source3/lib/tldap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Infrastructure for async ldap client requests
   4    Copyright (C) Volker Lendecke 2009
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "replace.h"
  21 #include "tldap.h"
  22 #include "system/network.h"
  23 #include "system/locale.h"
  24 #include "lib/util/talloc_stack.h"
  25 #include "lib/util/samba_util.h"
  26 #include "lib/util_tsock.h"
  27 #include "../lib/util/asn1.h"
  28 #include "../lib/tsocket/tsocket.h"
  29 #include "../lib/util/tevent_unix.h"
  30 #include "../libcli/util/ntstatus.h"
  31 #include "../source4/lib/tls/tls.h"
  32
  33 static TLDAPRC tldap_simple_recv(struct tevent_req *req);
  34 static bool tldap_msg_set_pending(struct tevent_req *req);
  35
  36 #define TEVENT_TLDAP_RC_MAGIC (0x87bcd26e)
  37
  38 bool tevent_req_ldap_error(struct tevent_req *req, TLDAPRC rc)
  39 {
  40         uint64_t err;
  41
  42         if (TLDAP_RC_IS_SUCCESS(rc)) {
  43                 return false;
  44         }
  45
  46         err = TEVENT_TLDAP_RC_MAGIC;
  47         err <<= 32;
  48         err |= TLDAP_RC_V(rc);
  49
  50         return tevent_req_error(req, err);
  51 }
  52
  53 bool tevent_req_is_ldap_error(struct tevent_req *req, TLDAPRC *perr)
  54 {
  55         enum tevent_req_state state;
  56         uint64_t err;
  57
  58         if (!tevent_req_is_error(req, &state, &err)) {
  59                 return false;
  60         }
  61         switch (state) {
  62         case TEVENT_REQ_TIMED_OUT:
  63                 *perr = TLDAP_TIMEOUT;
  64                 break;
  65         case TEVENT_REQ_NO_MEMORY:
  66                 *perr = TLDAP_NO_MEMORY;
  67                 break;
  68         case TEVENT_REQ_USER_ERROR:
  69                 if ((err >> 32) != TEVENT_TLDAP_RC_MAGIC) {
  70                         abort();
  71                 }
  72                 *perr = TLDAP_RC(err & 0xffffffff);
  73                 break;
  74         default:
  75                 *perr = TLDAP_OPERATIONS_ERROR;
  76                 break;
  77         }
  78         return true;
  79 }
  80
  81 struct tldap_ctx_attribute {
  82         char *name;
  83         void *ptr;
  84 };
  85
  86 struct tldap_context {
  87         int ld_version;
  88         struct tstream_context *plain;
  89         bool starttls_needed;
  90         struct tstream_context *tls;
  91         struct tstream_context *gensec;
  92         struct tstream_context *active;
  93         int msgid;
  94         struct tevent_queue *outgoing;
  95         struct tevent_req **pending;
  96         struct tevent_req *read_req;
  97
  98         /* For the sync wrappers we need something like get_last_error... */
  99         struct tldap_message *last_msg;
 100
 101         /* debug */
 102         void (*log_fn)(void *context, enum tldap_debug_level level,
 103                        const char *fmt, va_list ap);
 104         void *log_private;
 105
 106         struct tldap_ctx_attribute *ctx_attrs;
 107 };
 108
 109 struct tldap_message {
 110         struct asn1_data *data;
 111         uint8_t *inbuf;
 112         int type;
 113         int id;
 114
 115         /* RESULT_ENTRY */
 116         char *dn;
 117         struct tldap_attribute *attribs;
 118
 119         /* Error data sent by the server */
 120         TLDAPRC lderr;
 121         char *res_matcheddn;
 122         char *res_diagnosticmessage;
 123         char *res_referral;
 124         DATA_BLOB res_serverSaslCreds;
 125         struct {
 126                 char *oid;
 127                 DATA_BLOB blob;
 128         } res_extended;
 129         struct tldap_control *res_sctrls;
 130
 131         /* Controls sent by the server */
 132         struct tldap_control *ctrls;
 133 };
 134
 135 void tldap_set_debug(struct tldap_context *ld,
 136                      void (*log_fn)(void *log_private,
 137                                     enum tldap_debug_level level,
 138                                     const char *fmt,
 139                                     va_list ap) PRINTF_ATTRIBUTE(3,0),
 140                      void *log_private)
 141 {
 142         ld->log_fn = log_fn;
 143         ld->log_private = log_private;
 144 }
 145
 146 static void tldap_debug(
 147         struct tldap_context *ld,
 148         enum tldap_debug_level level,
 149         const char *fmt, ...) PRINTF_ATTRIBUTE(3,4);
 150
 151 static void tldap_debug(struct tldap_context *ld,
 152                          enum tldap_debug_level level,
 153                          const char *fmt, ...)
