source3/lib/tldap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Infrastructure for async ldap client requests
   4    Copyright (C) Volker Lendecke 2009
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21
  22 bool tevent_req_is_ldap_error(struct tevent_req *req, int *perr)
  23 {
  24         enum tevent_req_state state;
  25         uint64_t err;
  26
  27         if (!tevent_req_is_error(req, &state, &err)) {
  28                 return false;
  29         }
  30         switch (state) {
  31         case TEVENT_REQ_TIMED_OUT:
  32                 *perr = TLDAP_TIMEOUT;
  33                 break;
  34         case TEVENT_REQ_NO_MEMORY:
  35                 *perr = TLDAP_NO_MEMORY;
  36                 break;
  37         case TEVENT_REQ_USER_ERROR:
  38                 *perr = err;
  39                 break;
  40         default:
  41                 *perr = TLDAP_OPERATIONS_ERROR;
  42                 break;
  43         }
  44         return true;
  45 }
  46
  47 struct tldap_ctx_attribute {
  48         char *name;
  49         void *ptr;
  50 };
  51
  52 struct tldap_context {
  53         int ld_version;
  54         int ld_deref;
  55         int ld_sizelimit;
  56         int ld_timelimit;
  57         struct tstream_context *conn;
  58         bool server_down;
  59         int msgid;
  60         struct tevent_queue *outgoing;
  61         struct tevent_req **pending;
  62
  63         /* For the sync wrappers we need something like get_last_error... */
  64         struct tldap_message *last_msg;
  65
  66         /* debug */
  67         void (*log_fn)(void *context, enum tldap_debug_level level,
  68                        const char *fmt, va_list ap);
  69         void *log_private;
  70
  71         struct tldap_ctx_attribute *ctx_attrs;
  72 };
  73
  74 struct tldap_message {
  75         struct asn1_data *data;
  76         uint8_t *inbuf;
  77         int type;
  78         int id;
  79
  80         /* RESULT_ENTRY */
  81         char *dn;
  82         struct tldap_attribute *attribs;
  83
  84         /* Error data sent by the server */
  85         int lderr;
  86         char *res_matcheddn;
  87         char *res_diagnosticmessage;
  88         char *res_referral;
  89         struct tldap_control *res_sctrls;
  90
  91         /* Controls sent by the server */
  92         struct tldap_control *ctrls;
  93 };
  94
  95 void tldap_set_debug(struct tldap_context *ld,
  96                      void (*log_fn)(void *log_private,
  97                                     enum tldap_debug_level level,
  98                                     const char *fmt,
  99                                     va_list ap) PRINTF_ATTRIBUTE(3,0),
 100                      void *log_private)
 101 {
 102         ld->log_fn = log_fn;
 103         ld->log_private = log_private;
 104 }
 105
 106 static void tldap_debug(struct tldap_context *ld,
 107                          enum tldap_debug_level level,
 108                          const char *fmt, ...)
 109 {
 110         va_list ap;
 111         if (!ld) {
 112                 return;
 113         }
 114         if (ld->log_fn == NULL) {
 115                 return;
 116         }
 117         va_start(ap, fmt);
 118         ld->log_fn(ld->log_private, level, fmt, ap);
 119         va_end(ap);
 120 }
 121
 122 static int tldap_next_msgid(struct tldap_context *ld)
 123 {
 124         int result;
 125
 126         result = ld->msgid++;
 127         if (ld->msgid == 2147483647) {
 128                 ld->msgid = 1;
 129         }
 130         return result;
 131 }
 132
 133 struct tldap_context *tldap_context_create(TALLOC_CTX *mem_ctx, int fd)
 134 {
 135         struct tldap_context *ctx;
 136         int ret;
 137
 138         ctx = talloc_zero(mem_ctx, struct tldap_context);
 139         if (ctx == NULL) {
 140                 return NULL;
 141         }
 142         ret = tstream_bsd_existing_socket(ctx, fd, &ctx->conn);
 143         if (ret == -1) {
 144                 TALLOC_FREE(ctx);
 145                 return NULL;
 146         }
 147         ctx->msgid = 1;
 148         ctx->ld_version = 3;
 149         ctx->outgoing = tevent_queue_create(ctx, "tldap_outgoing");
 150         if (ctx->outgoing == NULL) {
 151                 TALLOC_FREE(ctx);
 152                 return NULL;
 153         }
 154         return ctx;
 155 }
 156
 157 bool tldap_connection_ok(struct tldap_context *ld)
 158 {
 159         if (ld == NULL) {
 160                 return false;
 161         }
 162         return !ld->server_down;
 163 }
 164
 165 static struct tldap_ctx_attribute *tldap_context_findattr(
 166         struct tldap_context *ld, const char *name)
 167 {
 168         int i, num_attrs;
 169
 170         num_attrs = talloc_array_length(ld->ctx_attrs);
 171
 172         for (i=0; i<num_attrs; i++) {
 173                 if (strcmp(ld->ctx_attrs[i].name, name) == 0) {
 174                         return &ld->ctx_attrs[i];
 175                 }
 176         }
 177         return NULL;
 178 }
 179
 180 bool tldap_context_setattr(struct tldap_context *ld,
 181                            const char *name, const void *_pptr)
 182 {
 183         struct tldap_ctx_attribute *tmp, *attr;
 184         char *tmpname;
 185         int num_attrs;
 186         void **pptr = (void **)_pptr;
 187
 188         attr = tldap_context_findattr(ld, name);
 189         if (attr != NULL) {
 190                 /*
 191                  * We don't actually delete attrs, we don't expect tons of
 192                  * attributes being shuffled around.
 193                  */
 194                 TALLOC_FREE(attr->ptr);
 195                 if (*pptr != NULL) {
 196                         attr->ptr = talloc_move(ld->ctx_attrs, pptr);
 197                         *pptr = NULL;
 198                 }
 199                 return true;
 200         }
 201
 202         tmpname = talloc_strdup(ld, name);
 203         if (tmpname == NULL) {
 204                 return false;
 205         }
 206
 207         num_attrs = talloc_array_length(ld->ctx_attrs);
 208
 209         tmp = talloc_realloc(ld, ld->ctx_attrs, struct tldap_ctx_attribute,
 210                              num_attrs+1);
 211         if (tmp == NULL) {
 212                 TALLOC_FREE(tmpname);
 213                 return false;
 214         }
 215         tmp[num_attrs].name = talloc_move(tmp, &tmpname);
 216         if (*pptr != NULL) {
 217                 tmp[num_attrs].ptr = talloc_move(tmp, pptr);
 218         } else {
 219                 tmp[num_attrs].ptr = NULL;
 220         }
 221         *pptr = NULL;
 222         ld->ctx_attrs = tmp;
 223         return true;
 224 }
 225
 226 void *tldap_context_getattr(struct tldap_context *ld, const char *name)
 227 {
 228         struct tldap_ctx_attribute *attr = tldap_context_findattr(ld, name);
 229
 230         if (attr == NULL) {
 231                 return NULL;
 232         }
 233         return attr->ptr;
 234 }
 235
 236 struct read_ldap_state {
 237         uint8_t *buf;
 238         bool done;
 239 };
 240
 241 static ssize_t read_ldap_more(uint8_t *buf, size_t buflen, void *private_data);
 242 static void read_ldap_done(struct tevent_req *subreq);
 243
 244 static struct tevent_req *read_ldap_send(TALLOC_CTX *mem_ctx,
 245                                          struct tevent_context *ev,
 246                                          struct tstream_context *conn)
 247 {
 248         struct tevent_req *req, *subreq;
 249         struct read_ldap_state *state;
 250
 251         req = tevent_req_create(mem_ctx, &state, struct read_ldap_state);
 252         if (req == NULL) {
 253                 return NULL;
 254         }
 255         state->done = false;
 256
 257         subreq = tstream_read_packet_send(state, ev, conn, 2, read_ldap_more,
 258                                           state);
 259         if (tevent_req_nomem(subreq, req)) {
 260                 return tevent_req_post(req, ev);
 261         }
 262         tevent_req_set_callback(subreq, read_ldap_done, req);
 263         return req;
 264 }
 265
 266 static ssize_t read_ldap_more(uint8_t *buf, size_t buflen, void *private_data)
 267 {
 268         struct read_ldap_state *state = talloc_get_type_abort(
 269                 private_data, struct read_ldap_state);
 270         size_t len;
 271         int i, lensize;
 272
 273         if (state->done) {
 274                 /* We've been here, we're done */
 275                 return 0;
 276         }
 277
 278         /*
 279          * From ldap.h: LDAP_TAG_MESSAGE is 0x30
 280          */
 281         if (buf[0] != 0x30) {
 282                 return -1;
 283         }
 284
 285         len = buf[1];
 286         if ((len & 0x80) == 0) {
 287                 state->done = true;
 288                 return len;
 289         }
 290
 291         lensize = (len & 0x7f);
 292         len = 0;
 293
 294         if (buflen == 2) {
 295                 /* Please get us the full length */
 296                 return lensize;
 297         }
 298         if (buflen > 2 + lensize) {
 299                 state->done = true;
 300                 return 0;
 301         }
 302         if (buflen != 2 + lensize) {
 303                 return -1;
 304         }
 305
 306         for (i=0; i<lensize; i++) {
 307                 len = (len << 8) | buf[2+i];
 308         }
 309         return len;
 310 }
 311
 312 static void read_ldap_done(struct tevent_req *subreq)
 313 {
 314         struct tevent_req *req = tevent_req_callback_data(
 315                 subreq, struct tevent_req);
 316         struct read_ldap_state *state = tevent_req_data(
 317                 req, struct read_ldap_state);
 318         ssize_t nread;
 319         int err;
 320
 321         nread = tstream_read_packet_recv(subreq, state, &state->buf, &err);
 322         TALLOC_FREE(subreq);
 323         if (nread == -1) {
 324                 tevent_req_error(req, err);
 325                 return;
 326         }
 327         tevent_req_done(req);
 328 }
 329
 330 static ssize_t read_ldap_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 331                               uint8_t **pbuf, int *perrno)
 332 {
 333         struct read_ldap_state *state = tevent_req_data(
 334                 req, struct read_ldap_state);
 335
 336         if (tevent_req_is_unix_error(req, perrno)) {
 337                 return -1;
 338         }
 339         *pbuf = talloc_move(mem_ctx, &state->buf);
 340         return talloc_get_size(*pbuf);
 341 }
 342
 343 struct tldap_msg_state {
 344         struct tldap_context *ld;
 345         struct tevent_context *ev;
 346         int id;
 347         struct iovec iov;
 348
 349         struct asn1_data *data;
 350         uint8_t *inbuf;
 351 };
 352
 353 static void tldap_push_controls(struct asn1_data *data,
 354                                 struct tldap_control *sctrls,
 355                                 int num_sctrls)
 356 {
 357         int i;
 358
 359         if ((sctrls == NULL) || (num_sctrls == 0)) {
 360                 return;
 361         }
 362
 363         asn1_push_tag(data, ASN1_CONTEXT(0));
 364
 365         for (i=0; i<num_sctrls; i++) {
 366                 struct tldap_control *c = &sctrls[i];
 367                 asn1_push_tag(data, ASN1_SEQUENCE(0));
 368                 asn1_write_OctetString(data, c->oid, strlen(c->oid));
 369                 if (c->critical) {
 370                         asn1_write_BOOLEAN(data, true);
 371                 }
 372                 if (c->value.data != NULL) {
 373                         asn1_write_OctetString(data, c->value.data,
 374                                                c->value.length);
 375                 }
 376                 asn1_pop_tag(data); /* ASN1_SEQUENCE(0) */
 377         }
 378
 379         asn1_pop_tag(data); /* ASN1_CONTEXT(0) */
 380 }
 381
 382 static void tldap_msg_sent(struct tevent_req *subreq);
 383 static void tldap_msg_received(struct tevent_req *subreq);
 384
 385 static struct tevent_req *tldap_msg_send(TALLOC_CTX *mem_ctx,
 386                                          struct tevent_context *ev,
 387                                          struct tldap_context *ld,
 388                                          int id, struct asn1_data *data,
 389                                          struct tldap_control *sctrls,
 390                                          int num_sctrls)
 391 {
 392         struct tevent_req *req, *subreq;
 393         struct tldap_msg_state *state;
 394         DATA_BLOB blob;
 395
 396         tldap_debug(ld, TLDAP_DEBUG_TRACE, "tldap_msg_send: sending msg %d\n",
 397                     id);
 398
 399         req = tevent_req_create(mem_ctx, &state, struct tldap_msg_state);
 400         if (req == NULL) {
 401                 return NULL;
 402         }
 403         state->ld = ld;
 404         state->ev = ev;
 405         state->id = id;
 406
 407         if (state->ld->server_down) {
 408                 tevent_req_error(req, TLDAP_SERVER_DOWN);
 409                 return tevent_req_post(req, ev);
 410         }
 411
 412         tldap_push_controls(data, sctrls, num_sctrls);
 413
 414         asn1_pop_tag(data);
 415
 416         if (!asn1_blob(data, &blob)) {
 417                 tevent_req_error(req, TLDAP_ENCODING_ERROR);
 418                 return tevent_req_post(req, ev);
 419         }
 420
 421         state->iov.iov_base = blob.data;
 422         state->iov.iov_len = blob.length;
 423
 424         subreq = tstream_writev_queue_send(state, ev, ld->conn, ld->outgoing,
 425                                            &state->iov, 1);
 426         if (tevent_req_nomem(subreq, req)) {
 427                 return tevent_req_post(req, ev);
 428         }
 429         tevent_req_set_callback(subreq, tldap_msg_sent, req);
 430         return req;
 431 }
 432
 433 static void tldap_msg_unset_pending(struct tevent_req *req)
 434 {
 435         struct tldap_msg_state *state = tevent_req_data(
 436                 req, struct tldap_msg_state);
 437         struct tldap_context *ld = state->ld;
 438         int num_pending = talloc_array_length(ld->pending);
 439         int i;
 440
 441         if (num_pending == 1) {
 442                 TALLOC_FREE(ld->pending);
 443                 return;
 444         }
 445
 446         for (i=0; i<num_pending; i++) {
 447                 if (req == ld->pending[i]) {
 448                         break;
 449                 }
 450         }
 451         if (i == num_pending) {
 452                 /*
 453                  * Something's seriously broken. Just returning here is the
 454                  * right thing nevertheless, the point of this routine is to
 455                  * remove ourselves from cli->pending.
