2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Tridgell 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 see RFC1798 for details of CLDAP
27 - carried over UDP on port 389
28 - request and response matched by message ID
29 - request consists of only a single searchRequest element
30 - response can be in one of two forms
31 - a single searchResponse, followed by a searchResult
32 - a single searchResult
36 #include "lib/events/events.h"
37 #include "lib/util/dlinklist.h"
38 #include "libcli/ldap/ldap.h"
39 #include "libcli/cldap/cldap.h"
40 #include "lib/socket/socket.h"
41 #include "libcli/security/security.h"
42 #include "librpc/gen_ndr/ndr_nbt.h"
45 destroy a pending request
47 static int cldap_request_destructor(struct cldap_request *req)
49 if (req->state == CLDAP_REQUEST_SEND) {
50 DLIST_REMOVE(req->cldap->send_queue, req);
52 if (!req->is_reply && req->message_id != 0) {
53 idr_remove(req->cldap->idr, req->message_id);
60 handle recv events on a cldap socket
62 static void cldap_socket_recv(struct cldap_socket *cldap)
64 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
66 struct socket_address *src;
69 struct asn1_data *asn1 = asn1_init(tmp_ctx);
70 struct ldap_message *ldap_msg;
71 struct cldap_request *req;
75 status = socket_pending(cldap->sock, &dsize);
76 if (!NT_STATUS_IS_OK(status)) {
81 blob = data_blob_talloc(tmp_ctx, NULL, dsize);
82 if (blob.data == NULL) {
87 status = socket_recvfrom(cldap->sock, blob.data, blob.length, &nread,
89 if (!NT_STATUS_IS_OK(status)) {
95 DEBUG(2,("Received cldap packet of length %d from %s:%d\n",
96 (int)blob.length, src->addr, src->port));
98 if (!asn1_load(asn1, blob)) {
99 DEBUG(2,("Failed to setup for asn.1 decode\n"));
100 talloc_free(tmp_ctx);
104 ldap_msg = talloc(tmp_ctx, struct ldap_message);
105 if (ldap_msg == NULL) {
106 talloc_free(tmp_ctx);
110 /* this initial decode is used to find the message id */
111 status = ldap_decode(asn1, ldap_msg);
112 if (!NT_STATUS_IS_OK(status)) {
113 DEBUG(2,("Failed to decode ldap message: %s\n", nt_errstr(status)));
114 talloc_free(tmp_ctx);
118 /* find the pending request */
119 req = idr_find(cldap->idr, ldap_msg->messageid);
121 if (cldap->incoming.handler) {
122 cldap->incoming.handler(cldap, ldap_msg, src);
124 DEBUG(2,("Mismatched cldap reply %u from %s:%d\n",
125 ldap_msg->messageid, src->addr, src->port));
127 talloc_free(tmp_ctx);
131 req->asn1 = talloc_steal(req, asn1);
134 req->state = CLDAP_REQUEST_DONE;
135 talloc_free(req->te);
137 talloc_free(tmp_ctx);
145 handle request timeouts
147 static void cldap_request_timeout(struct event_context *event_ctx,
148 struct timed_event *te, struct timeval t,
151 struct cldap_request *req = talloc_get_type(private, struct cldap_request);
153 /* possibly try again */
154 if (req->num_retries != 0) {
155 size_t len = req->encoded.length;
159 socket_sendto(req->cldap->sock, &req->encoded, &len,
162 req->te = event_add_timed(req->cldap->event_ctx, req,
163 timeval_current_ofs(req->timeout, 0),
164 cldap_request_timeout, req);
168 req->state = CLDAP_REQUEST_ERROR;
169 req->status = NT_STATUS_IO_TIMEOUT;
176 handle send events on a cldap socket
178 static void cldap_socket_send(struct cldap_socket *cldap)
180 struct cldap_request *req;
183 while ((req = cldap->send_queue)) {
186 len = req->encoded.length;
187 status = socket_sendto(cldap->sock, &req->encoded, &len,
189 if (NT_STATUS_IS_ERR(status)) {
190 DEBUG(0,("Failed to send cldap request of length %u to %s:%d\n",
191 (unsigned)req->encoded.length, req->dest->addr, req->dest->port));
192 DLIST_REMOVE(cldap->send_queue, req);
193 req->state = CLDAP_REQUEST_ERROR;
194 req->status = status;
201 if (!NT_STATUS_IS_OK(status)) return;
203 DLIST_REMOVE(cldap->send_queue, req);
208 req->state = CLDAP_REQUEST_WAIT;
210 req->te = event_add_timed(cldap->event_ctx, req,
211 timeval_current_ofs(req->timeout, 0),
212 cldap_request_timeout, req);
214 EVENT_FD_READABLE(cldap->fde);
