1 /*
2 Unix SMB/CIFS implementation.
3 LDAP server
4 Copyright (C) Stefan Metzmacher 2004
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "ldap_server/ldap_server.h"
22 #include "auth/auth.h"
23 #include "smbd/service.h"
24 #include <ldb.h>
25 #include <ldb_errors.h>
26 #include "../lib/util/dlinklist.h"
27 #include "dsdb/samdb/samdb.h"
28 #include "auth/gensec/gensec.h"
29 #include "auth/gensec/gensec_tstream.h"
30 #include "param/param.h"
31 #include "../lib/util/tevent_ntstatus.h"
32 #include "lib/util/time_basic.h"
33
34 static char *ldapsrv_bind_error_msg(TALLOC_CTX *mem_ctx,
35 HRESULT hresult,
36 uint32_t DSID,
map_ldb_error(TALLOC_CTX * mem_ctx,int ldb_err,const char * add_err_string,const char ** errstring)37 NTSTATUS status)
38 {
39 WERROR werr;
40 char *msg = NULL;
41
42 status = nt_status_squash(status);
43 werr = ntstatus_to_werror(status);
44
45 /*
46 * There are 4 lower case hex digits following 'v' at the end,
47 * but different Windows Versions return different values:
48 *
49 * Windows 2008R2 uses 'v1db1'
50 * Windows 2012R2 uses 'v2580'
51 *
52 * We just match Windows 2008R2 as that's what was referenced
53 * in https://bugzilla.samba.org/show_bug.cgi?id=9048
54 */
55 msg = talloc_asprintf(mem_ctx, "%08X: LdapErr: DSID-%08X, comment: "
56 "AcceptSecurityContext error, data %x, v1db1",
57 (unsigned)HRES_ERROR_V(hresult),
58 (unsigned)DSID,
59 (unsigned)W_ERROR_V(werr));
60
61 return msg;
62 }
63
64 struct ldapsrv_bind_wait_context {
65 struct ldapsrv_reply *reply;
66 struct tevent_req *req;
67 NTSTATUS status;
68 bool done;
69 };
70
71 struct ldapsrv_bind_wait_state {
72 uint8_t dummy;
73 };
74
75 static struct tevent_req *ldapsrv_bind_wait_send(TALLOC_CTX *mem_ctx,
76 struct tevent_context *ev,
77 void *private_data)
78 {
79 struct ldapsrv_bind_wait_context *bind_wait =
80 talloc_get_type_abort(private_data,
81 struct ldapsrv_bind_wait_context);
82 struct tevent_req *req;
83 struct ldapsrv_bind_wait_state *state;
84
85 req = tevent_req_create(mem_ctx, &state,
86 struct ldapsrv_bind_wait_state);
87 if (req == NULL) {
88 return NULL;
89 }
90 bind_wait->req = req;
91
92 tevent_req_defer_callback(req, ev);
93
94 if (!bind_wait->done) {
95 return req;
96 }
97
98 if (tevent_req_nterror(req, bind_wait->status)) {
99 return tevent_req_post(req, ev);
100 }
101
102 tevent_req_done(req);
103 return tevent_req_post(req, ev);
104 }
105
106 static NTSTATUS ldapsrv_bind_wait_recv(struct tevent_req *req)
107 {
108 return tevent_req_simple_recv_ntstatus(req);
109 }
110
111 static NTSTATUS ldapsrv_bind_wait_setup(struct ldapsrv_call *call,
112 struct ldapsrv_reply *reply)
113 {
114 struct ldapsrv_bind_wait_context *bind_wait = NULL;
115
116 if (call->wait_private != NULL) {
117 return NT_STATUS_INTERNAL_ERROR;
118 }
119
120 bind_wait = talloc_zero(call, struct ldapsrv_bind_wait_context);
121 if (bind_wait == NULL) {
122 return NT_STATUS_NO_MEMORY;
123 }
124 bind_wait->reply = reply;
125
126 call->wait_private = bind_wait;
127 call->wait_send = ldapsrv_bind_wait_send;
128 call->wait_recv = ldapsrv_bind_wait_recv;
129 return NT_STATUS_OK;
130 }
131
132 static void ldapsrv_bind_wait_finished(struct ldapsrv_call *call,
133 NTSTATUS status)
134 {