 456                  */
 457                 return;
 458         }
 459
 460         /*
 461          * Remove ourselves from the cli->pending array
 462          */
 463         if (num_pending > 1) {
 464                 ld->pending[i] = ld->pending[num_pending-1];
 465         }
 466
 467         /*
 468          * No NULL check here, we're shrinking by sizeof(void *), and
 469          * talloc_realloc just adjusts the size for this.
 470          */
 471         ld->pending = talloc_realloc(NULL, ld->pending, struct tevent_req *,
 472                                      num_pending - 1);
 473         return;
 474 }
 475
 476 static int tldap_msg_destructor(struct tevent_req *req)
 477 {
 478         tldap_msg_unset_pending(req);
 479         return 0;
 480 }
 481
 482 static bool tldap_msg_set_pending(struct tevent_req *req)
 483 {
 484         struct tldap_msg_state *state = tevent_req_data(
 485                 req, struct tldap_msg_state);
 486         struct tldap_context *ld;
 487         struct tevent_req **pending;
 488         int num_pending;
 489         struct tevent_req *subreq;
 490
 491         ld = state->ld;
 492         num_pending = talloc_array_length(ld->pending);
 493
 494         pending = talloc_realloc(ld, ld->pending, struct tevent_req *,
 495                                  num_pending+1);
 496         if (pending == NULL) {
 497                 return false;
 498         }
 499         pending[num_pending] = req;
 500         ld->pending = pending;
 501         talloc_set_destructor(req, tldap_msg_destructor);
 502
 503         if (num_pending > 0) {
 504                 return true;
 505         }
 506
 507         /*
 508          * We're the first ones, add the read_ldap request that waits for the
 509          * answer from the server
 510          */
 511         subreq = read_ldap_send(ld->pending, state->ev, ld->conn);
 512         if (subreq == NULL) {
 513                 tldap_msg_unset_pending(req);
 514                 return false;
 515         }
 516         tevent_req_set_callback(subreq, tldap_msg_received, ld);
 517         return true;
 518 }
 519
 520 static void tldap_msg_sent(struct tevent_req *subreq)
 521 {
 522         struct tevent_req *req = tevent_req_callback_data(
 523                 subreq, struct tevent_req);
 524         struct tldap_msg_state *state = tevent_req_data(
 525                 req, struct tldap_msg_state);
 526         ssize_t nwritten;
 527         int err;
 528
 529         nwritten = tstream_writev_queue_recv(subreq, &err);
 530         TALLOC_FREE(subreq);
 531         if (nwritten == -1) {
 532                 state->ld->server_down = true;
 533                 tevent_req_error(req, TLDAP_SERVER_DOWN);
 534                 return;
 535         }
 536
 537         if (!tldap_msg_set_pending(req)) {
 538                 tevent_req_nomem(NULL, req);
 539                 return;
 540         }
 541 }
 542
 543 static int tldap_msg_msgid(struct tevent_req *req)
 544 {
 545         struct tldap_msg_state *state = tevent_req_data(
 546                 req, struct tldap_msg_state);
 547
 548         return state->id;
 549 }
 550
 551 static void tldap_msg_received(struct tevent_req *subreq)
 552 {
 553         struct tldap_context *ld = tevent_req_callback_data(
 554                 subreq, struct tldap_context);
 555         struct tevent_req *req;
 556         struct tldap_msg_state *state;
 557         struct tevent_context *ev;
 558         struct asn1_data *data;
 559         uint8_t *inbuf;
 560         ssize_t received;
 561         size_t num_pending;
 562         int i, err, status;
 563         int id;
 564         uint8_t type;
 565         bool ok;
 566
 567         received = read_ldap_recv(subreq, talloc_tos(), &inbuf, &err);
 568         TALLOC_FREE(subreq);
 569         if (received == -1) {
 570                 status = TLDAP_SERVER_DOWN;
 571                 goto fail;
 572         }
 573
 574         data = asn1_init(talloc_tos());
 575         if (data == NULL) {
 576                 status = TLDAP_NO_MEMORY;
 577                 goto fail;
 578         }
 579         asn1_load_nocopy(data, inbuf, received);
 580
 581         ok = true;
 582         ok &= asn1_start_tag(data, ASN1_SEQUENCE(0));
 583         ok &= asn1_read_Integer(data, &id);
 584         ok &= asn1_peek_uint8(data, &type);
 585
 586         if (!ok) {
 587                 status = TLDAP_PROTOCOL_ERROR;
 588                 goto fail;
 589         }
 590
 591         tldap_debug(ld, TLDAP_DEBUG_TRACE, "tldap_msg_received: got msg %d "
 592                     "type %d\n", id, (int)type);
 593
 594         num_pending = talloc_array_length(ld->pending);
 595
 596         for (i=0; i<num_pending; i++) {
 597                 if (id == tldap_msg_msgid(ld->pending[i])) {
 598                         break;
 599                 }
 600         }
 601         if (i == num_pending) {
 602                 /* Dump unexpected reply */
 603                 tldap_debug(ld, TLDAP_DEBUG_WARNING, "tldap_msg_received: "
 604                             "No request pending for msg %d\n", id);
 605                 TALLOC_FREE(data);
 606                 TALLOC_FREE(inbuf);
 607                 goto done;
 608         }
 609
 610         req = ld->pending[i];
 611         state = tevent_req_data(req, struct tldap_msg_state);
 612
 613         state->inbuf = talloc_move(state, &inbuf);
 614         state->data = talloc_move(state, &data);
 615
 616         ev = state->ev;
 617
 618         talloc_set_destructor(req, NULL);
 619         tldap_msg_unset_pending(req);
 620         num_pending = talloc_array_length(ld->pending);
 621
 622         tevent_req_done(req);
 623
 624  done:
 625         if (num_pending == 0) {
 626                 return;
 627         }
 628         if (talloc_array_length(ld->pending) > num_pending) {
 629                 /*
 630                  * The callback functions called from tevent_req_done() above
 631                  * have put something on the pending queue. We don't have to
 632                  * trigger the read_ldap_send(), tldap_msg_set_pending() has
 633                  * done it for us already.