 154 {
 155         va_list ap;
 156         if (!ld) {
 157                 return;
 158         }
 159         if (ld->log_fn == NULL) {
 160                 return;
 161         }
 162         va_start(ap, fmt);
 163         ld->log_fn(ld->log_private, level, fmt, ap);
 164         va_end(ap);
 165 }
 166
 167 static int tldap_next_msgid(struct tldap_context *ld)
 168 {
 169         int result;
 170
 171         result = ld->msgid++;
 172         if (ld->msgid == INT_MAX) {
 173                 ld->msgid = 1;
 174         }
 175         return result;
 176 }
 177
 178 struct tldap_context *tldap_context_create(TALLOC_CTX *mem_ctx, int fd)
 179 {
 180         struct tldap_context *ctx;
 181         int ret;
 182
 183         ctx = talloc_zero(mem_ctx, struct tldap_context);
 184         if (ctx == NULL) {
 185                 return NULL;
 186         }
 187         ret = tstream_bsd_existing_socket(ctx, fd, &ctx->plain);
 188         if (ret == -1) {
 189                 TALLOC_FREE(ctx);
 190                 return NULL;
 191         }
 192         ctx->active = ctx->plain;
 193         ctx->msgid = 1;
 194         ctx->ld_version = 3;
 195         ctx->outgoing = tevent_queue_create(ctx, "tldap_outgoing");
 196         if (ctx->outgoing == NULL) {
 197                 TALLOC_FREE(ctx);
 198                 return NULL;
 199         }
 200         return ctx;
 201 }
 202
 203 bool tldap_connection_ok(struct tldap_context *ld)
 204 {
 205         int ret;
 206
 207         if (ld == NULL) {
 208                 return false;
 209         }
 210
 211         if (ld->active == NULL) {
 212                 return false;
 213         }
 214
 215         ret = tstream_pending_bytes(ld->active);
 216         if (ret == -1) {
 217                 return false;
 218         }
 219
 220         return true;
 221 }
 222
 223 static size_t tldap_pending_reqs(struct tldap_context *ld)
 224 {
 225         return talloc_array_length(ld->pending);
 226 }
 227
 228 struct tstream_context *tldap_get_plain_tstream(struct tldap_context *ld)
 229 {
 230         return ld->plain;
 231 }
 232
 233 void tldap_set_starttls_needed(struct tldap_context *ld, bool needed)
 234 {
 235         if (ld == NULL) {
 236                 return;
 237         }
 238
 239         ld->starttls_needed = needed;
 240 }
 241
 242 bool tldap_get_starttls_needed(struct tldap_context *ld)
 243 {
 244         if (ld == NULL) {
 245                 return false;
 246         }
 247
 248         return ld->starttls_needed;
 249 }
 250
 251 bool tldap_has_tls_tstream(struct tldap_context *ld)
 252 {
 253         return ld->tls != NULL && ld->active == ld->tls;
 254 }
 255
 256 const DATA_BLOB *tldap_tls_channel_bindings(struct tldap_context *ld)
 257 {
 258         return tstream_tls_channel_bindings(ld->tls);
 259 }
 260
 261 void tldap_set_tls_tstream(struct tldap_context *ld,
 262                            struct tstream_context **stream)
 263 {
 264         TALLOC_FREE(ld->tls);
 265         if (stream != NULL) {
 266                 ld->tls = talloc_move(ld, stream);
 267         }
 268         if (ld->tls != NULL) {
 269                 ld->active = ld->tls;
 270         } else {
 271                 ld->active = ld->plain;
 272         }
 273 }
 274
 275 bool tldap_has_gensec_tstream(struct tldap_context *ld)
 276 {
 277         return ld->gensec != NULL && ld->active == ld->gensec;
 278 }
 279
 280 void tldap_set_gensec_tstream(struct tldap_context *ld,
 281                               struct tstream_context **stream)
 282 {
 283         TALLOC_FREE(ld->gensec);
 284         if (stream != NULL) {
 285                 ld->gensec = talloc_move(ld, stream);
 286         }
 287         if (ld->gensec != NULL) {
 288                 ld->active = ld->gensec;
 289         } else {
 290                 ld->active = ld->plain;
 291         }
 292 }
 293