135 struct ldapsrv_bind_wait_context *bind_wait =
136 talloc_get_type_abort(call->wait_private,
137 struct ldapsrv_bind_wait_context);
138
139 bind_wait->done = true;
140 bind_wait->status = status;
141
142 if (bind_wait->req == NULL) {
143 return;
144 }
145
146 if (tevent_req_nterror(bind_wait->req, status)) {
147 return;
148 }
149
150 tevent_req_done(bind_wait->req);
151 }
152
153 static void ldapsrv_BindSimple_done(struct tevent_req *subreq);
154
155 static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
156 {
157 struct ldap_BindRequest *req = &call->request->r.BindRequest;
158 struct ldapsrv_reply *reply = NULL;
159 struct ldap_BindResponse *resp = NULL;
160 int result;
161 const char *errstr = NULL;
162 NTSTATUS status;
163 bool using_tls = call->conn->sockets.active == call->conn->sockets.tls;
164 struct tevent_req *subreq = NULL;
165
166 DEBUG(10, ("BindSimple dn: %s\n",req->dn));
167
168 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
169 if (!reply) {
170 return NT_STATUS_NO_MEMORY;
171 }
172
173 if (req->dn != NULL &&
174 strlen(req->dn) != 0 &&
175 call->conn->require_strong_auth > LDAP_SERVER_REQUIRE_STRONG_AUTH_NO &&
176 !using_tls)
177 {
178 status = NT_STATUS_NETWORK_ACCESS_DENIED;
179 result = LDAP_STRONG_AUTH_REQUIRED;
180 errstr = talloc_asprintf(reply,
181 "BindSimple: Transport encryption required.");
182 goto do_reply;
183 }
184
ldapsrv_backend_Init(struct ldapsrv_connection * conn,char ** errstring)185 subreq = authenticate_ldap_simple_bind_send(call,
186 call->conn->connection->event.ctx,
187 call->conn->connection->msg_ctx,
188 call->conn->lp_ctx,
189 call->conn->connection->remote_address,
190 call->conn->connection->local_address,
191 using_tls,
192 req->dn,
193 req->creds.password);
194 if (subreq == NULL) {
195 return NT_STATUS_NO_MEMORY;
196 }
197 tevent_req_set_callback(subreq, ldapsrv_BindSimple_done, call);
198
199 status = ldapsrv_bind_wait_setup(call, reply);
200 if (!NT_STATUS_IS_OK(status)) {
201 TALLOC_FREE(subreq);
202 return status;
203 }
204
205 /*
206 * The rest will be async.
207 */
208 return NT_STATUS_OK;
209
210 do_reply:
211 resp = &reply->msg->r.BindResponse;
212 resp->response.resultcode = result;
213 resp->response.errormessage = errstr;
214 resp->response.dn = NULL;
215 resp->response.referral = NULL;
216 resp->SASL.secblob = NULL;
217
218 ldapsrv_queue_reply(call, reply);
219 return NT_STATUS_OK;
220 }
221
222 static void ldapsrv_BindSimple_done(struct tevent_req *subreq)
223 {
224 struct ldapsrv_call *call =
225 tevent_req_callback_data(subreq,
226 struct ldapsrv_call);
227 struct ldapsrv_bind_wait_context *bind_wait =
228 talloc_get_type_abort(call->wait_private,
229 struct ldapsrv_bind_wait_context);
230 struct ldapsrv_reply *reply = bind_wait->reply;
231 struct auth_session_info *session_info = NULL;
232 NTSTATUS status;
233 struct ldap_BindResponse *resp = NULL;
234 int result;
235 const char *errstr = NULL;
236
237 status = authenticate_ldap_simple_bind_recv(subreq,
238 call,
239 &session_info);
ldapsrv_init_reply(struct ldapsrv_call * call,uint8_t type)240 if (NT_STATUS_IS_OK(status)) {
241 char *ldb_errstring = NULL;
242 result = LDAP_SUCCESS;
243 errstr = NULL;
244
245 talloc_unlink(call->conn, call->conn->session_info);