 634                  */
 635                 return;
 636         }
 637
 638         state = tevent_req_data(ld->pending[0], struct tldap_msg_state);
 639         subreq = read_ldap_send(ld->pending, state->ev, ld->conn);
 640         if (subreq == NULL) {
 641                 status = TLDAP_NO_MEMORY;
 642                 goto fail;
 643         }
 644         tevent_req_set_callback(subreq, tldap_msg_received, ld);
 645         return;
 646
 647  fail:
 648         while (talloc_array_length(ld->pending) > 0) {
 649                 req = ld->pending[0];
 650                 talloc_set_destructor(req, NULL);
 651                 tldap_msg_destructor(req);
 652                 tevent_req_error(req, status);
 653         }
 654 }
 655
 656 static int tldap_msg_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 657                           struct tldap_message **pmsg)
 658 {
 659         struct tldap_msg_state *state = tevent_req_data(
 660                 req, struct tldap_msg_state);
 661         struct tldap_message *msg;
 662         int err;
 663         uint8_t msgtype;
 664
 665         if (tevent_req_is_ldap_error(req, &err)) {
 666                 return err;
 667         }
 668
 669         if (!asn1_peek_uint8(state->data, &msgtype)) {
 670                 return TLDAP_PROTOCOL_ERROR;
 671         }
 672
 673         if (pmsg == NULL) {
 674                 return TLDAP_SUCCESS;
 675         }
 676
 677         msg = talloc_zero(mem_ctx, struct tldap_message);
 678         if (msg == NULL) {
 679                 return TLDAP_NO_MEMORY;
 680         }
 681         msg->id = state->id;
 682
 683         msg->inbuf = talloc_move(msg, &state->inbuf);
 684         msg->data = talloc_move(msg, &state->data);
 685         msg->type = msgtype;
 686
 687         *pmsg = msg;
 688         return TLDAP_SUCCESS;
 689 }
 690
 691 struct tldap_req_state {
 692         int id;
 693         struct asn1_data *out;
 694         struct tldap_message *result;
 695 };
 696
 697 static struct tevent_req *tldap_req_create(TALLOC_CTX *mem_ctx,
 698                                            struct tldap_context *ld,
 699                                            struct tldap_req_state **pstate)
 700 {
 701         struct tevent_req *req;
 702         struct tldap_req_state *state;
 703
 704         req = tevent_req_create(mem_ctx, &state, struct tldap_req_state);
 705         if (req == NULL) {
 706                 return NULL;
 707         }
 708         ZERO_STRUCTP(state);
 709         state->out = asn1_init(state);
 710         if (state->out == NULL) {
 711                 TALLOC_FREE(req);
 712                 return NULL;
 713         }
 714         state->result = NULL;
 715         state->id = tldap_next_msgid(ld);
 716
 717         asn1_push_tag(state->out, ASN1_SEQUENCE(0));
 718         asn1_write_Integer(state->out, state->id);
 719
 720         *pstate = state;
 721         return req;
 722 }
 723
 724 static void tldap_save_msg(struct tldap_context *ld, struct tevent_req *req)
 725 {
 726         struct tldap_req_state *state = tevent_req_data(
 727                 req, struct tldap_req_state);
 728
 729         TALLOC_FREE(ld->last_msg);
 730         ld->last_msg = talloc_move(ld, &state->result);
 731 }
 732
 733 static char *blob2string_talloc(TALLOC_CTX *mem_ctx, DATA_BLOB blob)
 734 {
 735         char *result = talloc_array(mem_ctx, char, blob.length+1);
 736         memcpy(result, blob.data, blob.length);
 737         result[blob.length] = '\0';
 738         return result;
 739 }
 740
 741 static bool asn1_read_OctetString_talloc(TALLOC_CTX *mem_ctx,
 742                                          struct asn1_data *data,
 743                                          char **result)
 744 {
 745         DATA_BLOB string;
 746         if (!asn1_read_OctetString(data, mem_ctx, &string))
 747                 return false;
 748         *result = blob2string_talloc(mem_ctx, string);
 749         data_blob_free(&string);
 750         return true;
 751 }
 752
 753 static bool tldap_decode_controls(struct tldap_req_state *state);
 754
 755 static bool tldap_decode_response(struct tldap_req_state *state)
 756 {
 757         struct asn1_data *data = state->result->data;
 758         struct tldap_message *msg = state->result;
 759         bool ok = true;
 760
 761         ok &= asn1_read_enumerated(data, &msg->lderr);
 762         ok &= asn1_read_OctetString_talloc(msg, data, &msg->res_matcheddn);
 763         ok &= asn1_read_OctetString_talloc(msg, data,
 764                                            &msg->res_diagnosticmessage);
 765         if (asn1_peek_tag(data, ASN1_CONTEXT(3))) {
 766                 ok &= asn1_start_tag(data, ASN1_CONTEXT(3));
 767                 ok &= asn1_read_OctetString_talloc(msg, data,
 768                                                    &msg->res_referral);
 769                 ok &= asn1_end_tag(data);
 770         } else {
 771                 msg->res_referral = NULL;
 772         }
 773
 774         return ok;
 775 }
 776
 777 static void tldap_sasl_bind_done(struct tevent_req *subreq);
 778
 779 struct tevent_req *tldap_sasl_bind_send(TALLOC_CTX *mem_ctx,
 780                                         struct tevent_context *ev,
 781                                         struct tldap_context *ld,
 782                                         const char *dn,
 783                                         const char *mechanism,
 784                                         DATA_BLOB *creds,
 785                                         struct tldap_control *sctrls,
 786                                         int num_sctrls,
 787                                         struct tldap_control *cctrls,
 788                                         int num_cctrls)
 789 {
 790         struct tevent_req *req, *subreq;
 791         struct tldap_req_state *state;
 792
 793         req = tldap_req_create(mem_ctx, ld, &state);
 794         if (req == NULL) {
 795                 return NULL;
 796         }
 797
 798         if (dn == NULL) {
 799                 dn = "";
 800         }
 801
 802         asn1_push_tag(state->out, TLDAP_REQ_BIND);
 803         asn1_write_Integer(state->out, ld->ld_version);
 804         asn1_write_OctetString(state->out, dn, (dn != NULL) ? strlen(dn) : 0);
 805
 806         if (mechanism == NULL) {
 807                 asn1_push_tag(state->out, ASN1_CONTEXT_SIMPLE(0));
 808                 asn1_write(state->out, creds->data, creds->length);
 809                 asn1_pop_tag(state->out);
 810         } else {
 811                 asn1_push_tag(state->out, ASN1_CONTEXT(3));
 812                 asn1_write_OctetString(state->out, mechanism,
 813                                        strlen(mechanism));
 814                 if ((creds != NULL) && (creds->data != NULL)) {
 815                         asn1_write_OctetString(state->out, creds->data,
 816                                                creds->length);
 817                 }
 818                 asn1_pop_tag(state->out);
 819         }
 820
 821         if (!asn1_pop_tag(state->out)) {
 822                 tevent_req_error(req, TLDAP_ENCODING_ERROR);
 823                 return tevent_req_post(req, ev);
 824         }
 825
 826         subreq = tldap_msg_send(state, ev, ld, state->id, state->out,
 827                                 sctrls, num_sctrls);
 828         if (tevent_req_nomem(subreq, req)) {
 829                 return tevent_req_post(req, ev);
 830         }
 831         tevent_req_set_callback(subreq, tldap_sasl_bind_done, req);
 832         return req;
 833 }
 834
 835 static void tldap_sasl_bind_done(struct tevent_req *subreq)
 836 {
 837         struct tevent_req *req = tevent_req_callback_data(
 838                 subreq, struct tevent_req);
 839         struct tldap_req_state *state = tevent_req_data(
 840                 req, struct tldap_req_state);
 841         int err;
 842
 843         err = tldap_msg_recv(subreq, state, &state->result);
 844         TALLOC_FREE(subreq);
 845         if (err != TLDAP_SUCCESS) {
 846                 tevent_req_error(req, err);
 847                 return;
 848         }
 849         if (state->result->type != TLDAP_RES_BIND) {
 850                 tevent_req_error(req, TLDAP_PROTOCOL_ERROR);
 851                 return;
 852         }
 853         if (!asn1_start_tag(state->result->data, state->result->type) ||
 854             !tldap_decode_response(state) ||
 855             !asn1_end_tag(state->result->data)) {
 856                 tevent_req_error(req, TLDAP_DECODING_ERROR);
 857                 return;
 858         }
 859         /*
 860          * TODO: pull the reply blob
 861          */
 862         if (state->result->lderr != TLDAP_SUCCESS) {
 863                 tevent_req_error(req, state->result->lderr);
 864                 return;
 865         }
 866         tevent_req_done(req);
 867 }
 868
 869 int tldap_sasl_bind_recv(struct tevent_req *req)
 870 {
 871         int err;
 872
 873         if (tevent_req_is_ldap_error(req, &err)) {
 874                 return err;
 875         }
 876         return TLDAP_SUCCESS;
 877 }
 878
 879 int tldap_sasl_bind(struct tldap_context *ld,
 880                     const char *dn,
 881                     const char *mechanism,
 882                     DATA_BLOB *creds,
 883                     struct tldap_control *sctrls,
 884                     int num_sctrls,
 885                     struct tldap_control *cctrls,
 886                     int num_cctrls)
 887 {
 888         TALLOC_CTX *frame = talloc_stackframe();
 889         struct tevent_context *ev;
 890         struct tevent_req *req;
 891         int result;
 892
 893         ev = event_context_init(frame);
 894         if (ev == NULL) {
 895                 result = TLDAP_NO_MEMORY;
 896                 goto fail;
 897         }
 898
 899         req = tldap_sasl_bind_send(frame, ev, ld, dn, mechanism, creds,
 900                                    sctrls, num_sctrls, cctrls, num_cctrls);
 901         if (req == NULL) {
 902                 result = TLDAP_NO_MEMORY;
 903                 goto fail;
 904         }
 905
 906         if (!tevent_req_poll(req, ev)) {
 907                 result = TLDAP_OPERATIONS_ERROR;
 908                 goto fail;
 909         }
 910
 911         result = tldap_sasl_bind_recv(req);
 912         tldap_save_msg(ld, req);
 913  fail:
 914         TALLOC_FREE(frame);
 915         return result;
 916 }
 917
 918 struct tevent_req *tldap_simple_bind_send(TALLOC_CTX *mem_ctx,
 919                                           struct tevent_context *ev,
 920                                           struct tldap_context *ld,
 921                                           const char *dn,
 922                                           const char *passwd)
 923 {
 924         DATA_BLOB cred;
 925
 926         if (passwd != NULL) {
 927                 cred.data = (uint8_t *)passwd;
 928                 cred.length = strlen(passwd);
 929         } else {
 930                 cred.data = (uint8_t *)"";
 931                 cred.length = 0;
 932         }
 933         return tldap_sasl_bind_send(mem_ctx, ev, ld, dn, NULL, &cred, NULL, 0,
 934                                     NULL, 0);
 935 }
 936
 937 int tldap_simple_bind_recv(struct tevent_req *req)
 938 {
 939         return tldap_sasl_bind_recv(req);
 940 }
 941
 942 int tldap_simple_bind(struct tldap_context *ld, const char *dn,
 943                       const char *passwd)
 944 {
 945         DATA_BLOB cred;
 946
 947         if (passwd != NULL) {
 948                 cred.data = (uint8_t *)passwd;
 949                 cred.length = strlen(passwd);
 950         } else {
 951                 cred.data = (uint8_t *)"";
 952                 cred.length = 0;
 953         }
 954         return tldap_sasl_bind(ld, dn, NULL, &cred, NULL, 0, NULL, 0);
 955 }
 956
 957 /*****************************************************************************/
 958
 959 /* can't use isalpha() as only a strict set is valid for LDAP */
 960 #define TLDAP_IS_ALPHA(c) ((((c) >= 'a') && ((c) <= 'z')) || \
 961                            (((c) >= 'A') && ((c) <= 'Z')))
 962
 963 #define TLDAP_IS_ADH(c) (TLDAP_IS_ALPHA(c) || isdigit(c) || (c) == '-')
 964
 965 #define TLDAP_FILTER_AND  ASN1_CONTEXT(0)
 966 #define TLDAP_FILTER_OR   ASN1_CONTEXT(1)
 967 #define TLDAP_FILTER_NOT  ASN1_CONTEXT(2)
 968 #define TLDAP_FILTER_EQ   ASN1_CONTEXT(3)
 969 #define TLDAP_FILTER_SUB  ASN1_CONTEXT(4)
 970 #define TLDAP_FILTER_LE   ASN1_CONTEXT(5)
 971 #define TLDAP_FILTER_GE   ASN1_CONTEXT(6)
 972 #define TLDAP_FILTER_PRES ASN1_CONTEXT_SIMPLE(7)
 973 #define TLDAP_FILTER_APX  ASN1_CONTEXT(8)
 974 #define TLDAP_FILTER_EXT  ASN1_CONTEXT(9)
 975
 976 #define TLDAP_SUB_INI ASN1_CONTEXT_SIMPLE(0)
 977 #define TLDAP_SUB_ANY ASN1_CONTEXT_SIMPLE(1)
 978 #define TLDAP_SUB_FIN ASN1_CONTEXT_SIMPLE(2)
 979
 980
 981 /* oid's should be numerical only in theory,
 982  * but apparently some broken servers may have alphanum aliases instead.