218 EVENT_FD_NOT_WRITEABLE(cldap->fde);
224 handle fd events on a cldap_socket
226 static void cldap_socket_handler(struct event_context *ev, struct fd_event *fde,
227 uint16_t flags, void *private)
229 struct cldap_socket *cldap = talloc_get_type(private, struct cldap_socket);
230 if (flags & EVENT_FD_WRITE) {
231 cldap_socket_send(cldap);
233 if (flags & EVENT_FD_READ) {
234 cldap_socket_recv(cldap);
239 initialise a cldap_socket. The event_ctx is optional, if provided
240 then operations will use that event context
242 struct cldap_socket *cldap_socket_init(TALLOC_CTX *mem_ctx,
243 struct event_context *event_ctx)
245 struct cldap_socket *cldap;
248 cldap = talloc(mem_ctx, struct cldap_socket);
249 if (cldap == NULL) goto failed;
251 if (event_ctx == NULL) {
252 cldap->event_ctx = event_context_init(cldap);
254 cldap->event_ctx = talloc_reference(cldap, event_ctx);
256 if (cldap->event_ctx == NULL) goto failed;
258 cldap->idr = idr_init(cldap);
259 if (cldap->idr == NULL) goto failed;
261 status = socket_create("ip", SOCKET_TYPE_DGRAM, &cldap->sock, 0);
262 if (!NT_STATUS_IS_OK(status)) goto failed;
264 talloc_steal(cldap, cldap->sock);
266 cldap->fde = event_add_fd(cldap->event_ctx, cldap,
267 socket_get_fd(cldap->sock), 0,
268 cldap_socket_handler, cldap);
270 cldap->send_queue = NULL;
271 cldap->incoming.handler = NULL;
282 setup a handler for incoming requests
284 NTSTATUS cldap_set_incoming_handler(struct cldap_socket *cldap,
285 void (*handler)(struct cldap_socket *, struct ldap_message *,
286 struct socket_address *),
289 cldap->incoming.handler = handler;
290 cldap->incoming.private = private;
291 EVENT_FD_READABLE(cldap->fde);
296 queue a cldap request for send
298 struct cldap_request *cldap_search_send(struct cldap_socket *cldap,
299 struct cldap_search *io)
301 struct ldap_message *msg;
302 struct cldap_request *req;
303 struct ldap_SearchRequest *search;
305 req = talloc_zero(cldap, struct cldap_request);
306 if (req == NULL) goto failed;
309 req->state = CLDAP_REQUEST_SEND;
310 req->timeout = io->in.timeout;
311 req->num_retries = io->in.retries;
312 req->is_reply = False;
313 req->asn1 = asn1_init(req);
318 req->dest = socket_address_from_strings(req, cldap->sock->backend_name,
319 io->in.dest_address, lp_cldap_port());
320 if (!req->dest) goto failed;
322 req->message_id = idr_get_new_random(cldap->idr, req, UINT16_MAX);
323 if (req->message_id == -1) goto failed;
325 talloc_set_destructor(req, cldap_request_destructor);
327 msg = talloc(req, struct ldap_message);
328 if (msg == NULL) goto failed;
329 msg->messageid = req->message_id;
330 msg->type = LDAP_TAG_SearchRequest;
331 msg->controls = NULL;
332 search = &msg->r.SearchRequest;
335 search->scope = LDAP_SEARCH_SCOPE_BASE;
336 search->deref = LDAP_DEREFERENCE_NEVER;
337 search->timelimit = 0;
338 search->sizelimit = 0;
339 search->attributesonly = False;
340 search->num_attributes = str_list_length(io->in.attributes);
341 search->attributes = io->in.attributes;
342 search->tree = ldb_parse_tree(req, io->in.filter);
343 if (search->tree == NULL) {
347 if (!ldap_encode(msg, &req->encoded, req)) {
348 DEBUG(0,("Failed to encode cldap message to %s:%d\n",
349 req->dest->addr, req->dest->port));
353 DLIST_ADD_END(cldap->send_queue, req, struct cldap_request *);
355 EVENT_FD_WRITEABLE(cldap->fde);
366 queue a cldap reply for send
368 NTSTATUS cldap_reply_send(struct cldap_socket *cldap, struct cldap_reply *io)
370 struct ldap_message *msg;
371 struct cldap_request *req;
372 DATA_BLOB blob1, blob2;
373 NTSTATUS status = NT_STATUS_NO_MEMORY;
375 req = talloc_zero(cldap, struct cldap_request);
376 if (req == NULL) goto failed;
379 req->state = CLDAP_REQUEST_SEND;
380 req->is_reply = True;
381 req->asn1 = asn1_init(req);
386 req->dest = io->dest;
387 if (talloc_reference(req, io->dest) == NULL) goto failed;
389 talloc_set_destructor(req, cldap_request_destructor);