246 call->conn->session_info = talloc_steal(call->conn, session_info);
247
248 call->conn->authz_logged = true;
249
250 /* don't leak the old LDB */
251 talloc_unlink(call->conn, call->conn->ldb);
252
253 result = ldapsrv_backend_Init(call->conn, &ldb_errstring);
254
255 if (result != LDB_SUCCESS) {
256 /* Only put the detailed error in DEBUG() */
257 DBG_ERR("ldapsrv_backend_Init failed: %s: %s",
258 ldb_errstring, ldb_strerror(result));
259 errstr = talloc_strdup(reply,
260 "Simple Bind: Failed to advise "
261 "ldb new credentials");
262 result = LDB_ERR_OPERATIONS_ERROR;
263 }
264 } else {
265 status = nt_status_squash(status);
266
267 result = LDAP_INVALID_CREDENTIALS;
268 errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_INVALID_TOKEN,
269 0x0C0903A9, status);
270 }
271
272 resp = &reply->msg->r.BindResponse;
273 resp->response.resultcode = result;
274 resp->response.errormessage = errstr;
275 resp->response.dn = NULL;
276 resp->response.referral = NULL;
277 resp->SASL.secblob = NULL;
278
279 ldapsrv_queue_reply(call, reply);
280 ldapsrv_bind_wait_finished(call, NT_STATUS_OK);
281 }
282
283 struct ldapsrv_sasl_postprocess_context {
284 struct ldapsrv_connection *conn;
285 struct tstream_context *sasl;
286 };
287
288 struct ldapsrv_sasl_postprocess_state {
289 uint8_t dummy;
ldapsrv_queue_reply_forced(struct ldapsrv_call * call,struct ldapsrv_reply * reply)290 };
291
292 static struct tevent_req *ldapsrv_sasl_postprocess_send(TALLOC_CTX *mem_ctx,
293 struct tevent_context *ev,
294 void *private_data)
295 {
296 struct ldapsrv_sasl_postprocess_context *context =
297 talloc_get_type_abort(private_data,
298 struct ldapsrv_sasl_postprocess_context);
299 struct tevent_req *req;
300 struct ldapsrv_sasl_postprocess_state *state;
301
302 req = tevent_req_create(mem_ctx, &state,
303 struct ldapsrv_sasl_postprocess_state);
304 if (req == NULL) {
305 return NULL;
ldapsrv_queue_reply(struct ldapsrv_call * call,struct ldapsrv_reply * reply)306 }
307
308 TALLOC_FREE(context->conn->sockets.sasl);
309 context->conn->sockets.sasl = talloc_move(context->conn, &context->sasl);
310 context->conn->sockets.active = context->conn->sockets.sasl;
311
312 tevent_req_done(req);
313 return tevent_req_post(req, ev);
314 }
315
316 static NTSTATUS ldapsrv_sasl_postprocess_recv(struct tevent_req *req)
317 {
318 return tevent_req_simple_recv_ntstatus(req);
319 }
320
321 static NTSTATUS ldapsrv_setup_gensec(struct ldapsrv_connection *conn,
322 const char *sasl_mech,
323 struct gensec_security **_gensec_security)
324 {
325 NTSTATUS status;
326
327 struct gensec_security *gensec_security;
328
329 status = samba_server_gensec_start(conn,
ldapsrv_unwilling(struct ldapsrv_call * call,int error)330 conn->connection->event.ctx,
331 conn->connection->msg_ctx,
332 conn->lp_ctx,
333 conn->server_credentials,
334 "ldap",
335 &gensec_security);
336 if (!NT_STATUS_IS_OK(status)) {
337 return status;
338 }
339
340 status = gensec_set_target_service_description(gensec_security,
341 "LDAP");
342 if (!NT_STATUS_IS_OK(status)) {
343 return status;
344 }
345
346 status = gensec_set_remote_address(gensec_security,
347 conn->connection->remote_address);
348 if (!NT_STATUS_IS_OK(status)) {
349 return status;
350 }
351