 983  * Do like openldap libraries and allow alphanum aliases for oids, but
 984  * do not allow Tagging options in that case.
 985  */
 986 static bool tldap_is_attrdesc(const char *s, int len, bool no_tagopts)
 987 {
 988         bool is_oid = false;
 989         bool dot = false;
 990         int i;
 991
 992         /* first char has stricter rules */
 993         if (isdigit(*s)) {
 994                 is_oid = true;
 995         } else if (!TLDAP_IS_ALPHA(*s)) {
 996                 /* bad first char */
 997                 return false;
 998         }
 999
1000         for (i = 1; i < len; i++) {
1001
1002                 if (is_oid) {
1003                         if (isdigit(s[i])) {
1004                                 dot = false;
1005                                 continue;
1006                         }
1007                         if (s[i] == '.') {
1008                                 if (dot) {
1009                                         /* malformed */
1010                                         return false;
1011                                 }
1012                                 dot = true;
1013                                 continue;
1014                         }
1015                 } else {
1016                         if (TLDAP_IS_ADH(s[i])) {
1017                                 continue;
1018                         }
1019                 }
1020
1021                 if (s[i] == ';') {
1022                         if (no_tagopts) {
1023                                 /* no tagging options */
1024                                 return false;
1025                         }
1026                         if (dot) {
1027                                 /* malformed */
1028                                 return false;
1029                         }
1030                         if ((i + 1) == len) {
1031                                 /* malformed */
1032                                 return false;
1033                         }
1034
1035                         is_oid = false;
1036                         continue;
1037                 }
1038         }
1039
1040         if (dot) {
1041                 /* malformed */
1042                 return false;
1043         }
1044
1045         return true;
1046 }
1047
1048 /* this function copies the value until the closing parenthesis is found. */
1049 static char *tldap_get_val(TALLOC_CTX *memctx,
1050                            const char *value, const char **_s)
1051 {
1052         const char *s = value;
1053
1054         /* find terminator */
1055         while (*s) {
1056                 s = strchr(s, ')');
1057                 if (s && (*(s - 1) == '\\')) {
1058                         continue;
1059                 }
1060                 break;
1061         }
1062         if (!s || !(*s == ')')) {
1063                 /* malformed filter */
1064                 return NULL;
1065         }
1066
1067         *_s = s;
1068
1069         return talloc_strndup(memctx, value, s - value);
1070 }
1071
1072 static int tldap_hex2char(const char *x)
1073 {
1074         if (isxdigit(x[0]) && isxdigit(x[1])) {
1075                 const char h1 = x[0], h2 = x[1];
1076                 int c;
1077
1078                 if (h1 >= 'a') c = h1 - (int)'a' + 10;
1079                 else if (h1 >= 'A') c = h1 - (int)'A' + 10;
1080                 else if (h1 >= '0') c = h1 - (int)'0';
1081                 c = c << 4;
1082                 if (h2 >= 'a') c += h2 - (int)'a' + 10;
1083                 else if (h1 >= 'A') c += h2 - (int)'A' + 10;
1084                 else if (h1 >= '0') c += h2 - (int)'0';
1085
1086                 return c;
1087         }
1088
1089         return -1;
1090 }
1091
1092 static bool tldap_find_first_star(const char *val, const char **star)
1093 {
1094         const char *s;
1095
1096         for (s = val; *s; s++) {
1097                 switch (*s) {
1098                 case '\\':
1099                         if (isxdigit(s[1]) && isxdigit(s[2])) {
1100                                 s += 2;
1101                                 break;
1102                         }
1103                         /* not hex based escape, check older syntax */
1104                         switch (s[1]) {
1105                         case '(':
1106                         case ')':
1107                         case '*':
1108                         case '\\':
1109                                 s++;
1110                                 break;
1111                         default:
1112                                 /* invalid escape sequence */
1113                                 return false;
1114                         }
1115                         break;
1116                 case ')':
1117                         /* end of val, nothing found */
1118                         *star = s;
1119                         return true;
1120
1121                 case '*':
1122                         *star = s;
1123                         return true;
1124                 }
1125         }
1126
1127         /* string ended without closing parenthesis, filter is malformed */
1128         return false;
1129 }
1130
1131 static bool tldap_unescape_inplace(char *value, size_t *val_len)
1132 {
1133         int c, i, p;
1134
1135         for (i = 0,p = 0; i < *val_len; i++) {
1136
1137                 switch (value[i]) {
1138                 case '(':
1139                 case ')':
1140                 case '*':
1141                         /* these must be escaped */
1142                         return false;
1143
1144                 case '\\':
1145                         if (!value[i + 1]) {
1146                                 /* invalid EOL */
1147                                 return false;
1148                         }
1149                         i++;
1150
1151                         c = tldap_hex2char(&value[i]);
1152                         if (c >= 0 && c < 256) {
1153                                 value[p] = c;
1154                                 i++;
1155                                 p++;
1156                                 break;
1157                         }
1158
1159                         switch (value[i]) {
1160                         case '(':
1161                         case ')':
1162                         case '*':
1163                         case '\\':
1164                                 value[p] = value[i];
1165                                 p++;
1166                         default:
1167                                 /* invalid */
1168                                 return false;
1169                         }
1170                         break;
1171
1172                 default:
1173                         value[p] = value[i];
1174                         p++;
1175                 }
1176         }
1177         value[p] = '\0';
1178         *val_len = p;
1179         return true;
1180 }
1181
1182 static bool tldap_push_filter_basic(struct tldap_context *ld,
1183                                     struct asn1_data *data,
1184                                     const char **_s);
1185 static bool tldap_push_filter_substring(struct tldap_context *ld,
1186                                         struct asn1_data *data,
1187                                         const char *val,
1188                                         const char **_s);
1189 static bool tldap_push_filter_int(struct tldap_context *ld,
1190                                   struct asn1_data *data,
1191                                   const char **_s)
1192 {
1193         const char *s = *_s;
1194         bool ret;
1195
1196         if (*s != '(') {
1197                 tldap_debug(ld, TLDAP_DEBUG_ERROR,
1198                             "Incomplete or malformed filter\n");
1199                 return false;
1200         }
1201         s++;
1202
1203         /* we are right after a parenthesis,
1204          * find out what op we have at hand */
1205         switch (*s) {
1206         case '&':
1207                 tldap_debug(ld, TLDAP_DEBUG_TRACE, "Filter op: AND\n");
1208                 asn1_push_tag(data, TLDAP_FILTER_AND);
1209                 s++;
1210                 break;
1211
1212         case '|':
1213                 tldap_debug(ld, TLDAP_DEBUG_TRACE, "Filter op: OR\n");
1214                 asn1_push_tag(data, TLDAP_FILTER_OR);
1215                 s++;
1216                 break;
1217
1218         case '!':
1219                 tldap_debug(ld, TLDAP_DEBUG_TRACE, "Filter op: NOT\n");
1220                 asn1_push_tag(data, TLDAP_FILTER_NOT);
1221                 s++;
1222                 ret = tldap_push_filter_int(ld, data, &s);
1223                 if (!ret) {
1224                         return false;
1225                 }
1226                 asn1_pop_tag(data);
1227                 goto done;
1228
1229         case '(':
1230         case ')':
1231                 tldap_debug(ld, TLDAP_DEBUG_ERROR,
1232                             "Invalid parenthesis '%c'\n", *s);
1233                 return false;
1234
1235         case '\0':
1236                 tldap_debug(ld, TLDAP_DEBUG_ERROR,
1237                             "Invalid filter termination\n");
1238                 return false;
1239
1240         default:
1241                 ret = tldap_push_filter_basic(ld, data, &s);
1242                 if (!ret) {
1243                         return false;
1244                 }
1245                 goto done;
1246         }
1247
1248         /* only and/or filters get here.