391 msg = talloc(req, struct ldap_message);
392 if (msg == NULL) goto failed;
393 msg->messageid = io->messageid;
394 msg->controls = NULL;
397 msg->type = LDAP_TAG_SearchResultEntry;
398 msg->r.SearchResultEntry = *io->response;
400 if (!ldap_encode(msg, &blob1, req)) {
401 DEBUG(0,("Failed to encode cldap message to %s:%d\n",
402 req->dest->addr, req->dest->port));
403 status = NT_STATUS_INVALID_PARAMETER;
407 blob1 = data_blob(NULL, 0);
410 msg->type = LDAP_TAG_SearchResultDone;
411 msg->r.SearchResultDone = *io->result;
413 if (!ldap_encode(msg, &blob2, req)) {
414 DEBUG(0,("Failed to encode cldap message to %s:%d\n",
415 req->dest->addr, req->dest->port));
416 status = NT_STATUS_INVALID_PARAMETER;
420 req->encoded = data_blob_talloc(req, NULL, blob1.length + blob2.length);
421 if (req->encoded.data == NULL) goto failed;
423 memcpy(req->encoded.data, blob1.data, blob1.length);
424 memcpy(req->encoded.data+blob1.length, blob2.data, blob2.length);
426 DLIST_ADD_END(cldap->send_queue, req, struct cldap_request *);
428 EVENT_FD_WRITEABLE(cldap->fde);
438 receive a cldap reply
440 NTSTATUS cldap_search_recv(struct cldap_request *req,
442 struct cldap_search *io)
444 struct ldap_message *ldap_msg;
448 return NT_STATUS_NO_MEMORY;
451 while (req->state < CLDAP_REQUEST_DONE) {
452 if (event_loop_once(req->cldap->event_ctx) != 0) {
454 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
458 if (req->state == CLDAP_REQUEST_ERROR) {
459 status = req->status;
464 ldap_msg = talloc(mem_ctx, struct ldap_message);
465 NT_STATUS_HAVE_NO_MEMORY(ldap_msg);
467 status = ldap_decode(req->asn1, ldap_msg);
468 if (!NT_STATUS_IS_OK(status)) {
469 DEBUG(2,("Failed to decode cldap search reply: %s\n", nt_errstr(status)));
474 ZERO_STRUCT(io->out);
476 /* the first possible form has a search result in first place */
477 if (ldap_msg->type == LDAP_TAG_SearchResultEntry) {
478 io->out.response = talloc(mem_ctx, struct ldap_SearchResEntry);
479 NT_STATUS_HAVE_NO_MEMORY(io->out.response);
480 *io->out.response = ldap_msg->r.SearchResultEntry;
482 /* decode the 2nd part */
483 status = ldap_decode(req->asn1, ldap_msg);
484 if (!NT_STATUS_IS_OK(status)) {
485 DEBUG(2,("Failed to decode cldap search result entry: %s\n", nt_errstr(status)));
491 if (ldap_msg->type != LDAP_TAG_SearchResultDone) {
493 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
496 io->out.result = talloc(mem_ctx, struct ldap_Result);
497 NT_STATUS_HAVE_NO_MEMORY(io->out.result);
498 *io->out.result = ldap_msg->r.SearchResultDone;
502 if (io->out.result->resultcode != LDAP_SUCCESS) {
503 return NT_STATUS_LDAP(io->out.result->resultcode);
510 synchronous cldap search
512 NTSTATUS cldap_search(struct cldap_socket *cldap,
514 struct cldap_search *io)
516 struct cldap_request *req = cldap_search_send(cldap, io);
517 return cldap_search_recv(req, mem_ctx, io);
523 queue a cldap netlogon for send
525 struct cldap_request *cldap_netlogon_send(struct cldap_socket *cldap,
526 struct cldap_netlogon *io)
528 struct cldap_search search;
530 struct cldap_request *req;
531 const char *attr[] = { "NetLogon", NULL };
532 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
534 filter = talloc_asprintf(tmp_ctx, "(&(NtVer=%s)",
535 ldap_encode_ndr_uint32(tmp_ctx, io->in.version));
536 if (filter == NULL) goto failed;
538 filter = talloc_asprintf_append(filter, "(User=%s)", io->in.user);
539 if (filter == NULL) goto failed;
542 filter = talloc_asprintf_append(filter, "(Host=%s)", io->in.host);
543 if (filter == NULL) goto failed;
546 filter = talloc_asprintf_append(filter, "(DnsDomain=%s)", io->in.realm);
547 if (filter == NULL) goto failed;
549 if (io->in.acct_control != -1) {
550 filter = talloc_asprintf_append(filter, "(AAC=%s)",
551 ldap_encode_ndr_uint32(tmp_ctx, io->in.acct_control));
552 if (filter == NULL) goto failed;
554 if (io->in.domain_sid) {
555 struct dom_sid *sid = dom_sid_parse_talloc(tmp_ctx, io->in.domain_sid);
