s4-ldb: added ldb_req_mark_untrusted() and ldb_req_is_untrusted()

these will be used to determine if a ldb request comes from an
untrusted source. We want requests over ldap:// to be marked untrusted
so we can reject unregistered controls

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>

diff --git a/source4/lib/ldb/common/ldb.c b/source4/lib/ldb/common/ldb.c
index 922237482f74b6fb6ca751fc47f5efad0e65cdd4..33d6c48cbe49c930af5dc0a1925a753a5a2880a4 100644 (file)
--- a/source4/lib/ldb/common/ldb.c
+++ b/source4/lib/ldb/common/ldb.c
@@ -1810,3 +1810,20 @@ const char *ldb_req_location(struct ldb_request *req)
 {
        return req->handle->location;
 }
+
+/**
+  mark a request as untrusted. This tells the rootdse module to remove
+  unregistered controls
+ */
+void ldb_req_mark_untrusted(struct ldb_request *req)
+{
+       req->handle->flags |= LDB_HANDLE_FLAG_UNTRUSTED;
+}
+
+/**
+   return true is a request is untrusted
+ */
+bool ldb_req_is_untrusted(struct ldb_request *req)
+{
+       return (req->handle->flags & LDB_HANDLE_FLAG_UNTRUSTED) != 0;
+}

diff --git a/source4/lib/ldb/include/ldb_module.h b/source4/lib/ldb/include/ldb_module.h
index a708063ed85714dd49e0fe83a2794b27637aef94..c1d668222fa9bd65e9a9af7c8cf62d35ac85e779 100644 (file)
--- a/source4/lib/ldb/include/ldb_module.h
+++ b/source4/lib/ldb/include/ldb_module.h
@@ -216,4 +216,15 @@ void ldb_set_default_dns(struct ldb_context *ldb);
 */
 int ldb_reply_add_control(struct ldb_reply *ares, const char *oid, bool critical, void *data);
 
+/**
+  mark a request as untrusted. This tells the rootdse module to remove
+  unregistered controls
+ */
+void ldb_req_mark_untrusted(struct ldb_request *req);
+
+/**
+   return true is a request is untrusted
+ */
+bool ldb_req_is_untrusted(struct ldb_request *req);
+
 #endif

diff --git a/source4/lib/ldb/include/ldb_private.h b/source4/lib/ldb/include/ldb_private.h
index c8efb6bbc536d8a778075d0556d1a55b5f0d1e47..ef8cd25030202c443653a9f50d9b00e9fba135de 100644 (file)
--- a/source4/lib/ldb/include/ldb_private.h
+++ b/source4/lib/ldb/include/ldb_private.h
@@ -48,6 +48,8 @@ struct ldb_module_ops;
 struct ldb_backend_ops;
 
 #define LDB_HANDLE_FLAG_DONE_CALLED 1
+/* call is from an untrusted source - eg. over ldap:// */
+#define LDB_HANDLE_FLAG_UNTRUSTED   2
 
 struct ldb_handle {
        int status;