1249          * go through the list of filters */
1250
1251         if (*s == ')') {
1252                 /* RFC 4526: empty and/or */
1253                 asn1_pop_tag(data);
1254                 goto done;
1255         }
1256
1257         while (*s) {
1258                 ret = tldap_push_filter_int(ld, data, &s);
1259                 if (!ret) {
1260                         return false;
1261                 }
1262
1263                 if (*s == ')') {
1264                         /* end of list, return */
1265                         asn1_pop_tag(data);
1266                         break;
1267                 }
1268         }
1269
1270 done:
1271         if (*s != ')') {
1272                 tldap_debug(ld, TLDAP_DEBUG_ERROR,
1273                             "Incomplete or malformed filter\n");
1274                 return false;
1275         }
1276         s++;
1277
1278         if (data->has_error) {
1279                 return false;
1280         }
1281
1282         *_s = s;
1283         return true;
1284 }
1285
1286
1287 static bool tldap_push_filter_basic(struct tldap_context *ld,
1288                                     struct asn1_data *data,
1289                                     const char **_s)
1290 {
1291         TALLOC_CTX *tmpctx = talloc_tos();
1292         const char *s = *_s;
1293         const char *e;
1294         const char *eq;
1295         const char *val;
1296         const char *type;
1297         const char *dn;
1298         const char *rule;
1299         const char *star;
1300         size_t type_len;
1301         char *uval;
1302         size_t uval_len;
1303         bool write_octect = true;
1304         bool ret;
1305
1306         eq = strchr(s, '=');
1307         if (!eq) {
1308                 tldap_debug(ld, TLDAP_DEBUG_ERROR,
1309                             "Invalid filter, missing equal sign\n");
1310                 return false;
1311         }
1312
1313         val = eq + 1;
1314         e = eq - 1;
1315
1316         switch (*e) {
1317         case '<':
1318                 asn1_push_tag(data, TLDAP_FILTER_LE);
1319                 break;
1320
1321         case '>':
1322                 asn1_push_tag(data, TLDAP_FILTER_GE);
1323                 break;
1324
1325         case '~':
1326                 asn1_push_tag(data, TLDAP_FILTER_APX);
1327                 break;
1328
1329         case ':':
1330                 asn1_push_tag(data, TLDAP_FILTER_EXT);
1331                 write_octect = false;
1332
1333                 type = NULL;
1334                 dn = NULL;
1335                 rule = NULL;
1336
1337                 if (*s == ':') { /* [:dn]:rule:= value */
1338                         if (s == e) {
1339                                 /* malformed filter */
1340                                 return false;
1341                         }
1342                         dn = s;
1343                 } else { /* type[:dn][:rule]:= value */
1344                         type = s;
1345                         dn = strchr(s, ':');
1346                         type_len = dn - type;
1347                         if (dn == e) { /* type:= value */
1348                                 dn = NULL;
1349                         }
1350                 }
1351                 if (dn) {
1352                         dn++;
1353
1354                         rule = strchr(dn, ':');
1355                         if ((rule == dn + 1) || rule + 1 == e) {
1356                                 /* malformed filter, contains "::" */
1357                                 return false;
1358                         }
1359
1360                         if (StrnCaseCmp(dn, "dn:", 3) != 0) {
1361                                 if (rule == e) {
1362                                         rule = dn;
1363                                         dn = NULL;
1364                                 } else {
1365                                         /* malformed filter. With two
1366                                          * optionals, the first must be "dn"
1367                                          */
1368                                         return false;
1369                                 }
1370                         } else {
1371                                 if (rule == e) {
1372                                         rule = NULL;
1373                                 } else {
1374                                         rule++;
1375                                 }
1376                         }
1377                 }
1378
1379                 if (!type && !dn && !rule) {
1380                         /* malformed filter, there must be at least one */
1381                         return false;
1382                 }
1383
1384                 /*
1385                   MatchingRuleAssertion ::= SEQUENCE {
1386                   matchingRule    [1] MatchingRuleID OPTIONAL,
1387                   type      [2] AttributeDescription OPTIONAL,
1388                   matchValue      [3] AssertionValue,
1389                   dnAttributes    [4] BOOLEAN DEFAULT FALSE
1390                   }
1391                 */
1392
1393                 /* check and add rule */
1394                 if (rule) {
1395                         ret = tldap_is_attrdesc(rule, e - rule, true);
1396                         if (!ret) {
1397                                 return false;
1398                         }
1399                         asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(1));
1400                         asn1_write(data, rule, e - rule);
1401                         asn1_pop_tag(data);
1402                 }
1403
1404                 /* check and add type */
1405                 if (type) {
1406                         ret = tldap_is_attrdesc(type, type_len, false);
1407                         if (!ret) {
1408                                 return false;
1409                         }
1410                         asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(2));
1411                         asn1_write(data, type, type_len);
1412                         asn1_pop_tag(data);
1413                 }
1414
1415                 uval = tldap_get_val(tmpctx, val, _s);
1416                 if (!uval) {
1417                         return false;
1418                 }
1419                 uval_len = *_s - val;
1420                 ret = tldap_unescape_inplace(uval, &uval_len);
1421                 if (!ret) {
1422                         return false;
1423                 }
1424
1425                 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(3));
1426                 asn1_write(data, uval, uval_len);
1427                 asn1_pop_tag(data);
1428
1429                 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(4));
1430                 asn1_write_uint8(data, dn?1:0);
1431                 asn1_pop_tag(data);
1432                 break;
1433
1434         default:
1435                 e = eq;
1436
1437                 ret = tldap_is_attrdesc(s, e - s, false);
1438                 if (!ret) {
1439                         return false;
1440                 }
1441
1442                 if (strncmp(val, "*)", 2) == 0) {
1443                         /* presence */
1444                         asn1_push_tag(data, TLDAP_FILTER_PRES);
1445                         asn1_write(data, s, e - s);
1446                         *_s = val + 1;
1447                         write_octect = false;
1448                         break;
1449                 }
1450
1451                 ret = tldap_find_first_star(val, &star);
1452                 if (!ret) {
1453                         return false;
1454                 }
1455                 if (*star == '*') {
1456                         /* substring */
1457                         asn1_push_tag(data, TLDAP_FILTER_SUB);
1458                         asn1_write_OctetString(data, s, e - s);
1459                         ret = tldap_push_filter_substring(ld, data, val, &s);
1460                         if (!ret) {
1461                                 return false;
1462                         }
1463                         *_s = s;
1464                         write_octect = false;
1465                         break;
1466                 }
1467
1468                 /* if nothing else, then it is just equality */
1469                 asn1_push_tag(data, TLDAP_FILTER_EQ);
1470                 write_octect = true;
1471                 break;
1472         }
1473
1474         if (write_octect) {
1475                 uval = tldap_get_val(tmpctx, val, _s);
1476                 if (!uval) {
1477                         return false;
1478                 }
1479                 uval_len = *_s - val;
1480                 ret = tldap_unescape_inplace(uval, &uval_len);
1481                 if (!ret) {
1482                         return false;
1483                 }
1484
1485                 asn1_write_OctetString(data, s, e - s);
1486                 asn1_write_OctetString(data, uval, uval_len);
1487         }
1488
1489         if (data->has_error) {
1490                 return false;
1491         }
1492         asn1_pop_tag(data);
1493         return true;
1494 }
1495
1496 static bool tldap_push_filter_substring(struct tldap_context *ld,
1497                                         struct asn1_data *data,
1498                                         const char *val,
1499                                         const char **_s)
1500 {
1501         TALLOC_CTX *tmpctx = talloc_tos();
1502         bool initial = true;
1503         const char *star;
1504         char *chunk;
1505         size_t chunk_len;
1506         bool ret;
1507
1508         /*
1509           SubstringFilter ::= SEQUENCE {
1510                   type      AttributeDescription,
1511                   -- at least one must be present
1512                   substrings      SEQUENCE OF CHOICE {
1513                           initial [0] LDAPString,
1514                           any     [1] LDAPString,
1515                           final   [2] LDAPString } }
1516         */
1517         asn1_push_tag(data, ASN1_SEQUENCE(0));
1518
1519         do {
1520                 ret = tldap_find_first_star(val, &star);
1521                 if (!ret) {
1522                         return false;
1523                 }
1524                 chunk_len = star - val;
1525
1526                 switch (*star) {
1527                 case '*':
1528                         if (!initial && chunk_len == 0) {
1529                                 /* found '**', which is illegal */
1530                                 return false;
1531                         }
1532                         break;
1533                 case ')':
1534                         if (initial) {
1535                                 /* no stars ?? */
1536                                 return false;
1537                         }
1538                         /* we are done */
1539                         break;
1540                 default:
1541                         /* ?? */
1542                         return false;
1543                 }
1544
1545                 if (initial && chunk_len == 0) {
1546                         val = star + 1;
1547                         initial = false;
1548                         continue;
1549                 }
1550
1551                 chunk = talloc_strndup(tmpctx, val, chunk_len);
1552                 if (!chunk) {
1553                         return false;
1554                 }
1555                 ret = tldap_unescape_inplace(chunk, &chunk_len);
1556                 if (!ret) {
1557                         return false;
1558                 }
1559                 switch (*star) {
1560                 case '*':
1561                         if (initial) {
1562                                 asn1_push_tag(data, TLDAP_SUB_INI);
1563                                 initial = false;
1564                         } else {
1565                                 asn1_push_tag(data, TLDAP_SUB_ANY);
1566                         }
1567                         break;
1568                 case ')':
1569                         asn1_push_tag(data, TLDAP_SUB_FIN);
1570                         break;
1571                 default:
1572                         /* ?? */
1573                         return false;
1574                 }
1575                 asn1_write(data, chunk, chunk_len);
1576                 asn1_pop_tag(data);
1577
1578                 val = star + 1;
1579
1580         } while (*star == '*');
1581
1582         *_s = star;
1583
1584         /* end of sequence */
1585         asn1_pop_tag(data);
1586         return true;
1587 }