 294 static struct tldap_ctx_attribute *tldap_context_findattr(
 295         struct tldap_context *ld, const char *name)
 296 {
 297         size_t i, num_attrs;
 298
 299         num_attrs = talloc_array_length(ld->ctx_attrs);
 300
 301         for (i=0; i<num_attrs; i++) {
 302                 if (strcmp(ld->ctx_attrs[i].name, name) == 0) {
 303                         return &ld->ctx_attrs[i];
 304                 }
 305         }
 306         return NULL;
 307 }
 308
 309 bool tldap_context_setattr(struct tldap_context *ld,
 310                            const char *name, const void *_pptr)
 311 {
 312         struct tldap_ctx_attribute *tmp, *attr;
 313         char *tmpname;
 314         int num_attrs;
 315         void **pptr = (void **)discard_const_p(void,_pptr);
 316
 317         attr = tldap_context_findattr(ld, name);
 318         if (attr != NULL) {
 319                 /*
 320                  * We don't actually delete attrs, we don't expect tons of
 321                  * attributes being shuffled around.
 322                  */
 323                 TALLOC_FREE(attr->ptr);
 324                 if (*pptr != NULL) {
 325                         attr->ptr = talloc_move(ld->ctx_attrs, pptr);
 326                         *pptr = NULL;
 327                 }
 328                 return true;
 329         }
 330
 331         tmpname = talloc_strdup(ld, name);
 332         if (tmpname == NULL) {
 333                 return false;
 334         }
 335
 336         num_attrs = talloc_array_length(ld->ctx_attrs);
 337
 338         tmp = talloc_realloc(ld, ld->ctx_attrs, struct tldap_ctx_attribute,
 339                              num_attrs+1);
 340         if (tmp == NULL) {
 341                 TALLOC_FREE(tmpname);
 342                 return false;
 343         }
 344         tmp[num_attrs].name = talloc_move(tmp, &tmpname);
 345         if (*pptr != NULL) {
 346                 tmp[num_attrs].ptr = talloc_move(tmp, pptr);
 347         } else {
 348                 tmp[num_attrs].ptr = NULL;
 349         }
 350         *pptr = NULL;
 351         ld->ctx_attrs = tmp;
 352         return true;
 353 }
 354
 355 void *tldap_context_getattr(struct tldap_context *ld, const char *name)
 356 {
 357         struct tldap_ctx_attribute *attr = tldap_context_findattr(ld, name);
 358
 359         if (attr == NULL) {
 360                 return NULL;
 361         }
 362         return attr->ptr;
 363 }
 364
 365 struct read_ldap_state {
 366         uint8_t *buf;
 367 };
 368
 369 static ssize_t read_ldap_more(uint8_t *buf, size_t buflen, void *private_data);
 370 static void read_ldap_done(struct tevent_req *subreq);
 371
 372 static struct tevent_req *read_ldap_send(TALLOC_CTX *mem_ctx,
 373                                          struct tevent_context *ev,
 374                                          struct tstream_context *conn)
 375 {
 376         struct tevent_req *req, *subreq;
 377         struct read_ldap_state *state;
 378
 379         req = tevent_req_create(mem_ctx, &state, struct read_ldap_state);
 380         if (req == NULL) {
 381                 return NULL;
 382         }
 383
 384         subreq = tstream_read_packet_send(state, ev, conn, 7, read_ldap_more,
 385                                           state);
 386         if (tevent_req_nomem(subreq, req)) {
 387                 return tevent_req_post(req, ev);
 388         }
 389         tevent_req_set_callback(subreq, read_ldap_done, req);
 390         return req;
 391 }
 392
 393 static ssize_t read_ldap_more(uint8_t *buf, size_t buflen, void *private_data)
 394 {
 395         const DATA_BLOB blob = data_blob_const(buf, buflen);
 396         size_t pdu_len = 0;
 397         int ret;
 398
 399         if (buflen < 7) {
 400                 /*
 401                  * We need at least 6 bytes to workout the length
 402                  * of the pdu.
