = (uint8_t *) talloc_asprintf(mem_ctx, "%lld", (long long)i);
845         if (out->data == NULL) {
846                 ldb_oom(ldb);
847                 return LDB_ERR_OPERATIONS_ERROR;
848         }
849         out->length = strlen((char *)out->data);
850         return 0;
851 }
852
853 /* Comparison of two 64-bit integers */
854 static int ldif_comparison_int64(struct ldb_context *ldb, void *mem_ctx,
855                                  const struct ldb_val *v1, const struct ldb_val *v2)
856 {
857         int64_t i1=0, i2=0;
858         val_to_int64(v1, &i1);
859         val_to_int64(v2, &i2);
860         if (i1 == i2) return 0;
861         return i1 > i2? 1 : -1;
862 }
863
864 /*
865   convert a NDR formatted blob to a ldif formatted repsFromTo
866 */
867 static int ldif_write_repsFromTo(struct ldb_context *ldb, void *mem_ctx,
868                                  const struct ldb_val *in, struct ldb_val *out)
869 {
870         return ldif_write_NDR(ldb, mem_ctx, in, out, 
871                               sizeof(struct repsFromToBlob),
872                               (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob,
873                               (ndr_print_fn_t)ndr_print_repsFromToBlob,
874                               true);
875 }
876
877 /*
878   convert a NDR formatted blob to a ldif formatted replPropertyMetaData
879 */
880 static int ldif_write_replPropertyMetaData(struct ldb_context *ldb, void *mem_ctx,
881                                            const struct ldb_val *in, struct ldb_val *out)
882 {
883         return ldif_write_NDR(ldb, mem_ctx, in, out, 
884                               sizeof(struct replPropertyMetaDataBlob),
885                               (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob,
886                               (ndr_print_fn_t)ndr_print_replPropertyMetaDataBlob,
887                               true);
888 }
889
890 /*
891   convert a NDR formatted blob to a ldif formatted replUpToDateVector
892 */
893 static int ldif_write_replUpToDateVector(struct ldb_context *ldb, void *mem_ctx,
894                                          const struct ldb_val *in, struct ldb_val *out)
895 {
896         return ldif_write_NDR(ldb, mem_ctx, in, out, 
897                               sizeof(struct replUpToDateVectorBlob),
898                               (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob,
899                               (ndr_print_fn_t)ndr_print_replUpToDateVectorBlob,
900                               true);
901 }
902
903
904 /*
905   convert a NDR formatted blob to a ldif formatted dnsRecord
906 */
907 static int ldif_write_dnsRecord(struct ldb_context *ldb, void *mem_ctx,
908                                 const struct ldb_val *in, struct ldb_val *out)
909 {
910         return ldif_write_NDR(ldb, mem_ctx, in, out,
911                               sizeof(struct dnsp_DnssrvRpcRecord),
912                               (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord,
913                               (ndr_print_fn_t)ndr_print_dnsp_DnssrvRpcRecord,
914                               true);
915 }
916
917 /*
918   convert a NDR formatted blob of a supplementalCredentials into text
919 */
920 static int ldif_write_supplementalCredentialsBlob(struct ldb_context *ldb, void *mem_ctx,
921                                                   const struct ldb_val *in, struct ldb_val *out)
922 {
923         return ldif_write_NDR(ldb, mem_ctx, in, out,
924                               sizeof(struct supplementalCredentialsBlob),
925                               (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob,
926                               (ndr_print_fn_t)ndr_print_supplementalCredentialsBlob,
927                               true);
928 }
929
930
931 static int extended_dn_write_hex(struct ldb_context *ldb, void *mem_ctx,
932                                  const struct ldb_val *in, struct ldb_val *out)