1588
1589 /* NOTE: although openldap libraries allow for spaces in some places, mosly
1590  * around parenthesis, we do not allow any spaces (except in values of
1591  * course) as I couldn't fine any place in RFC 4512 or RFC 4515 where
1592  * leading or trailing spaces where allowed.
1593  */
1594 static bool tldap_push_filter(struct tldap_context *ld,
1595                               struct asn1_data *data,
1596                               const char *filter)
1597 {
1598         const char *s = filter;
1599         bool ret;
1600
1601         ret = tldap_push_filter_int(ld, data, &s);
1602         if (ret && *s) {
1603                 tldap_debug(ld, TLDAP_DEBUG_ERROR,
1604                             "Incomplete or malformed filter\n");
1605                 return false;
1606         }
1607         return ret;
1608 }
1609
1610 /*****************************************************************************/
1611
1612 static void tldap_search_done(struct tevent_req *subreq);
1613
1614 struct tevent_req *tldap_search_send(TALLOC_CTX *mem_ctx,
1615                                      struct tevent_context *ev,
1616                                      struct tldap_context *ld,
1617                                      const char *base, int scope,
1618                                      const char *filter,
1619                                      const char **attrs,
1620                                      int num_attrs,
1621                                      int attrsonly,
1622                                      struct tldap_control *sctrls,
1623                                      int num_sctrls,
1624                                      struct tldap_control *cctrls,
1625                                      int num_cctrls,
1626                                      int timelimit,
1627                                      int sizelimit,
1628                                      int deref)
1629 {
1630         struct tevent_req *req, *subreq;
1631         struct tldap_req_state *state;
1632         int i;
1633
1634         req = tldap_req_create(mem_ctx, ld, &state);
1635         if (req == NULL) {
1636                 return NULL;
1637         }
1638
1639         asn1_push_tag(state->out, TLDAP_REQ_SEARCH);
1640         asn1_write_OctetString(state->out, base, strlen(base));
1641         asn1_write_enumerated(state->out, scope);
1642         asn1_write_enumerated(state->out, deref);
1643         asn1_write_Integer(state->out, sizelimit);
1644         asn1_write_Integer(state->out, timelimit);
1645         asn1_write_BOOLEAN(state->out, attrsonly);
1646
1647         if (!tldap_push_filter(ld, state->out, filter)) {
1648                 goto encoding_error;
1649         }
1650
1651         asn1_push_tag(state->out, ASN1_SEQUENCE(0));
1652         for (i=0; i<num_attrs; i++) {
1653                 asn1_write_OctetString(state->out, attrs[i], strlen(attrs[i]));
1654         }
1655         asn1_pop_tag(state->out);
1656         asn1_pop_tag(state->out);
1657
1658         subreq = tldap_msg_send(state, ev, ld, state->id, state->out,
1659                                 sctrls, num_sctrls);
1660         if (tevent_req_nomem(subreq, req)) {
1661                 return tevent_req_post(req, ev);
1662         }
1663         tevent_req_set_callback(subreq, tldap_search_done, req);
1664         return req;
1665
1666  encoding_error:
1667         tevent_req_error(req, TLDAP_ENCODING_ERROR);
1668         return tevent_req_post(req, ev);
1669 }
1670
1671 static void tldap_search_done(struct tevent_req *subreq)
1672 {
1673         struct tevent_req *req = tevent_req_callback_data(
1674                 subreq, struct tevent_req);
1675         struct tldap_req_state *state = tevent_req_data(
1676                 req, struct tldap_req_state);
1677         int err;
1678
1679         err = tldap_msg_recv(subreq, state, &state->result);
1680         if (err != TLDAP_SUCCESS) {
1681                 tevent_req_error(req, err);
1682                 return;
1683         }
1684         switch (state->result->type) {
1685         case TLDAP_RES_SEARCH_ENTRY:
1686         case TLDAP_RES_SEARCH_REFERENCE:
1687                 tevent_req_notify_callback(req);
1688                 if (!tldap_msg_set_pending(subreq)) {
1689                         tevent_req_nomem(NULL, req);
1690                         return;
1691                 }
1692                 break;
1693         case TLDAP_RES_SEARCH_RESULT:
1694                 TALLOC_FREE(subreq);
1695                 if (!asn1_start_tag(state->result->data,
1696                                     state->result->type) ||
1697                     !tldap_decode_response(state) ||
1698                     !asn1_end_tag(state->result->data) ||
1699                     !tldap_decode_controls(state)) {
1700                         tevent_req_error(req, TLDAP_DECODING_ERROR);
1701                         return;
1702                 }
1703                 tevent_req_done(req);
1704                 break;
1705         default:
1706                 tevent_req_error(req, TLDAP_PROTOCOL_ERROR);
1707                 return;
1708         }
1709 }
1710
1711 int tldap_search_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1712                       struct tldap_message **pmsg)
1713 {
1714         struct tldap_req_state *state = tevent_req_data(
1715                 req, struct tldap_req_state);
1716         int err;
1717
1718         if (!tevent_req_is_in_progress(req)
1719             && tevent_req_is_ldap_error(req, &err)) {
1720                 return err;
1721         }
1722
1723         if (tevent_req_is_in_progress(req)) {
1724                 switch (state->result->type) {
1725                 case TLDAP_RES_SEARCH_ENTRY:
1726                 case TLDAP_RES_SEARCH_REFERENCE:
1727                         break;
1728                 default:
1729                         return TLDAP_OPERATIONS_ERROR;
1730                 }
1731         }
1732
1733         *pmsg = talloc_move(mem_ctx, &state->result);
1734         return TLDAP_SUCCESS;
1735 }
1736
1737 struct tldap_sync_search_state {
1738         TALLOC_CTX *mem_ctx;
1739         struct tldap_message **entries;
1740         struct tldap_message **refs;
1741         int rc;
1742 };
1743
1744 static void tldap_search_cb(struct tevent_req *req)
1745 {
1746         struct tldap_sync_search_state *state =
1747                 (struct tldap_sync_search_state *)
1748                 tevent_req_callback_data_void(req);
1749         struct tldap_message *msg, **tmp;
1750         int rc, num_entries, num_refs;
1751
1752         rc = tldap_search_recv(req, talloc_tos(), &msg);
1753         if (rc != TLDAP_SUCCESS) {
1754                 state->rc = rc;
1755                 return;
1756         }
1757
1758         switch (tldap_msg_type(msg)) {
1759         case TLDAP_RES_SEARCH_ENTRY:
1760                 num_entries = talloc_array_length(state->entries);
1761                 tmp = talloc_realloc(state->mem_ctx, state->entries,
1762                                      struct tldap_message *, num_entries + 1);
1763                 if (tmp == NULL) {
1764                         state->rc = TLDAP_NO_MEMORY;
1765                         return;
1766                 }
1767                 state->entries = tmp;
1768                 state->entries[num_entries] = talloc_move(state->entries,
1769                                                           &msg);
1770                 break;
1771         case TLDAP_RES_SEARCH_REFERENCE:
1772                 num_refs = talloc_array_length(state->refs);
1773                 tmp = talloc_realloc(state->mem_ctx, state->refs,
1774                                      struct tldap_message *, num_refs + 1);
1775                 if (tmp == NULL) {
1776                         state->rc = TLDAP_NO_MEMORY;
1777                         return;
1778                 }
1779                 state->refs = tmp;
1780                 state->refs[num_refs] = talloc_move(state->refs, &msg);
1781                 break;
1782         case TLDAP_RES_SEARCH_RESULT:
1783                 state->rc = TLDAP_SUCCESS;
1784                 break;
1785         default:
1786                 state->rc = TLDAP_PROTOCOL_ERROR;
1787                 break;
1788         }
1789 }
1790
1791 int tldap_search(struct tldap_context *ld,
1792                  const char *base, int scope, const char *filter,
1793                  const char **attrs, int num_attrs, int attrsonly,
1794                  struct tldap_control *sctrls, int num_sctrls,
1795                  struct tldap_control *cctrls, int num_cctrls,
1796                  int timelimit, int sizelimit, int deref,
1797                  TALLOC_CTX *mem_ctx, struct tldap_message ***entries,
1798                  struct tldap_message ***refs)
1799 {
1800         TALLOC_CTX *frame = talloc_stackframe();
1801         struct tevent_context *ev;
1802         struct tevent_req *req;
1803         struct tldap_sync_search_state state;
1804
1805         ZERO_STRUCT(state);
1806         state.mem_ctx = mem_ctx;
1807         state.rc = TLDAP_SUCCESS;
1808
1809         ev = event_context_init(frame);
1810         if (ev == NULL) {
1811                 state.rc = TLDAP_NO_MEMORY;
1812                 goto fail;
1813         }
1814
1815         req = tldap_search_send(frame, ev, ld, base, scope, filter,
1816                                 attrs, num_attrs, attrsonly,
1817                                 sctrls, num_sctrls, cctrls, num_cctrls,
1818                                 timelimit, sizelimit, deref);
1819         if (req == NULL) {
1820                 state.rc = TLDAP_NO_MEMORY;
1821                 goto fail;
1822         }
1823
1824         tevent_req_set_callback(req, tldap_search_cb, &state);
1825
1826         if (!tevent_req_is_in_progress(req)) {
1827                 /* an error happend before sending */
1828                 if (tevent_req_is_ldap_error(req, &state.rc)) {
1829                         goto fail;
1830                 }
1831         }
1832
1833         while (tevent_req_is_in_progress(req)
1834                && (state.rc == TLDAP_SUCCESS)) {
1835                 if (tevent_loop_once(ev) == -1) {
1836                         return TLDAP_OPERATIONS_ERROR;
1837                 }
1838         }
1839
1840         if (state.rc != TLDAP_SUCCESS) {
1841                 return state.rc;
1842         }
1843
1844         if (entries != NULL) {
1845                 *entries = state.entries;
1846         } else {
1847                 TALLOC_FREE(state.entries);
1848         }
1849         if (refs != NULL) {
1850                 *refs = state.refs;
1851         } else {
1852                 TALLOC_FREE(state.refs);
1853         }
1854         tldap_save_msg(ld, req);
1855 fail:
1856         TALLOC_FREE(frame);
1857         return state.rc;
1858 }
1859
1860 static bool tldap_parse_search_entry(struct tldap_message *msg)
1861 {
1862         int num_attribs = 0;
1863
1864         asn1_start_tag(msg->data, msg->type);
1865
1866         /* dn */
1867
1868         asn1_read_OctetString_talloc(msg, msg->data, &msg->dn);
1869         if (msg->dn == NULL) {
1870                 return false;
1871         }
1872
1873         /*
1874          * Attributes: We overallocate msg->attribs by one, so that while
1875          * looping over the attributes we can directly parse into the last
1876          * array element. Same for the values in the inner loop.
1877          */
1878
1879         msg->attribs = talloc_array(msg, struct tldap_attribute, 1);
1880         if (msg->attribs == NULL) {
1881                 return false;
1882         }
1883
1884         asn1_start_tag(msg->data, ASN1_SEQUENCE(0));
1885         while (asn1_peek_tag(msg->data, ASN1_SEQUENCE(0))) {
1886                 struct tldap_attribute *attrib;
1887                 int num_values = 0;
1888
1889                 attrib = &msg->attribs[num_attribs];
1890                 attrib->values = talloc_array(msg->attribs, DATA_BLOB, 1);
1891                 if (attrib->values == NULL) {
1892                         return false;
1893                 }
1894                 asn1_start_tag(msg->data, ASN1_SEQUENCE(0));
1895                 asn1_read_OctetString_talloc(msg->attribs, msg->data,
1896                                              &attrib->name);
1897                 asn1_start_tag(msg->data, ASN1_SET);
1898
1899                 while (asn1_peek_tag(msg->data, ASN1_OCTET_STRING)) {
1900                         asn1_read_OctetString(msg->data, msg,
1901                                               &attrib->values[num_values]);
1902