 403                  *
 404                  * And we have asked for 7 because the that's
 405                  * the size of the smallest possible LDAP pdu.
 406                  */
 407                 return -1;
 408         }
 409
 410         ret = asn1_peek_full_tag(blob, ASN1_SEQUENCE(0), &pdu_len);
 411         if (ret == 0) {
 412                 return 0;
 413         }
 414         if (ret == EAGAIN) {
 415                 return pdu_len - buflen;
 416         }
 417
 418         return -1;
 419 }
 420
 421 static void read_ldap_done(struct tevent_req *subreq)
 422 {
 423         struct tevent_req *req = tevent_req_callback_data(
 424                 subreq, struct tevent_req);
 425         struct read_ldap_state *state = tevent_req_data(
 426                 req, struct read_ldap_state);
 427         ssize_t nread;
 428         int err;
 429
 430         nread = tstream_read_packet_recv(subreq, state, &state->buf, &err);
 431         TALLOC_FREE(subreq);
 432         if (nread == -1) {
 433                 tevent_req_error(req, err);
 434                 return;
 435         }
 436         tevent_req_done(req);
 437 }
 438
 439 static ssize_t read_ldap_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 440                               uint8_t **pbuf, int *perrno)
 441 {
 442         struct read_ldap_state *state = tevent_req_data(
 443                 req, struct read_ldap_state);
 444
 445         if (tevent_req_is_unix_error(req, perrno)) {
 446                 return -1;
 447         }
 448         *pbuf = talloc_move(mem_ctx, &state->buf);
 449         return talloc_get_size(*pbuf);
 450 }
 451
 452 struct tldap_msg_state {
 453         struct tldap_context *ld;
 454         struct tevent_context *ev;
 455         int id;
 456         struct iovec iov;
 457
 458         struct asn1_data *data;
 459         uint8_t *inbuf;
 460 };
 461
 462 static bool tldap_push_controls(struct asn1_data *data,
 463                                 struct tldap_control *sctrls,
 464                                 int num_sctrls)
 465 {
 466         int i;
 467
 468         if ((sctrls == NULL) || (num_sctrls == 0)) {
 469                 return true;
 470         }
 471
 472         if (!asn1_push_tag(data, ASN1_CONTEXT(0))) return false;
 473
 474         for (i=0; i<num_sctrls; i++) {
 475                 struct tldap_control *c = &sctrls[i];
 476                 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) return false;
 477                 if (!asn1_write_OctetString(data, c->oid, strlen(c->oid))) return false;
 478                 if (c->critical) {
 479                         if (!asn1_write_BOOLEAN(data, true)) return false;
 480                 }
 481                 if (c->value.data != NULL) {
 482                         if (!asn1_write_OctetString(data, c->value.data,
 483                                                c->value.length)) return false;
 484                 }
 485                 if (!asn1_pop_tag(data)) return false; /* ASN1_SEQUENCE(0) */
 486         }
 487
 488         return asn1_pop_tag(data); /* ASN1_CONTEXT(0) */
 489 }
 490
 491 #define tldap_context_disconnect(ld, status) \
 492         _tldap_context_disconnect(ld, status, __location__)
 493
 494 static void _tldap_context_disconnect(struct tldap_context *ld,
 495                                       TLDAPRC status,
 496                                       const char *location)
 497 {
 498         if (ld->active == NULL) {
 499                 /*
 500                  * We don't need to tldap_debug() on
 501                  * a potential 2nd run.
 502                  *
 503                  * The rest of the function would just
 504                  * be a noop for the 2nd run anyway.