352 status = gensec_set_local_address(gensec_security,
353 conn->connection->local_address);
ldapsrv_add_with_controls(struct ldapsrv_call * call,const struct ldb_message * message,struct ldb_control ** controls,struct ldb_result * res)354 if (!NT_STATUS_IS_OK(status)) {
355 return status;
356 }
357
358 gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES);
359 gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAP_STYLE);
360
361 if (conn->sockets.active == conn->sockets.tls) {
362 gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAPS_TRANSPORT);
363 }
364
365 status = gensec_start_mech_by_sasl_name(gensec_security, sasl_mech);
366
367 if (!NT_STATUS_IS_OK(status)) {
368 return status;
369 }
370
371 *_gensec_security = gensec_security;
372 return status;
373 }
374
375 static void ldapsrv_BindSASL_done(struct tevent_req *subreq);
376
377 static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
378 {
379 struct ldap_BindRequest *req = &call->request->r.BindRequest;
380 struct ldapsrv_reply *reply;
381 struct ldap_BindResponse *resp;
382 struct ldapsrv_connection *conn;
383 int result = 0;
384 const char *errstr=NULL;
385 NTSTATUS status = NT_STATUS_OK;
386 DATA_BLOB input = data_blob_null;
387 struct tevent_req *subreq = NULL;
388
389 DEBUG(10, ("BindSASL dn: %s\n",req->dn));
390
391 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
392 if (!reply) {
393 return NT_STATUS_NO_MEMORY;
394 }
395 resp = &reply->msg->r.BindResponse;
396 /* Windows 2000 mmc doesn't like secblob == NULL and reports a decoding error */
397 resp->SASL.secblob = talloc_zero(reply, DATA_BLOB);
398 if (resp->SASL.secblob == NULL) {
399 return NT_STATUS_NO_MEMORY;
400 }
401
402 conn = call->conn;
403
404 /*
405 * TODO: a SASL bind with a different mechanism
406 * should cancel an inprogress SASL bind.
407 * (see RFC 4513)
408 */
409
ldapsrv_mod_with_controls(struct ldapsrv_call * call,const struct ldb_message * message,struct ldb_control ** controls,struct ldb_result * res)410 if (!conn->gensec) {
411 status = ldapsrv_setup_gensec(conn, req->creds.SASL.mechanism,
412 &conn->gensec);
413 if (!NT_STATUS_IS_OK(status)) {
414 DEBUG(1, ("Failed to start GENSEC server for [%s] code: %s\n",
415 ldb_binary_encode_string(call, req->creds.SASL.mechanism),
416 nt_errstr(status)));
417 result = LDAP_OPERATIONS_ERROR;
418 errstr = talloc_asprintf(reply, "SASL: Failed to start authentication system: %s",
419 nt_errstr(status));
420 goto do_reply;
421 }
422 }
423
424 if (req->creds.SASL.secblob) {
425 input = *req->creds.SASL.secblob;
426 }
427
428 subreq = gensec_update_send(call, conn->connection->event.ctx,
429 conn->gensec, input);
430 if (subreq == NULL) {
431 return NT_STATUS_NO_MEMORY;
432 }
433 tevent_req_set_callback(subreq, ldapsrv_BindSASL_done, call);
434
435 status = ldapsrv_bind_wait_setup(call, reply);
436 if (!NT_STATUS_IS_OK(status)) {
437 TALLOC_FREE(subreq);
438 return status;
439 }
440
441 /*
442 * The rest will be async.
443 */
444 return NT_STATUS_OK;
445
446 do_reply:
447 if (result != LDAP_SASL_BIND_IN_PROGRESS) {
448 /*
449 * We should destroy the gensec context
450 * when we hit a fatal error.
451 *
452 * Note: conn->gensec is already cleared
453 * for the LDAP_SUCCESS case.