1903                         attrib->values = talloc_realloc(
1904                                 msg->attribs, attrib->values, DATA_BLOB,
1905                                 num_values + 2);
1906                         if (attrib->values == NULL) {
1907                                 return false;
1908                         }
1909                         num_values += 1;
1910                 }
1911                 attrib->values = talloc_realloc(msg->attribs, attrib->values,
1912                                                 DATA_BLOB, num_values);
1913                 attrib->num_values = num_values;
1914
1915                 asn1_end_tag(msg->data); /* ASN1_SET */
1916                 asn1_end_tag(msg->data); /* ASN1_SEQUENCE(0) */
1917                 msg->attribs = talloc_realloc(
1918                         msg, msg->attribs, struct tldap_attribute,
1919                         num_attribs + 2);
1920                 if (msg->attribs == NULL) {
1921                         return false;
1922                 }
1923                 num_attribs += 1;
1924         }
1925         msg->attribs = talloc_realloc(
1926                 msg, msg->attribs, struct tldap_attribute, num_attribs);
1927         asn1_end_tag(msg->data);
1928         if (msg->data->has_error) {
1929                 return false;
1930         }
1931         return true;
1932 }
1933
1934 bool tldap_entry_dn(struct tldap_message *msg, char **dn)
1935 {
1936         if ((msg->dn == NULL) && (!tldap_parse_search_entry(msg))) {
1937                 return false;
1938         }
1939         *dn = msg->dn;
1940         return true;
1941 }
1942
1943 bool tldap_entry_attributes(struct tldap_message *msg, int *num_attributes,
1944                             struct tldap_attribute **attributes)
1945 {
1946         if ((msg->dn == NULL) && (!tldap_parse_search_entry(msg))) {
1947                 return false;
1948         }
1949         *attributes = msg->attribs;
1950         *num_attributes = talloc_array_length(msg->attribs);
1951         return true;
1952 }
1953
1954 static bool tldap_decode_controls(struct tldap_req_state *state)
1955 {
1956         struct tldap_message *msg = state->result;
1957         struct asn1_data *data = msg->data;
1958         struct tldap_control *sctrls = NULL;
1959         int num_controls = 0;
1960
1961         msg->res_sctrls = NULL;
1962
1963         if (!asn1_peek_tag(data, ASN1_CONTEXT(0))) {
1964                 return true;
1965         }
1966
1967         asn1_start_tag(data, ASN1_CONTEXT(0));
1968
1969         while (asn1_peek_tag(data, ASN1_SEQUENCE(0))) {
1970                 struct tldap_control *c;
1971                 char *oid = NULL;
1972
1973                 sctrls = talloc_realloc(msg, sctrls, struct tldap_control,
1974                                         num_controls + 1);
1975                 if (sctrls == NULL) {
1976                         return false;
1977                 }
1978                 c = &sctrls[num_controls];
1979
1980                 asn1_start_tag(data, ASN1_SEQUENCE(0));
1981                 asn1_read_OctetString_talloc(msg, data, &oid);
1982                 if ((data->has_error) || (oid == NULL)) {
1983                         return false;
1984                 }
1985                 c->oid = oid;
1986                 if (asn1_peek_tag(data, ASN1_BOOLEAN)) {
1987                         asn1_read_BOOLEAN(data, &c->critical);
1988                 } else {
1989                         c->critical = false;
1990                 }
1991                 c->value = data_blob_null;
1992                 if (asn1_peek_tag(data, ASN1_OCTET_STRING) &&
1993                     !asn1_read_OctetString(data, msg, &c->value)) {
1994                         return false;
1995                 }
1996                 asn1_end_tag(data); /* ASN1_SEQUENCE(0) */
1997
1998                 num_controls += 1;
1999         }
2000
2001         asn1_end_tag(data);     /* ASN1_CONTEXT(0) */
2002
2003         if (data->has_error) {
2004                 TALLOC_FREE(sctrls);
2005                 return false;
2006         }
2007         msg->res_sctrls = sctrls;
2008         return true;
2009 }
2010
2011 static void tldap_simple_done(struct tevent_req *subreq, int type)
2012 {
2013         struct tevent_req *req = tevent_req_callback_data(
2014                 subreq, struct tevent_req);
2015         struct tldap_req_state *state = tevent_req_data(
2016                 req, struct tldap_req_state);
2017         int err;
2018
2019         err = tldap_msg_recv(subreq, state, &state->result);
2020         TALLOC_FREE(subreq);
2021         if (err != TLDAP_SUCCESS) {
2022                 tevent_req_error(req, err);
2023                 return;
2024         }
2025         if (state->result->type != type) {
2026                 tevent_req_error(req, TLDAP_PROTOCOL_ERROR);
2027                 return;
2028         }
2029         if (!asn1_start_tag(state->result->data, state->result->type) ||
2030             !tldap_decode_response(state) ||
2031             !asn1_end_tag(state->result->data) ||
2032             !tldap_decode_controls(state)) {
2033                 tevent_req_error(req, TLDAP_DECODING_ERROR);
2034                 return;
2035         }
2036         if (state->result->lderr != TLDAP_SUCCESS) {
2037                 tevent_req_error(req, state->result->lderr);
2038                 return;
2039         }
2040         tevent_req_done(req);
2041 }
2042
2043 static int tldap_simple_recv(struct tevent_req *req)
2044 {
2045         int err;
2046         if (tevent_req_is_ldap_error(req, &err)) {
2047                 return err;
2048         }
2049         return TLDAP_SUCCESS;
2050 }
2051
2052 static void tldap_add_done(struct tevent_req *subreq);
2053
2054 struct tevent_req *tldap_add_send(TALLOC_CTX *mem_ctx,
2055                                   struct tevent_context *ev,
2056                                   struct tldap_context *ld,
2057                                   const char *dn,
2058                                   struct tldap_mod *attributes,
2059                                   int num_attributes,
2060                                   struct tldap_control *sctrls,
2061                                   int num_sctrls,
2062                                   struct tldap_control *cctrls,
2063                                   int num_cctrls)
2064 {
2065         struct tevent_req *req, *subreq;
2066         struct tldap_req_state *state;
2067         int i, j;
2068
2069         req = tldap_req_create(mem_ctx, ld, &state);
2070         if (req == NULL) {
2071                 return NULL;
2072         }
2073
2074         asn1_push_tag(state->out, TLDAP_REQ_ADD);
2075         asn1_write_OctetString(state->out, dn, strlen(dn));
2076         asn1_push_tag(state->out, ASN1_SEQUENCE(0));
2077
2078         for (i=0; i<num_attributes; i++) {
2079                 struct tldap_mod *attrib = &attributes[i];
2080                 asn1_push_tag(state->out, ASN1_SEQUENCE(0));
2081                 asn1_write_OctetString(state->out, attrib->attribute,
2082                                        strlen(attrib->attribute));
2083                 asn1_push_tag(state->out, ASN1_SET);
2084                 for (j=0; j<attrib->num_values; j++) {
2085                         asn1_write_OctetString(state->out,
2086                                                attrib->values[j].data,
2087                                                attrib->values[j].length);
2088                 }
2089                 asn1_pop_tag(state->out);
2090                 asn1_pop_tag(state->out);
2091         }
2092
2093         asn1_pop_tag(state->out);
2094         asn1_pop_tag(state->out);
2095
2096         subreq = tldap_msg_send(state, ev, ld, state->id, state->out,
2097                                 sctrls, num_sctrls);
2098         if (tevent_req_nomem(subreq, req)) {
2099                 return tevent_req_post(req, ev);
2100         }
2101         tevent_req_set_callback(subreq, tldap_add_done, req);
2102         return req;
2103 }
2104
2105 static void tldap_add_done(struct tevent_req *subreq)
2106 {
2107         tldap_simple_done(subreq, TLDAP_RES_ADD);
2108 }
2109
2110 int tldap_add_recv(struct tevent_req *req)
2111 {
2112         return tldap_simple_recv(req);
2113 }
2114
2115 int tldap_add(struct tldap_context *ld, const char *dn,
2116               int num_attributes, struct tldap_mod *attributes,
2117               struct tldap_control *sctrls, int num_sctrls,
2118               struct tldap_control *cctrls, int num_cctrls)
2119 {
2120         TALLOC_CTX *frame = talloc_stackframe();
2121         struct tevent_context *ev;
2122         struct tevent_req *req;
2123         int result;
2124
2125         ev = event_context_init(frame);
2126         if (ev == NULL) {
2127                 result = TLDAP_NO_MEMORY;
2128                 goto fail;
2129         }
2130
2131         req = tldap_add_send(frame, ev, ld, dn, attributes, num_attributes,
2132                              sctrls, num_sctrls, cctrls, num_cctrls);
2133         if (req == NULL) {
2134                 result = TLDAP_NO_MEMORY;
2135                 goto fail;
2136         }
2137
2138         if (!tevent_req_poll(req, ev)) {
2139                 result = TLDAP_OPERATIONS_ERROR;
2140                 goto fail;
2141         }
2142
2143         result = tldap_add_recv(req);
2144         tldap_save_msg(ld, req);
2145  fail:
2146         TALLOC_FREE(frame);
2147         return result;
2148 }
2149
2150 static void tldap_modify_done(struct tevent_req *subreq);
2151
2152 struct tevent_req *tldap_modify_send(TALLOC_CTX *mem_ctx,
2153                                      struct tevent_context *ev,
2154                                      struct tldap_context *ld,
2155                                      const char *dn,
2156                                      int num_mods, struct tldap_mod *mods,
2157                                      struct tldap_control *sctrls,
2158                                      int num_sctrls,
2159                                      struct tldap_control *cctrls,
2160                                      int num_cctrls)
2161 {
2162         struct tevent_req *req, *subreq;
2163         struct tldap_req_state *state;
2164         int i, j;
2165
2166         req = tldap_req_create(mem_ctx, ld, &state);
2167         if (req == NULL) {
2168                 return NULL;
2169         }
2170
2171         asn1_push_tag(state->out, TLDAP_REQ_MODIFY);
2172         asn1_write_OctetString(state->out, dn, strlen(dn));
2173         asn1_push_tag(state->out, ASN1_SEQUENCE(0));
2174
2175         for (i=0; i<num_mods; i++) {
2176                 struct tldap_mod *mod = &mods[i];
2177                 asn1_push_tag(state->out, ASN1_SEQUENCE(0));
2178                 asn1_write_enumerated(state->out, mod->mod_op),
2179                 asn1_push_tag(state->out, ASN1_SEQUENCE(0));
2180                 asn1_write_OctetString(state->out, mod->attribute,
2181                                        strlen(mod->attribute));
2182                 asn1_push_tag(state->out, ASN1_SET);
2183                 for (j=0; j<mod->num_values; j++) {
2184                         asn1_write_OctetString(state->out,
2185                                                mod->values[j].data,
2186                                                mod->values[j].length);
2187                 }
2188                 asn1_pop_tag(state->out);
2189                 asn1_pop_tag(state->out);
2190                 asn1_pop_tag(state->out);
2191         }
2192
2193         asn1_pop_tag(state->out);
2194         asn1_pop_tag(state->out);
2195
2196         subreq = tldap_msg_send(state, ev, ld, state->id, state->out,
2197                                 sctrls, num_sctrls);
2198         if (tevent_req_nomem(subreq, req)) {
2199                 return tevent_req_post(req, ev);
2200         }
2201         tevent_req_set_callback(subreq, tldap_modify_done, req);
2202         return req;
2203 }
2204
2205 static void tldap_modify_done(struct tevent_req *subreq)
2206 {
2207         tldap_simple_done(subreq, TLDAP_RES_MODIFY);
2208 }
2209
2210 int tldap_modify_recv(struct tevent_req *req)
2211 {
2212         return tldap_simple_recv(req);
2213 }
2214
2215 int tldap_modify(struct tldap_context *ld, const char *dn,
2216                  int num_mods, struct tldap_mod *mods,
2217                  struct tldap_control *sctrls, int num_sctrls,
2218                  struct tldap_control *cctrls, int num_cctrls)
2219  {
2220         TALLOC_CTX *frame = talloc_stackframe();
2221         struct tevent_context *ev;