933 {
934         *out = data_blob_string_const(data_blob_hex_string_lower(mem_ctx, in));
935         if (!out->data) {
936                 return -1;
937         }
938         return 0;
939 }
940
941 /*
942   compare two dns
943 */
944 static int samba_ldb_dn_link_comparison(struct ldb_context *ldb, void *mem_ctx,
945                                         const struct ldb_val *v1, const struct ldb_val *v2)
946 {
947         struct ldb_dn *dn1 = NULL, *dn2 = NULL;
948         int ret;
949
950         if (dsdb_dn_is_deleted_val(v1)) {
951                 /* If the DN is deleted, then we can't search for it */
952                 return -1;
953         }
954
955         if (dsdb_dn_is_deleted_val(v2)) {
956                 /* If the DN is deleted, then we can't search for it */
957                 return -1;
958         }
959
960         dn1 = ldb_dn_from_ldb_val(mem_ctx, ldb, v1);
961         if ( ! ldb_dn_validate(dn1)) return -1;
962
963         dn2 = ldb_dn_from_ldb_val(mem_ctx, ldb, v2);
964         if ( ! ldb_dn_validate(dn2)) {
965                 talloc_free(dn1);
966                 return -1;
967         }
968
969         ret = ldb_dn_compare(dn1, dn2);
970
971         talloc_free(dn1);
972         talloc_free(dn2);
973         return ret;
974 }
975
976 static int samba_ldb_dn_link_canonicalise(struct ldb_context *ldb, void *mem_ctx,
977                                           const struct ldb_val *in, struct ldb_val *out)
978 {
979         struct ldb_dn *dn;
980         int ret = -1;
981
982         out->length = 0;
983         out->data = NULL;
984
985         dn = ldb_dn_from_ldb_val(mem_ctx, ldb, in);
986         if ( ! ldb_dn_validate(dn)) {
987                 return LDB_ERR_INVALID_DN_SYNTAX;
988         }
989
990         /* By including the RMD_FLAGS of a deleted DN, we ensure it
991          * does not casually match a not deleted DN */
992         if (dsdb_dn_is_deleted_val(in)) {
993                 out->data = (uint8_t *)talloc_asprintf(mem_ctx,
994                                                        "<RMD_FLAGS=%u>%s",
995                                                        dsdb_dn_val_rmd_flags(in),
996                                                        ldb_dn_get_casefold(dn));
997         } else {
998                 out->data = (uint8_t *)ldb_dn_alloc_casefold(mem_ctx, dn);
999         }
1000
1001         if (out->data == NULL) {
1002                 goto done;
1003         }
1004         out->length = strlen((char *)out->data);
1005
1006         ret = 0;
1007
1008 done:
1009         talloc_free(dn);
1010
1011         return ret;
1012 }
1013
1014
1015 /*
1016   write a 64 bit 2-part range
1017 */
1018 static int ldif_write_range64(struct ldb_context *ldb, void *mem_ctx,
1019                               const struct ldb_val *in, struct ldb_val *out)
1020 {
1021         int64_t v;
1022         int ret;
1023         ret = val_to_int64(in, &v);
1024         if (ret != LDB_SUCCESS) {
1025                 return ret;
1026         }
1027         out->data = (uint8_t *)talloc_asprintf(mem_ctx, "%lu-%lu",
1028                                                (unsigned long)(v&0xFFFFFFFF),
1029                                                (unsigned long)(v>>32));
1030         if (out->data == NULL) {
1031                 ldb_oom(ldb);
1032                 return LDB_ERR_OPERATIONS_ERROR;
1033         }
1034         out->length = strlen((char *)out->data);
1035         return LDB_SUCCESS;
1036 }
1037
1038 /*
1039   read a 64 bit 2-part range
1040 */
1041 static int ldif_read_range64(struct ldb_context *ldb, void *mem_ctx,
1042                               const struct ldb_val *in, struct ldb_val *out)
1043 {
1044         unsigned long high, low;
1045         char buf[64];
1046
1047         if (memchr(in->data, '-', in->length) == NULL) {
1048                 return ldb_handler_copy(ldb, mem_ctx, in, out);
1049         }
1050
1051         if (in->length > sizeof(buf)-1) {