 505                  */
 506                 return;
 507         }
 508
 509         tldap_debug(ld, TLDAP_DEBUG_WARNING,
 510                     "tldap_context_disconnect: %s at %s\n",
 511                     tldap_rc2string(status),
 512                     location);
 513         tevent_queue_stop(ld->outgoing);
 514         TALLOC_FREE(ld->read_req);
 515         ld->active = NULL;
 516         TALLOC_FREE(ld->gensec);
 517         TALLOC_FREE(ld->tls);
 518         TALLOC_FREE(ld->plain);
 519
 520         while (talloc_array_length(ld->pending) > 0) {
 521                 struct tevent_req *req = NULL;
 522                 struct tldap_msg_state *state = NULL;
 523
 524                 req = ld->pending[0];
 525                 state = tevent_req_data(req, struct tldap_msg_state);
 526                 tevent_req_defer_callback(req, state->ev);
 527                 tevent_req_ldap_error(req, status);
 528         }
 529 }
 530
 531 static void tldap_msg_sent(struct tevent_req *subreq);
 532 static void tldap_msg_received(struct tevent_req *subreq);
 533
 534 static struct tevent_req *tldap_msg_send(TALLOC_CTX *mem_ctx,
 535                                          struct tevent_context *ev,
 536                                          struct tldap_context *ld,
 537                                          int id, struct asn1_data *data,
 538                                          struct tldap_control *sctrls,
 539                                          int num_sctrls)
 540 {
 541         struct tevent_req *req, *subreq;
 542         struct tldap_msg_state *state;
 543         DATA_BLOB blob;
 544         bool ok;
 545
 546         tldap_debug(ld, TLDAP_DEBUG_TRACE, "tldap_msg_send: sending msg %d\n",
 547                     id);
 548
 549         req = tevent_req_create(mem_ctx, &state, struct tldap_msg_state);
 550         if (req == NULL) {
 551                 return NULL;
 552         }
 553         state->ld = ld;
 554         state->ev = ev;
 555         state->id = id;
 556
 557         ok = tldap_connection_ok(ld);
 558         if (!ok) {
 559                 tevent_req_ldap_error(req, TLDAP_SERVER_DOWN);
 560                 return tevent_req_post(req, ev);
 561         }
 562
 563         if (!tldap_push_controls(data, sctrls, num_sctrls)) {
 564                 tevent_req_ldap_error(req, TLDAP_ENCODING_ERROR);
 565                 return tevent_req_post(req, ev);
 566         }
 567
 568
 569         if (!asn1_pop_tag(data)) {
 570                 tevent_req_ldap_error(req, TLDAP_ENCODING_ERROR);
 571                 return tevent_req_post(req, ev);
 572         }
 573
 574         if (!asn1_blob(data, &blob)) {
 575                 tevent_req_ldap_error(req, TLDAP_ENCODING_ERROR);
 576                 return tevent_req_post(req, ev);
 577         }
 578
 579         if (!tldap_msg_set_pending(req)) {
 580                 tevent_req_oom(req);
 581                 return tevent_req_post(req, ev);;
 582         }
 583
 584         state->iov.iov_base = (void *)blob.data;
 585         state->iov.iov_len = blob.length;
 586
 587         subreq = tstream_writev_queue_send(state, ev, ld->active, ld->outgoing,
 588                                            &state->iov, 1);
 589         if (tevent_req_nomem(subreq, req)) {
 590                 return tevent_req_post(req, ev);
 591         }
 592         tevent_req_set_callback(subreq, tldap_msg_sent, req);
 593         return req;
 594 }
 595
 596 static void tldap_msg_unset_pending(struct tevent_req *req)
 597 {
 598         struct tldap_msg_state *state = tevent_req_data(
 599                 req, struct tldap_msg_state);
 600         struct tldap_context *ld = state->ld;
 601         int num_pending = tldap_pending_reqs(ld);
 602         int i;
 603
 604         tevent_req_set_cleanup_fn(req, NULL);
 605
 606         for (i=0; i<num_pending; i++) {
 607                 if (req == ld->pending[i]) {
 608                         break;
 609                 }
 610         }
 611         if (i == num_pending) {
 612                 /*
 613                  * Something's seriously broken. Just returning here is the
 614                  * right thing nevertheless, the point of this routine is to
 615                  * remove ourselves from cli->pending.