2222         struct tevent_req *req;
2223         int result;
2224
2225         ev = event_context_init(frame);
2226         if (ev == NULL) {
2227                 result = TLDAP_NO_MEMORY;
2228                 goto fail;
2229         }
2230
2231         req = tldap_modify_send(frame, ev, ld, dn, num_mods, mods,
2232                                 sctrls, num_sctrls, cctrls, num_cctrls);
2233         if (req == NULL) {
2234                 result = TLDAP_NO_MEMORY;
2235                 goto fail;
2236         }
2237
2238         if (!tevent_req_poll(req, ev)) {
2239                 result = TLDAP_OPERATIONS_ERROR;
2240                 goto fail;
2241         }
2242
2243         result = tldap_modify_recv(req);
2244         tldap_save_msg(ld, req);
2245  fail:
2246         TALLOC_FREE(frame);
2247         return result;
2248 }
2249
2250 static void tldap_delete_done(struct tevent_req *subreq);
2251
2252 struct tevent_req *tldap_delete_send(TALLOC_CTX *mem_ctx,
2253                                      struct tevent_context *ev,
2254                                      struct tldap_context *ld,
2255                                      const char *dn,
2256                                      struct tldap_control *sctrls,
2257                                      int num_sctrls,
2258                                      struct tldap_control *cctrls,
2259                                      int num_cctrls)
2260 {
2261         struct tevent_req *req, *subreq;
2262         struct tldap_req_state *state;
2263
2264         req = tldap_req_create(mem_ctx, ld, &state);
2265         if (req == NULL) {
2266                 return NULL;
2267         }
2268
2269         asn1_push_tag(state->out, TLDAP_REQ_DELETE);
2270         asn1_write(state->out, dn, strlen(dn));
2271         asn1_pop_tag(state->out);
2272
2273         subreq = tldap_msg_send(state, ev, ld, state->id, state->out,
2274                                 sctrls, num_sctrls);
2275         if (tevent_req_nomem(subreq, req)) {
2276                 return tevent_req_post(req, ev);
2277         }
2278         tevent_req_set_callback(subreq, tldap_delete_done, req);
2279         return req;
2280 }
2281
2282 static void tldap_delete_done(struct tevent_req *subreq)
2283 {
2284         tldap_simple_done(subreq, TLDAP_RES_DELETE);
2285 }
2286
2287 int tldap_delete_recv(struct tevent_req *req)
2288 {
2289         return tldap_simple_recv(req);
2290 }
2291
2292 int tldap_delete(struct tldap_context *ld, const char *dn,
2293                  struct tldap_control *sctrls, int num_sctrls,
2294                  struct tldap_control *cctrls, int num_cctrls)
2295 {
2296         TALLOC_CTX *frame = talloc_stackframe();
2297         struct tevent_context *ev;
2298         struct tevent_req *req;
2299         int result;
2300
2301         ev = event_context_init(frame);
2302         if (ev == NULL) {
2303                 result = TLDAP_NO_MEMORY;
2304                 goto fail;
2305         }
2306
2307         req = tldap_delete_send(frame, ev, ld, dn, sctrls, num_sctrls,
2308                                 cctrls, num_cctrls);
2309         if (req == NULL) {
2310                 result = TLDAP_NO_MEMORY;
2311                 goto fail;
2312         }
2313
2314         if (!tevent_req_poll(req, ev)) {
2315                 result = TLDAP_OPERATIONS_ERROR;
2316                 goto fail;
2317         }
2318
2319         result = tldap_delete_recv(req);
2320         tldap_save_msg(ld, req);
2321  fail:
2322         TALLOC_FREE(frame);
2323         return result;
2324 }
2325
2326 int tldap_msg_id(const struct tldap_message *msg)
2327 {
2328         return msg->id;
2329 }
2330
2331 int tldap_msg_type(const struct tldap_message *msg)
2332 {
2333         return msg->type;
2334 }
2335
2336 const char *tldap_msg_matcheddn(struct tldap_message *msg)
2337 {
2338         if (msg == NULL) {
2339                 return NULL;
2340         }
2341         return msg->res_matcheddn;
2342 }
2343
2344 const char *tldap_msg_diagnosticmessage(struct tldap_message *msg)
2345 {
2346         if (msg == NULL) {
2347                 return NULL;
2348         }
2349         return msg->res_diagnosticmessage;
2350 }
2351
2352 const char *tldap_msg_referral(struct tldap_message *msg)
2353 {
2354         if (msg == NULL) {
2355                 return NULL;
2356         }
2357         return msg->res_referral;
2358 }
2359
2360 void tldap_msg_sctrls(struct tldap_message *msg, int *num_sctrls,
2361                       struct tldap_control **sctrls)
2362 {
2363         if (msg == NULL) {
2364                 *sctrls = NULL;
2365                 *num_sctrls = 0;
2366         }
2367         *sctrls = msg->res_sctrls;
2368         *num_sctrls = talloc_array_length(msg->res_sctrls);
2369 }
2370
2371 struct tldap_message *tldap_ctx_lastmsg(struct tldap_context *ld)
2372 {
2373         return ld->last_msg;
2374 }
2375
2376 const char *tldap_err2string(int rc)
2377 {
2378         const char *res = NULL;
2379
2380         /*
2381          * This would normally be a table, but the error codes are not fully
2382          * sequential. Let the compiler figure out the optimum implementation
2383          * :-)
2384          */
2385
2386         switch (rc) {
2387         case TLDAP_SUCCESS:
2388                 res = "TLDAP_SUCCESS";
2389                 break;
2390         case TLDAP_OPERATIONS_ERROR:
2391                 res = "TLDAP_OPERATIONS_ERROR";
2392                 break;
2393         case TLDAP_PROTOCOL_ERROR:
2394                 res = "TLDAP_PROTOCOL_ERROR";
2395                 break;
2396         case TLDAP_TIMELIMIT_EXCEEDED:
2397                 res = "TLDAP_TIMELIMIT_EXCEEDED";
2398                 break;
2399         case TLDAP_SIZELIMIT_EXCEEDED:
2400                 res = "TLDAP_SIZELIMIT_EXCEEDED";
2401                 break;
2402         case TLDAP_COMPARE_FALSE:
2403                 res = "TLDAP_COMPARE_FALSE";
2404                 break;
2405         case TLDAP_COMPARE_TRUE:
2406                 res = "TLDAP_COMPARE_TRUE";
2407                 break;
2408         case TLDAP_STRONG_AUTH_NOT_SUPPORTED:
2409                 res = "TLDAP_STRONG_AUTH_NOT_SUPPORTED";
2410                 break;
2411         case TLDAP_STRONG_AUTH_REQUIRED:
2412                 res = "TLDAP_STRONG_AUTH_REQUIRED";
2413                 break;
2414         case TLDAP_REFERRAL:
2415                 res = "TLDAP_REFERRAL";
2416                 break;
2417         case TLDAP_ADMINLIMIT_EXCEEDED:
2418                 res = "TLDAP_ADMINLIMIT_EXCEEDED";
2419                 break;
2420         case TLDAP_UNAVAILABLE_CRITICAL_EXTENSION:
2421                 res = "TLDAP_UNAVAILABLE_CRITICAL_EXTENSION";
2422                 break;
2423         case TLDAP_CONFIDENTIALITY_REQUIRED:
2424                 res = "TLDAP_CONFIDENTIALITY_REQUIRED";
2425                 break;
2426         case TLDAP_SASL_BIND_IN_PROGRESS:
2427                 res = "TLDAP_SASL_BIND_IN_PROGRESS";
2428                 break;
2429         case TLDAP_NO_SUCH_ATTRIBUTE:
2430                 res = "TLDAP_NO_SUCH_ATTRIBUTE";
2431                 break;
2432         case TLDAP_UNDEFINED_TYPE:
2433                 res = "TLDAP_UNDEFINED_TYPE";
2434                 break;
2435         case TLDAP_INAPPROPRIATE_MATCHING:
2436                 res = "TLDAP_INAPPROPRIATE_MATCHING";
2437                 break;
2438         case TLDAP_CONSTRAINT_VIOLATION:
2439                 res = "TLDAP_CONSTRAINT_VIOLATION";
2440                 break;
2441         case TLDAP_TYPE_OR_VALUE_EXISTS:
2442                 res = "TLDAP_TYPE_OR_VALUE_EXISTS";
2443                 break;
2444         case TLDAP_INVALID_SYNTAX:
2445                 res = "TLDAP_INVALID_SYNTAX";
2446                 break;
2447         case TLDAP_NO_SUCH_OBJECT:
2448                 res = "TLDAP_NO_SUCH_OBJECT";
2449                 break;
2450         case TLDAP_ALIAS_PROBLEM:
2451                 res = "TLDAP_ALIAS_PROBLEM";
2452                 break;
2453         case TLDAP_INVALID_DN_SYNTAX:
2454                 res = "TLDAP_INVALID_DN_SYNTAX";
2455                 break;
2456         case TLDAP_IS_LEAF:
2457                 res = "TLDAP_IS_LEAF";
2458                 break;
2459         case TLDAP_ALIAS_DEREF_PROBLEM:
2460                 res = "TLDAP_ALIAS_DEREF_PROBLEM";
2461                 break;
2462         case TLDAP_INAPPROPRIATE_AUTH:
2463                 res = "TLDAP_INAPPROPRIATE_AUTH";
2464                 break;
2465         case TLDAP_INVALID_CREDENTIALS:
2466                 res = "TLDAP_INVALID_CREDENTIALS";
2467                 break;
2468         case TLDAP_INSUFFICIENT_ACCESS:
2469                 res = "TLDAP_INSUFFICIENT_ACCESS";
2470                 break;
2471         case TLDAP_BUSY:
2472                 res = "TLDAP_BUSY";
2473                 break;
2474         case TLDAP_UNAVAILABLE:
2475                 res = "TLDAP_UNAVAILABLE";
2476                 break;
2477         case TLDAP_UNWILLING_TO_PERFORM:
2478                 res = "TLDAP_UNWILLING_TO_PERFORM";
2479                 break;
2480         case TLDAP_LOOP_DETECT:
2481                 res = "TLDAP_LOOP_DETECT";
2482                 break;
2483         case TLDAP_NAMING_VIOLATION:
2484                 res = "TLDAP_NAMING_VIOLATION";
2485                 break;
2486         case TLDAP_OBJECT_CLASS_VIOLATION:
2487                 res = "TLDAP_OBJECT_CLASS_VIOLATION";
2488                 break;
2489         case TLDAP_NOT_ALLOWED_ON_NONLEAF:
2490                 res = "TLDAP_NOT_ALLOWED_ON_NONLEAF";
2491                 break;
2492         case TLDAP_NOT_ALLOWED_ON_RDN:
2493                 res = "TLDAP_NOT_ALLOWED_ON_RDN";
2494                 break;
2495         case TLDAP_ALREADY_EXISTS:
2496                 res = "TLDAP_ALREADY_EXISTS";
2497                 break;
2498         case TLDAP_NO_OBJECT_CLASS_MODS:
2499                 res = "TLDAP_NO_OBJECT_CLASS_MODS";
2500                 break;
2501         case TLDAP_RESULTS_TOO_LARGE:
2502                 res = "TLDAP_RESULTS_TOO_LARGE";
2503                 break;
2504         case TLDAP_AFFECTS_MULTIPLE_DSAS:
2505                 res = "TLDAP_AFFECTS_MULTIPLE_DSAS";
2506                 break;
2507         case TLDAP_OTHER:
2508                 res = "TLDAP_OTHER";
2509                 break;
2510         case TLDAP_SERVER_DOWN:
2511                 res = "TLDAP_SERVER_DOWN";
2512                 break;
2513         case TLDAP_LOCAL_ERROR:
2514                 res = "TLDAP_LOCAL_ERROR";
2515                 break;
2516         case TLDAP_ENCODING_ERROR:
2517                 res = "TLDAP_ENCODING_ERROR";
2518                 break;
2519         case TLDAP_DECODING_ERROR:
2520                 res = "TLDAP_DECODING_ERROR";
2521                 break;
2522         case TLDAP_TIMEOUT:
2523                 res = "TLDAP_TIMEOUT";
2524                 break;
2525         case TLDAP_AUTH_UNKNOWN:
2526                 res = "TLDAP_AUTH_UNKNOWN";
2527                 break;
2528         case TLDAP_FILTER_ERROR:
2529                 res = "TLDAP_FILTER_ERROR";
2530                 break;
2531         case TLDAP_USER_CANCELLED:
2532                 res = "TLDAP_USER_CANCELLED";
2533                 break;
2534         case TLDAP_PARAM_ERROR:
2535                 res = "TLDAP_PARAM_ERROR";
2536                 break;
2537         case TLDAP_NO_MEMORY:
2538                 res = "TLDAP_NO_MEMORY";
2539                 break;
2540         case TLDAP_CONNECT_ERROR:
2541                 res = "TLDAP_CONNECT_ERROR";
2542                 break;
2543         case TLDAP_NOT_SUPPORTED:
2544                 res = "TLDAP_NOT_SUPPORTED";
2545                 break;
2546         case TLDAP_CONTROL_NOT_FOUND:
2547                 res = "TLDAP_CONTROL_NOT_FOUND";
2548                 break;
2549         case TLDAP_NO_RESULTS_RETURNED:
2550                 res = "TLDAP_NO_RESULTS_RETURNED";
2551                 break;
2552         case TLDAP_MORE_RESULTS_TO_RETURN:
2553                 res = "TLDAP_MORE_RESULTS_TO_RETURN";
2554                 break;
2555         case TLDAP_CLIENT_LOOP:
2556                 res = "TLDAP_CLIENT_LOOP";
2557                 break;
2558         case TLDAP_REFERRAL_LIMIT_EXCEEDED:
2559                 res = "TLDAP_REFERRAL_LIMIT_EXCEEDED";
2560                 break;
2561         default:
2562                 res = talloc_asprintf(talloc_tos(), "Unknown LDAP Error (%d)",
2563                                       rc);
2564                 break;
2565         }
2566         if (res == NULL) {
2567                 res = "Unknown LDAP Error";
2568         }
2569         return res;
2570 }