454 */
455 talloc_unlink(conn, conn->gensec);
456 conn->gensec = NULL;
457 }
458
459 resp->response.resultcode = result;
460 resp->response.dn = NULL;
461 resp->response.errormessage = errstr;
462 resp->response.referral = NULL;
463
464 ldapsrv_queue_reply(call, reply);
465 return NT_STATUS_OK;
466 }
467
ldapsrv_del_with_controls(struct ldapsrv_call * call,struct ldb_dn * dn,struct ldb_control ** controls,struct ldb_result * res)468 static void ldapsrv_BindSASL_done(struct tevent_req *subreq)
469 {
470 struct ldapsrv_call *call =
471 tevent_req_callback_data(subreq,
472 struct ldapsrv_call);
473 struct ldapsrv_bind_wait_context *bind_wait =
474 talloc_get_type_abort(call->wait_private,
475 struct ldapsrv_bind_wait_context);
476 struct ldap_BindRequest *req = &call->request->r.BindRequest;
477 struct ldapsrv_reply *reply = bind_wait->reply;
478 struct ldap_BindResponse *resp = &reply->msg->r.BindResponse;
479 struct ldapsrv_connection *conn = call->conn;
480 struct auth_session_info *session_info = NULL;
481 struct ldapsrv_sasl_postprocess_context *context = NULL;
482 NTSTATUS status;
483 int result;
484 const char *errstr = NULL;
485 char *ldb_errstring = NULL;
486 DATA_BLOB output = data_blob_null;
487 NTTIME expire_time_nt;
488
489 status = gensec_update_recv(subreq, call, &output);
490 TALLOC_FREE(subreq);
491
492 if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED, status)) {
493 *resp->SASL.secblob = output;
494 result = LDAP_SASL_BIND_IN_PROGRESS;
495 errstr = NULL;
496 goto do_reply;
497 }
498
499 if (!NT_STATUS_IS_OK(status)) {
500 status = nt_status_squash(status);
501 result = LDAP_INVALID_CREDENTIALS;
502 errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_LOGON_DENIED,
503 0x0C0904DC, status);
504 goto do_reply;
505 }
506
507 if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
508 gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
509
510 context = talloc_zero(call, struct ldapsrv_sasl_postprocess_context);
511 if (context == NULL) {
512 ldapsrv_bind_wait_finished(call, NT_STATUS_NO_MEMORY);
513 return;
514 }
515 }
516
517 if (context && conn->sockets.tls) {
518 TALLOC_FREE(context);
519 status = NT_STATUS_NOT_SUPPORTED;
520 result = LDAP_UNWILLING_TO_PERFORM;
521 errstr = talloc_asprintf(reply,
522 "SASL:[%s]: Sign or Seal are not allowed if TLS is used",
523 req->creds.SASL.mechanism);
524 goto do_reply;
525 }
526
527 if (context && conn->sockets.sasl) {
528 TALLOC_FREE(context);
529 status = NT_STATUS_NOT_SUPPORTED;
530 result = LDAP_UNWILLING_TO_PERFORM;
531 errstr = talloc_asprintf(reply,
532 "SASL:[%s]: Sign or Seal are not allowed if SASL encryption has already been set up",
533 req->creds.SASL.mechanism);
534 goto do_reply;
535 }
536
537 if (context == NULL) {
538 switch (call->conn->require_strong_auth) {
539 case LDAP_SERVER_REQUIRE_STRONG_AUTH_NO:
540 break;
541 case LDAP_SERVER_REQUIRE_STRONG_AUTH_ALLOW_SASL_OVER_TLS:
542 if (call->conn->sockets.active == call->conn->sockets.tls) {
543 break;
544 }
545 status = NT_STATUS_NETWORK_ACCESS_DENIED;
546 result = LDAP_STRONG_AUTH_REQUIRED;
547 errstr = talloc_asprintf(reply,
548 "SASL:[%s]: not allowed if TLS is used.",
549 req->creds.SASL.mechanism);
550 goto do_reply;
551
552 case LDAP_SERVER_REQUIRE_STRONG_AUTH_YES:
553 status = NT_STATUS_NETWORK_ACCESS_DENIED;
554 result = LDAP_STRONG_AUTH_REQUIRED;
555 errstr = talloc_asprintf(reply,
556 "SASL:[%s]: Sign or Seal are required.",
557 req->creds.SASL.mechanism);
558 goto do_reply;
559 }
560 }
561
562 if (context != NULL) {
563 context->conn = conn;