1052                 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
1053         }
1054         strncpy(buf, (const char *)in->data, in->length);
1055         buf[in->length] = 0;
1056
1057         if (sscanf(buf, "%lu-%lu", &low, &high) != 2) {
1058                 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
1059         }
1060
1061         out->data = (uint8_t *)talloc_asprintf(mem_ctx, "%llu",
1062                                                (unsigned long long)(((uint64_t)high)<<32) | (low));
1063
1064         if (out->data == NULL) {
1065                 ldb_oom(ldb);
1066                 return LDB_ERR_OPERATIONS_ERROR;
1067         }
1068         out->length = strlen((char *)out->data);
1069         return LDB_SUCCESS;
1070 }
1071
1072 /*
1073   when this operator_fn is set for a syntax, the backend calls is in
1074   preference to the comparison function. We are told the exact
1075   comparison operation that is needed, and we can return errors
1076  */
1077 static int samba_syntax_operator_fn(struct ldb_context *ldb, enum ldb_parse_op operation,
1078                                     const struct ldb_schema_attribute *a,
1079                                     const struct ldb_val *v1, const struct ldb_val *v2, bool *matched)
1080 {
1081         switch (operation) {
1082         case LDB_OP_AND:
1083         case LDB_OP_OR:
1084         case LDB_OP_NOT:
1085         case LDB_OP_SUBSTRING:
1086         case LDB_OP_APPROX:
1087         case LDB_OP_EXTENDED:
1088                 /* handled in the backends */
1089                 return LDB_ERR_INAPPROPRIATE_MATCHING;
1090
1091         case LDB_OP_GREATER:
1092         case LDB_OP_LESS:
1093         case LDB_OP_EQUALITY:
1094         {
1095                 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
1096                 int ret;
1097                 if (tmp_ctx == NULL) {
1098                         return ldb_oom(ldb);
1099                 }
1100                 ret = a->syntax->comparison_fn(ldb, tmp_ctx, v1, v2);
1101                 talloc_free(tmp_ctx);
1102                 if (operation == LDB_OP_GREATER) {
1103                         *matched = (ret > 0);
1104                 } else if (operation == LDB_OP_LESS) {
1105                         *matched = (ret < 0);
1106                 } else {
1107                         *matched = (ret == 0);
1108                 }
1109                 return LDB_SUCCESS;
1110         }
1111
1112         case LDB_OP_PRESENT:
1113                 *matched = true;
1114                 return LDB_SUCCESS;
1115         }
1116
1117         /* we shouldn't get here */
1118         return LDB_ERR_INAPPROPRIATE_MATCHING;
1119 }
1120
1121 /*
1122   special operation for DNs, to take account of the RMD_FLAGS deleted bit
1123  */
1124 static int samba_syntax_operator_dn(struct ldb_context *ldb, enum ldb_parse_op operation,
1125                                     const struct ldb_schema_attribute *a,
1126                                     const struct ldb_val *v1, const struct ldb_val *v2, bool *matched)
1127 {
1128         if (operation == LDB_OP_PRESENT && dsdb_dn_is_deleted_val(v1)) {
1129                 /* If the DN is deleted, then we can't search for it */
1130                 *matched = false;
1131                 return LDB_SUCCESS;
1132         }
1133         return samba_syntax_operator_fn(ldb, operation, a, v1, v2, matched);
1134 }
1135
1136
1137 static const struct ldb_schema_syntax samba_syntaxes[] = {
1138         {
1139                 .name             = LDB_SYNTAX_SAMBA_SID,
1140                 .ldif_read_fn     = ldif_read_objectSid,
1141                 .ldif_write_fn    = ldif_write_objectSid,
1142                 .canonicalise_fn  = ldif_canonicalise_objectSid,
1143                 .comparison_fn    = ldif_comparison_objectSid,
1144                 .operator_fn      = samba_syntax_operator_fn
1145         },{