556 if (sid == NULL) goto failed;
557 filter = talloc_asprintf_append(filter, "(domainSid=%s)",
558 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
559 if (filter == NULL) goto failed;
561 if (io->in.domain_guid) {
564 status = GUID_from_string(io->in.domain_guid, &guid);
565 if (!NT_STATUS_IS_OK(status)) goto failed;
566 filter = talloc_asprintf_append(filter, "(DomainGuid=%s)",
567 ldap_encode_ndr_GUID(tmp_ctx, &guid));
568 if (filter == NULL) goto failed;
570 filter = talloc_asprintf_append(filter, ")");
571 if (filter == NULL) goto failed;
573 search.in.dest_address = io->in.dest_address;
574 search.in.filter = filter;
575 search.in.attributes = attr;
576 search.in.timeout = 2;
577 search.in.retries = 2;
579 req = cldap_search_send(cldap, &search);
581 talloc_free(tmp_ctx);
584 talloc_free(tmp_ctx);
590 receive a cldap netlogon reply
592 NTSTATUS cldap_netlogon_recv(struct cldap_request *req,
594 struct cldap_netlogon *io)
597 struct cldap_search search;
600 status = cldap_search_recv(req, mem_ctx, &search);
601 if (!NT_STATUS_IS_OK(status)) {
604 if (search.out.response == NULL) {
605 return NT_STATUS_NOT_FOUND;
608 if (search.out.response->num_attributes != 1 ||
609 strcasecmp(search.out.response->attributes[0].name, "netlogon") != 0 ||
610 search.out.response->attributes[0].num_values != 1 ||
611 search.out.response->attributes[0].values->length < 2) {
612 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
614 data = search.out.response->attributes[0].values;
616 status = ndr_pull_union_blob(data, mem_ctx, &io->out.netlogon,
617 io->in.version & 0xF,
618 (ndr_pull_flags_fn_t)ndr_pull_nbt_cldap_netlogon);
619 if (!NT_STATUS_IS_OK(status)) {
620 DEBUG(2,("cldap failed to parse netlogon response of type 0x%02x\n",
621 SVAL(data->data, 0)));
622 dump_data(10, data->data, data->length);
629 sync cldap netlogon search
631 NTSTATUS cldap_netlogon(struct cldap_socket *cldap,
632 TALLOC_CTX *mem_ctx, struct cldap_netlogon *io)
634 struct cldap_request *req = cldap_netlogon_send(cldap, io);
635 return cldap_netlogon_recv(req, mem_ctx, io);
640 send an empty reply (used on any error, so the client doesn't keep waiting
641 or send the bad request again)
643 NTSTATUS cldap_empty_reply(struct cldap_socket *cldap,
645 struct socket_address *src)
648 struct cldap_reply reply;
649 struct ldap_Result result;
651 reply.messageid = message_id;
653 reply.response = NULL;
654 reply.result = &result;
658 status = cldap_reply_send(cldap, &reply);
664 send an error reply (used on any error, so the client doesn't keep waiting
665 or send the bad request again)
667 NTSTATUS cldap_error_reply(struct cldap_socket *cldap,
669 struct socket_address *src,
671 const char *errormessage)
674 struct cldap_reply reply;
675 struct ldap_Result result;
677 reply.messageid = message_id;
679 reply.response = NULL;
680 reply.result = &result;
683 result.resultcode = resultcode;
684 result.errormessage = errormessage;
686 status = cldap_reply_send(cldap, &reply);
693 send a netlogon reply
695 NTSTATUS cldap_netlogon_reply(struct cldap_socket *cldap,
697 struct socket_address *src,
699 union nbt_cldap_netlogon *netlogon)
702 struct cldap_reply reply;
703 struct ldap_SearchResEntry response;
704 struct ldap_Result result;
705 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
708 status = ndr_push_union_blob(&blob, tmp_ctx, netlogon, version & 0xF,
709 (ndr_push_flags_fn_t)ndr_push_nbt_cldap_netlogon);
710 if (!NT_STATUS_IS_OK(status)) {
711 talloc_free(tmp_ctx);
715 reply.messageid = message_id;
717 reply.response = &response;
718 reply.result = &result;
723 response.num_attributes = 1;
724 response.attributes = talloc(tmp_ctx, struct ldb_message_element);
725 NT_STATUS_HAVE_NO_MEMORY(response.attributes);
726 response.attributes->name = "netlogon";
727 response.attributes->num_values = 1;
728 response.attributes->values = &blob;
730 status = cldap_reply_send(cldap, &reply);
732 talloc_free(tmp_ctx);