564 status = gensec_create_tstream(context,
565 context->conn->gensec,
566 context->conn->sockets.raw,
567 &context->sasl);
568 if (!NT_STATUS_IS_OK(status)) {
569 result = LDAP_OPERATIONS_ERROR;
570 errstr = talloc_asprintf(reply,
571 "SASL:[%s]: Failed to setup SASL socket: %s",
572 req->creds.SASL.mechanism, nt_errstr(status));
573 goto do_reply;
574 }
575 }
576
577 status = gensec_session_info(conn->gensec, call, &session_info);
578 if (!NT_STATUS_IS_OK(status)) {
579 result = LDAP_OPERATIONS_ERROR;
580 errstr = talloc_asprintf(reply,
581 "SASL:[%s]: Failed to get session info: %s",
582 req->creds.SASL.mechanism, nt_errstr(status));
583 goto do_reply;
584 }
585
586 talloc_unlink(conn, conn->session_info);
587 conn->session_info = talloc_steal(conn, session_info);
588
589 /* don't leak the old LDB */
590 talloc_unlink(conn, conn->ldb);
591
592 call->conn->authz_logged = true;
593
594 result = ldapsrv_backend_Init(call->conn, &ldb_errstring);
595
596 if (result != LDB_SUCCESS) {
597 /* Only put the detailed error in DEBUG() */
598 DBG_ERR("ldapsrv_backend_Init failed: %s: %s",
599 ldb_errstring, ldb_strerror(result));
600 errstr = talloc_strdup(reply,
601 "SASL Bind: Failed to advise "
602 "ldb new credentials");
603 result = LDB_ERR_OPERATIONS_ERROR;
604 goto do_reply;
605 }
606
607 expire_time_nt = gensec_expire_time(conn->gensec);
608 if (expire_time_nt != GENSEC_EXPIRE_TIME_INFINITY) {
609 struct timeval_buf buf;
610
611 nttime_to_timeval(&conn->limits.expire_time, expire_time_nt);
612
613 DBG_DEBUG("Setting connection expire_time to %s\n",
614 timeval_str_buf(&conn->limits.expire_time,
615 false,
616 true,
617 &buf));
618 }
619
620 if (context != NULL) {
621 const void *ptr = NULL;
622
623 ptr = talloc_reparent(conn, context->sasl, conn->gensec);
624 if (ptr == NULL) {
625 ldapsrv_bind_wait_finished(call, NT_STATUS_NO_MEMORY);
626 return;
627 }
628
629 call->postprocess_send = ldapsrv_sasl_postprocess_send;
630 call->postprocess_recv = ldapsrv_sasl_postprocess_recv;
631 call->postprocess_private = context;
632 } else {
633 talloc_unlink(conn, conn->gensec);
634 }
635 conn->gensec = NULL;
636
637 *resp->SASL.secblob = output;
638 result = LDAP_SUCCESS;
639 errstr = NULL;
640
641 do_reply:
642 if (result != LDAP_SASL_BIND_IN_PROGRESS) {
643 /*
644 * We should destroy the gensec context
645 * when we hit a fatal error.
646 *
647 * Note: conn->gensec is already cleared
648 * for the LDAP_SUCCESS case.
649 */
650 talloc_unlink(conn, conn->gensec);
651 conn->gensec = NULL;
652 }
653
654 resp->response.resultcode = result;
655 resp->response.dn = NULL;
656 resp->response.errormessage = errstr;
657 resp->response.referral = NULL;
658
659 ldapsrv_queue_reply(call, reply);
660 ldapsrv_bind_wait_finished(call, NT_STATUS_OK);
661 }
662
663 NTSTATUS ldapsrv_BindRequest(struct ldapsrv_call *call)
664 {
665 struct ldap_BindRequest *req = &call->request->r.BindRequest;
666 struct ldapsrv_reply *reply;
667 struct ldap_BindResponse *resp;
668
669 if (call->conn->pending_calls != NULL) {
670 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
671 if (!reply) {
672 return NT_STATUS_NO_MEMORY;
673 }
674
675 resp = &reply->msg->r.BindResponse;
676 resp->response.resultcode = LDAP_BUSY;
677 resp->response.dn = NULL;
678 resp->response.errormessage = talloc_asprintf(reply, "Pending requests on this LDAP session");
679 resp->response.referral = NULL;
680 resp->SASL.secblob = NULL;
681
682 ldapsrv_queue_reply(call, reply);
683 return NT_STATUS_OK;
684 }
685
686 /*
687 * TODO: a simple bind should cancel an
688 * inprogress SASL bind.