1146                 .name             = LDB_SYNTAX_SAMBA_SECURITY_DESCRIPTOR,
1147                 .ldif_read_fn     = ldif_read_ntSecurityDescriptor,
1148                 .ldif_write_fn    = ldif_write_ntSecurityDescriptor,
1149                 .canonicalise_fn  = ldb_handler_copy,
1150                 .comparison_fn    = ldb_comparison_binary,
1151                 .operator_fn      = samba_syntax_operator_fn
1152         },{
1153                 .name             = LDB_SYNTAX_SAMBA_SDDL_SECURITY_DESCRIPTOR,
1154                 .ldif_read_fn     = ldb_handler_copy,
1155                 .ldif_write_fn    = ldif_write_sddlSecurityDescriptor,
1156                 .canonicalise_fn  = ldb_handler_fold,
1157                 .comparison_fn    = ldb_comparison_fold,
1158                 .operator_fn      = samba_syntax_operator_fn
1159         },{
1160                 .name             = LDB_SYNTAX_SAMBA_GUID,
1161                 .ldif_read_fn     = ldif_read_objectGUID,
1162                 .ldif_write_fn    = ldif_write_objectGUID,
1163                 .canonicalise_fn  = ldif_canonicalise_objectGUID,
1164                 .comparison_fn    = ldif_comparison_objectGUID,
1165                 .operator_fn      = samba_syntax_operator_fn
1166         },{
1167                 .name             = LDB_SYNTAX_SAMBA_OBJECT_CATEGORY,
1168                 .ldif_read_fn     = ldb_handler_copy,
1169                 .ldif_write_fn    = ldb_handler_copy,
1170                 .canonicalise_fn  = ldif_canonicalise_objectCategory,
1171                 .comparison_fn    = ldif_comparison_objectCategory,
1172                 .operator_fn      = samba_syntax_operator_fn
1173         },{
1174                 .name             = LDB_SYNTAX_SAMBA_SCHEMAINFO,
1175                 .ldif_read_fn     = ldb_handler_copy,
1176                 .ldif_write_fn    = ldif_write_schemaInfo,
1177                 .canonicalise_fn  = ldb_handler_copy,
1178                 .comparison_fn    = ldb_comparison_binary,
1179                 .operator_fn      = samba_syntax_operator_fn
1180         },{
1181                 .name             = LDB_SYNTAX_SAMBA_PREFIX_MAP,
1182                 .ldif_read_fn     = ldif_read_prefixMap,
1183                 .ldif_write_fn    = ldif_write_prefixMap,
1184                 .canonicalise_fn  = ldif_canonicalise_prefixMap,
1185                 .comparison_fn    = ldif_comparison_prefixMap,
1186                 .operator_fn      = samba_syntax_operator_fn
1187         },{
1188                 .name             = LDB_SYNTAX_SAMBA_INT32,
1189                 .ldif_read_fn     = ldb_handler_copy,
1190                 .ldif_write_fn    = ldb_handler_copy,
1191                 .canonicalise_fn  = ldif_canonicalise_int32,
1192                 .comparison_fn    = ldif_comparison_int32,
1193                 .operator_fn      = samba_syntax_operator_fn
1194         },{
1195                 .name             = LDB_SYNTAX_SAMBA_REPSFROMTO,
1196                 .ldif_read_fn     = ldb_handler_copy,
1197                 .ldif_write_fn    = ldif_write_repsFromTo,
1198                 .canonicalise_fn  = ldb_handler_copy,
1199                 .comparison_fn    = ldb_comparison_binary,
1200                 .operator_fn      = samba_syntax_operator_fn
1201         },{
1202                 .name             = LDB_SYNTAX_SAMBA_REPLPROPERTYMETADATA,
1203                 .ldif_read_fn     = ldb_handler_copy,
1204                 .ldif_write_fn    = ldif_write_replPropertyMetaData,
1205                 .canonicalise_fn  = ldb_handler_copy,
1206                 .comparison_fn    = ldb_comparison_binary,
1207                 .operator_fn      = samba_syntax_operator_fn
1208         },{
1209                 .name             = LDB_SYNTAX_SAMBA_REPLUPTODATEVECTOR,
1210                 .ldif_read_fn     = ldb_handler_copy,
1211                 .ldif_write_fn    = ldif_write_replUpToDateVector,
1212                 .canonicalise_fn  = ldb_handler_copy,