 616                  */
 617                 return;
 618         }
 619
 620         if (num_pending == 1) {
 621                 TALLOC_FREE(ld->pending);
 622                 return;
 623         }
 624
 625         /*
 626          * Remove ourselves from the cli->pending array
 627          */
 628         if (num_pending > 1) {
 629                 ld->pending[i] = ld->pending[num_pending-1];
 630         }
 631
 632         /*
 633          * No NULL check here, we're shrinking by sizeof(void *), and
 634          * talloc_realloc just adjusts the size for this.
 635          */
 636         ld->pending = talloc_realloc(NULL, ld->pending, struct tevent_req *,
 637                                      num_pending - 1);
 638 }
 639
 640 static void tldap_msg_cleanup(struct tevent_req *req,
 641                               enum tevent_req_state req_state)
 642 {
 643         tldap_msg_unset_pending(req);
 644 }
 645
 646 static bool tldap_msg_set_pending(struct tevent_req *req)
 647 {
 648         struct tldap_msg_state *state = tevent_req_data(
 649                 req, struct tldap_msg_state);
 650         struct tldap_context *ld;
 651         struct tevent_req **pending;
 652         int num_pending;
 653
 654         ld = state->ld;
 655         num_pending = tldap_pending_reqs(ld);
 656
 657         pending = talloc_realloc(ld, ld->pending, struct tevent_req *,
 658                                  num_pending+1);
 659         if (pending == NULL) {
 660                 return false;
 661         }
 662         pending[num_pending] = req;
 663         ld->pending = pending;
 664         tevent_req_set_cleanup_fn(req, tldap_msg_cleanup);
 665
 666         if (ld->read_req != NULL) {
 667                 return true;
 668         }
 669
 670         /*
 671          * We're the first one, add the read_ldap request that waits for the
 672          * answer from the server
 673          */
 674         ld->read_req = read_ldap_send(ld->pending, state->ev, ld->active);
 675         if (ld->read_req == NULL) {
 676                 tldap_msg_unset_pending(req);
 677                 return false;
 678         }
 679         tevent_req_set_callback(ld->read_req, tldap_msg_received, ld);
 680         return true;
 681 }
 682
 683 static void tldap_msg_sent(struct tevent_req *subreq)
 684 {
 685         struct tevent_req *req = tevent_req_callback_data(
 686                 subreq, struct tevent_req);
 687         struct tldap_msg_state *state = tevent_req_data(
 688                 req, struct tldap_msg_state);
 689         ssize_t nwritten;
 690         int err;
 691
 692         nwritten = tstream_writev_queue_recv(subreq, &err);
 693         TALLOC_FREE(subreq);
 694         if (nwritten == -1) {
 695                 tldap_context_disconnect(state->ld, TLDAP_SERVER_DOWN);
 696                 return;
 697         }
 698 }
 699
 700 static int tldap_msg_msgid(struct tevent_req *req)
 701 {
 702         struct tldap_msg_state *state = tevent_req_data(
 703                 req, struct tldap_msg_state);
 704
 705         return state->id;
 706 }
 707
 708 static void tldap_msg_received(struct tevent_req *subreq)
 709 {
 710         struct tldap_context *ld = tevent_req_callback_data(
 711                 subreq, struct tldap_context);
 712         struct tevent_req *req;
 713         struct tldap_msg_state *state;
 714         struct asn1_data *data;
 715         uint8_t *inbuf;
 716         ssize_t received;
 717         size_t num_pending;
 718         size_t i;
 719         int err;
 720         TLDAPRC status = TLDAP_PROTOCOL_ERROR;
 721         int id;
 722         uint8_t type;
 723         bool ok;
 724
 725         received = read_ldap_recv(subreq, talloc_tos(), &inbuf, &err);
 726         TALLOC_FREE(subreq);
 727         ld->read_req = NULL;
 728         if (received == -1) {
 729                 status = TLDAP_SERVER_DOWN;
 730                 goto fail;
 731         }
 732
 733         data = asn1_init(talloc_tos(), ASN1_MAX_TREE_DEPTH);
 734         if (data == NULL) {
 735                 /*
 736                  * We have to disconnect all, we can't tell which of
 737                  * the requests this reply is for.