689 * (see RFC 4513)
690 */
691 switch (req->mechanism) {
692 case LDAP_AUTH_MECH_SIMPLE:
693 return ldapsrv_BindSimple(call);
694 case LDAP_AUTH_MECH_SASL:
695 return ldapsrv_BindSASL(call);
696 }
697
698 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
699 if (!reply) {
700 return NT_STATUS_NO_MEMORY;
701 }
702
703 resp = &reply->msg->r.BindResponse;
704 resp->response.resultcode = LDAP_AUTH_METHOD_NOT_SUPPORTED;
705 resp->response.dn = NULL;
706 resp->response.errormessage = talloc_asprintf(reply, "Bad AuthenticationChoice [%d]", req->mechanism);
707 resp->response.referral = NULL;
708 resp->SASL.secblob = NULL;
709
710 ldapsrv_queue_reply(call, reply);
711 return NT_STATUS_OK;
ldapsrv_SearchRequest(struct ldapsrv_call * call)712 }
713
714 struct ldapsrv_unbind_wait_context {
715 uint8_t dummy;
716 };
717
718 struct ldapsrv_unbind_wait_state {
719 uint8_t dummy;
720 };
721
722 static struct tevent_req *ldapsrv_unbind_wait_send(TALLOC_CTX *mem_ctx,
723 struct tevent_context *ev,
724 void *private_data)
725 {
726 struct ldapsrv_unbind_wait_context *unbind_wait =
727 talloc_get_type_abort(private_data,
728 struct ldapsrv_unbind_wait_context);
729 struct tevent_req *req;
730 struct ldapsrv_unbind_wait_state *state;
731
732 req = tevent_req_create(mem_ctx, &state,
733 struct ldapsrv_unbind_wait_state);
734 if (req == NULL) {
735 return NULL;
736 }
737
738 (void)unbind_wait;
739
740 tevent_req_nterror(req, NT_STATUS_LOCAL_DISCONNECT);
741 return tevent_req_post(req, ev);
742 }
743
744 static NTSTATUS ldapsrv_unbind_wait_recv(struct tevent_req *req)
745 {
746 return tevent_req_simple_recv_ntstatus(req);
747 }
748
749 static NTSTATUS ldapsrv_unbind_wait_setup(struct ldapsrv_call *call)
750 {
751 struct ldapsrv_unbind_wait_context *unbind_wait = NULL;
752
753 if (call->wait_private != NULL) {
754 return NT_STATUS_INTERNAL_ERROR;
755 }
756
757 unbind_wait = talloc_zero(call, struct ldapsrv_unbind_wait_context);
758 if (unbind_wait == NULL) {
759 return NT_STATUS_NO_MEMORY;
760 }
761
762 call->wait_private = unbind_wait;
763 call->wait_send = ldapsrv_unbind_wait_send;
764 call->wait_recv = ldapsrv_unbind_wait_recv;
765 return NT_STATUS_OK;
766 }
767
768 NTSTATUS ldapsrv_UnbindRequest(struct ldapsrv_call *call)
769 {
770 struct ldapsrv_call *c = NULL;
771 struct ldapsrv_call *n = NULL;
772
773 DEBUG(10, ("UnbindRequest\n"));
774
775 for (c = call->conn->pending_calls; c != NULL; c = n) {
776 n = c->next;
777
778 DLIST_REMOVE(call->conn->pending_calls, c);
779 TALLOC_FREE(c);
780 }
781
782 return ldapsrv_unbind_wait_setup(call);
783 }
784