1213                 .comparison_fn    = ldb_comparison_binary,
1214                 .operator_fn      = samba_syntax_operator_fn
1215         },{
1216                 .name             = DSDB_SYNTAX_BINARY_DN,
1217                 .ldif_read_fn     = ldb_handler_copy,
1218                 .ldif_write_fn    = ldb_handler_copy,
1219                 .canonicalise_fn  = dsdb_dn_binary_canonicalise,
1220                 .comparison_fn    = dsdb_dn_binary_comparison,
1221                 .operator_fn      = samba_syntax_operator_fn
1222         },{
1223                 .name             = DSDB_SYNTAX_STRING_DN,
1224                 .ldif_read_fn     = ldb_handler_copy,
1225                 .ldif_write_fn    = ldb_handler_copy,
1226                 .canonicalise_fn  = dsdb_dn_string_canonicalise,
1227                 .comparison_fn    = dsdb_dn_string_comparison,
1228                 .operator_fn      = samba_syntax_operator_fn
1229         },{
1230                 .name             = LDB_SYNTAX_DN,
1231                 .ldif_read_fn     = ldb_handler_copy,
1232                 .ldif_write_fn    = ldb_handler_copy,
1233                 .canonicalise_fn  = samba_ldb_dn_link_canonicalise,
1234                 .comparison_fn    = samba_ldb_dn_link_comparison,
1235                 .operator_fn      = samba_syntax_operator_dn
1236         },{
1237                 .name             = LDB_SYNTAX_SAMBA_RANGE64,
1238                 .ldif_read_fn     = ldif_read_range64,
1239                 .ldif_write_fn    = ldif_write_range64,
1240                 .canonicalise_fn  = ldif_canonicalise_int64,
1241                 .comparison_fn    = ldif_comparison_int64,
1242                 .operator_fn      = samba_syntax_operator_fn
1243         },{
1244                 .name             = LDB_SYNTAX_SAMBA_DNSRECORD,
1245                 .ldif_read_fn     = ldb_handler_copy,
1246                 .ldif_write_fn    = ldif_write_dnsRecord,
1247                 .canonicalise_fn  = ldb_handler_copy,
1248                 .comparison_fn    = ldb_comparison_binary,
1249                 .operator_fn      = samba_syntax_operator_fn
1250         },{
1251                 .name             = LDB_SYNTAX_SAMBA_SUPPLEMENTALCREDENTIALS,
1252                 .ldif_read_fn     = ldb_handler_copy,
1253                 .ldif_write_fn    = ldif_write_supplementalCredentialsBlob,
1254                 .canonicalise_fn  = ldb_handler_copy,
1255                 .comparison_fn    = ldb_comparison_binary,
1256                 .operator_fn      = samba_syntax_operator_fn
1257         }
1258 };
1259
1260 static const struct ldb_dn_extended_syntax samba_dn_syntax[] = {
1261         {
1262                 .name             = "SID",
1263                 .read_fn          = extended_dn_read_SID,
1264                 .write_clear_fn   = ldif_write_objectSid,
1265                 .write_hex_fn     = extended_dn_write_hex
1266         },{
1267                 .name             = "GUID",
1268                 .read_fn          = extended_dn_read_GUID,
1269                 .write_clear_fn   = ldif_write_objectGUID,
1270                 .write_hex_fn     = extended_dn_write_hex
1271         },{
1272                 .name             = "WKGUID",
1273                 .read_fn          = ldb_handler_copy,
1274                 .write_clear_fn   = ldb_handler_copy,
1275                 .write_hex_fn     = ldb_handler_copy
1276         },{
1277                 .name             = "RMD_INVOCID",
1278                 .read_fn          = extended_dn_read_GUID,
1279                 .write_clear_fn   = ldif_write_objectGUID,
1280                 .write_hex_fn     = extended_dn_write_hex
1281         },{
1282                 .name             = "RMD_FLAGS",
1283                 .read_fn          = ldb_handler_copy,
1284                 .write_clear_fn   = ldb_handler_copy,
1285                 .write_hex_fn     = ldb_handler_copy
1286         },{
1287                 .name             = "RMD_ADDTIME",
1288                 .read_fn          = ldb_handler_copy,
1289                 .write_clear_fn   = ldb_handler_copy,
1290                 .write_hex_fn     = ldb_handler_copy
1291         },{
1292                 .name             = "RMD_CHANGETIME",
1293                 .read_fn          = ldb_handler_copy,
1294                 .write_clear_fn   = ldb_handler_copy,
1295                 .write_hex_fn     = ldb_handler_copy
1296         },{
1297                 .name             = "RMD_LOCAL_USN",
1298                 .read_fn          = ldb_handler_copy,
1299                 .write_clear_fn   = ldb_handler_copy,
1300                 .write_hex_fn     = ldb_handler_copy
1301         },{
1302                 .name             = "RMD_ORIGINATING_USN",
1303                 .read_fn          = ldb_handler_copy,
1304                 .write_clear_fn   = ldb_handler_copy,
1305                 .write_hex_fn     = ldb_handler_copy
1306         },{
1307                 .name             = "RMD_VERSION",
1308                 .read_fn          = ldb_handler_copy,
1309                 .write_clear_fn   = ldb_handler_copy,
1310                 .write_hex_fn     = ldb_handler_copy
1311         }
1312 };
1313
1314 /* TODO: Should be dynamic at some point */
1315 static const struct {
1316         const char *name;
1317         const char *syntax;
1318 } samba_attributes[] = {
1319         { "objectSid",                  LDB_SYNTAX_SAMBA_SID },
1320         { "securityIdentifier",         LDB_SYNTAX_SAMBA_SID },
1321         { "tokenGroups",                LDB_SYNTAX_SAMBA_SID },
1322         { "ntSecurityDescriptor",       LDB_SYNTAX_SAMBA_SECURITY_DESCRIPTOR },
1323         { "oMSyntax",                   LDB_SYNTAX_SAMBA_INT32 },
1324         { "objectCategory",             LDB_SYNTAX_SAMBA_OBJECT_CATEGORY },
1325         { "schemaInfo",                 LDB_SYNTAX_SAMBA_SCHEMAINFO },
1326         { "prefixMap",                  LDB_SYNTAX_SAMBA_PREFIX_MAP },
1327         { "repsFrom",                   LDB_SYNTAX_SAMBA_REPSFROMTO },
1328         { "repsTo",                     LDB_SYNTAX_SAMBA_REPSFROMTO },
1329         { "replPropertyMetaData",       LDB_SYNTAX_SAMBA_REPLPROPERTYMETADATA },
1330         { "replUpToDateVector",         LDB_SYNTAX_SAMBA_REPLUPTODATEVECTOR },
1331         { "rIDAllocationPool",          LDB_SYNTAX_SAMBA_RANGE64 },
1332         { "rIDPreviousAllocationPool",  LDB_SYNTAX_SAMBA_RANGE64 },
1333         { "rIDAvailablePool",           LDB_SYNTAX_SAMBA_RANGE64 },
1334         { "defaultSecurityDescriptor",  LDB_SYNTAX_SAMBA_SDDL_SECURITY_DESCRIPTOR },
1335
1336         /*
1337          * these are extracted by searching
1338          * (&(attributeSyntax=2.5.5.10)(rangeLower=16)(rangeUpper=16)(omSyntax=4))
1339          */
1340         { "attributeSecurityGUID",              LDB_SYNTAX_SAMBA_GUID },
1341         { "categoryId",                         LDB_SYNTAX_SAMBA_GUID },
1342         { "controlAccessRights",                LDB_SYNTAX_SAMBA_GUID },
1343         { "currMachineId",                      LDB_SYNTAX_SAMBA_GUID },
1344         { "fRSReplicaSetGUID",                  LDB_SYNTAX_SAMBA_GUID },
1345         { "fRSVersionGUID",                     LDB_SYNTAX_SAMBA_GUID },
1346         { "implementedCategories",              LDB_SYNTAX_SAMBA_GUID },
1347         { "msDS-AzObjectGuid",                  LDB_SYNTAX_SAMBA_GUID },
1348         { "msDFSR-ContentSetGuid",              LDB_SYNTAX_SAMBA_GUID },
1349         { "msDFSR-ReplicationGroupGuid",        LDB_SYNTAX_SAMBA_GUID },
1350         { "mSMQDigests",                        LDB_SYNTAX_SAMBA_GUID },
1351         { "mSMQOwnerID",                        LDB_SYNTAX_SAMBA_GUID },
1352         { "mSMQQMID",                           LDB_SYNTAX_SAMBA_GUID },
1353         { "mSMQQueueType",                      LDB_SYNTAX_SAMBA_GUID },
1354         { "mSMQSites",                          LDB_SYNTAX_SAMBA_GUID },
1355         { "netbootGUID",                        LDB_SYNTAX_SAMBA_GUID },
1356         { "objectGUID",                         LDB_SYNTAX_SAMBA_GUID },
1357         { "pKTGuid",                            LDB_SYNTAX_SAMBA_GUID },
1358         { "requiredCategories",                 LDB_SYNTAX_SAMBA_GUID },
1359         { "schemaIDGUID",                       LDB_SYNTAX_SAMBA_GUID },
1360         { "siteGUID",                           LDB_SYNTAX_SAMBA_GUID },
1361         { "msDFS-GenerationGUIDv2",             LDB_SYNTAX_SAMBA_GUID },
1362         { "msDFS-LinkIdentityGUIDv2",           LDB_SYNTAX_SAMBA_GUID },
1363         { "msDFS-NamespaceIdentityGUIDv2",      LDB_SYNTAX_SAMBA_GUID },
1364
1365         /*
1366          * these are known to be GUIDs
1367          */
1368         { "invocationId",                       LDB_SYNTAX_SAMBA_GUID },
1369         { "parentGUID",                         LDB_SYNTAX_SAMBA_GUID },
1370         { "msDS-OptionalFeatureGUID",           LDB_SYNTAX_SAMBA_GUID },
1371
1372         /* These NDR encoded things we want to be able to read with --show-binary */
1373         { "dnsRecord",                          LDB_SYNTAX_SAMBA_DNSRECORD },
1374         { "supplementalCredentials",            LDB_SYNTAX_SAMBA_SUPPLEMENTALCREDENTIALS}
1375 };
1376
1377 const struct ldb_schema_syntax *ldb_samba_syntax_by_name(struct ldb_context *ldb, const char *name)
1378 {
1379         unsigned int j;
1380         const struct ldb_schema_syntax *s = NULL;
1381         
1382         for (j=0; j < ARRAY_SIZE(samba_syntaxes); j++) {
1383                 if (strcmp(name, samba_syntaxes[j].name) == 0) {
1384                         s = &samba_syntaxes[j];
1385                         break;
1386                 }
1387         }
1388         return s;
1389 }
1390
1391 const struct ldb_schema_syntax *ldb_samba_syntax_by_lDAPDisplayName(struct ldb_context *ldb, const char *name)
1392 {
1393         unsigned int j;
1394         const struct ldb_schema_syntax *s = NULL;
1395
1396         for (j=0; j < ARRAY_SIZE(samba_attributes); j++) {
1397                 if (strcmp(samba_attributes[j].name, name) == 0) {
1398                         s = ldb_samba_syntax_by_name(ldb, samba_attributes[j].syntax);
1399                         break;
1400                 }
1401         }
1402         
1403         return s;
1404 }
1405
1406 /*
1407   register the samba ldif handlers
1408 */
1409 int ldb_register_samba_handlers(struct ldb_context *ldb)
1410 {
1411         unsigned int i;
1412         int ret;
1413
1414         if (ldb_get_opaque(ldb, "SAMBA_HANDLERS_REGISTERED") != NULL) {
1415                 return LDB_SUCCESS;
1416         }
1417
1418         for (i=0; i < ARRAY_SIZE(samba_attributes); i++) {
1419                 const struct ldb_schema_syntax *s = NULL;
1420
1421                 s = ldb_samba_syntax_by_name(ldb, samba_attributes[i].syntax);
1422
1423                 if (!s) {
1424                         s = ldb_standard_syntax_by_name(ldb, samba_attributes[i].syntax);
1425                 }
1426
1427                 if (!s) {
1428                         return LDB_ERR_OPERATIONS_ERROR;
1429                 }
1430
1431                 ret = ldb_schema_attribute_add_with_syntax(ldb, samba_attributes[i].name, LDB_ATTR_FLAG_FIXED, s);
1432                 if (ret != LDB_SUCCESS) {
1433                         return ret;
1434                 }
1435         }
1436
1437         for (i=0; i < ARRAY_SIZE(samba_dn_syntax); i++) {
1438                 ret = ldb_dn_extended_add_syntax(ldb, LDB_ATTR_FLAG_FIXED, &samba_dn_syntax[i]);
1439                 if (ret != LDB_SUCCESS) {
1440                         return ret;
1441                 }
1442
1443         }
1444
1445         ret = ldb_set_opaque(ldb, "SAMBA_HANDLERS_REGISTERED", (void*)1);
1446         if (ret != LDB_SUCCESS) {
1447                 return ret;
1448         }
1449
1450         return LDB_SUCCESS;
1451 }