 738                  */
 739                 status = TLDAP_NO_MEMORY;
 740                 goto fail;
 741         }
 742         asn1_load_nocopy(data, inbuf, received);
 743
 744         ok = true;
 745         ok &= asn1_start_tag(data, ASN1_SEQUENCE(0));
 746         ok &= asn1_read_Integer(data, &id);
 747         ok &= asn1_peek_uint8(data, &type);
 748
 749         if (!ok) {
 750                 status = TLDAP_PROTOCOL_ERROR;
 751                 goto fail;
 752         }
 753
 754         tldap_debug(ld, TLDAP_DEBUG_TRACE, "tldap_msg_received: got msg %d "
 755                     "type %d\n", id, (int)type);
 756
 757         if (id == 0) {
 758                 tldap_debug(
 759                         ld,
 760                         TLDAP_DEBUG_WARNING,
 761                         "tldap_msg_received: got msgid 0 of "
 762                         "type %"PRIu8", disconnecting\n",
 763                         type);
 764                 tldap_context_disconnect(ld, TLDAP_SERVER_DOWN);
 765                 return;
 766         }
 767
 768         num_pending = talloc_array_length(ld->pending);
 769
 770         for (i=0; i<num_pending; i++) {
 771                 if (id == tldap_msg_msgid(ld->pending[i])) {
 772                         break;
 773                 }
 774         }
 775         if (i == num_pending) {
 776                 /* Dump unexpected reply */
 777                 tldap_debug(ld, TLDAP_DEBUG_WARNING, "tldap_msg_received: "
 778                             "No request pending for msg %d\n", id);
 779                 TALLOC_FREE(data);
 780                 TALLOC_FREE(inbuf);
 781                 goto done;
 782         }
 783
 784         req = ld->pending[i];
 785         state = tevent_req_data(req, struct tldap_msg_state);
 786
 787         state->inbuf = talloc_move(state, &inbuf);
 788         state->data = talloc_move(state, &data);
 789
 790         tldap_msg_unset_pending(req);
 791         num_pending = talloc_array_length(ld->pending);
 792
 793         tevent_req_defer_callback(req, state->ev);
 794         tevent_req_done(req);
 795
 796  done:
 797         if (num_pending == 0) {
 798                 return;
 799         }
 800
 801         state = tevent_req_data(ld->pending[0], struct tldap_msg_state);
 802         ld->read_req = read_ldap_send(ld->pending, state->ev, ld->active);
 803         if (ld->read_req == NULL) {
 804                 status = TLDAP_NO_MEMORY;
 805                 goto fail;
 806         }
 807         tevent_req_set_callback(ld->read_req, tldap_msg_received, ld);
 808         return;
 809
 810  fail:
 811         tldap_context_disconnect(ld, status);
 812 }
 813
 814 static TLDAPRC tldap_msg_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 815                               struct tldap_message **pmsg)
 816 {
 817         struct tldap_msg_state *state = tevent_req_data(
 818                 req, struct tldap_msg_state);
 819         struct tldap_message *msg;
 820         TLDAPRC err;
 821         uint8_t msgtype;
 822
 823         if (tevent_req_is_ldap_error(req, &err)) {
 824                 return err;
 825         }
 826
 827         if (!asn1_peek_uint8(state->data, &msgtype)) {
 828                 return TLDAP_PROTOCOL_ERROR;
 829         }
 830
 831         if (pmsg == NULL) {
 832                 return TLDAP_SUCCESS;
 833         }
 834
 835         msg = talloc_zero(mem_ctx, struct tldap_message);
 836         if (msg == NULL) {
 837                 return TLDAP_NO_MEMORY;
 838         }
 839         msg->id = state->id;
 840
 841         msg->inbuf = talloc_move(msg, &state->inbuf);
 842         msg->data = talloc_move(msg, &state->data);
 843         msg->type = msgtype;
 844
 845         *pmsg = msg;
 846         return TLDAP_SUCCESS;
 847 }
 848
 849 struct tldap_req_state {
 850         int id;
 851         struct asn1_data *out;
 852         struct tldap_message *result;
 853 };
 854
 855 static struct tevent_req *tldap_req_create(TALLOC_CTX *mem_ctx,
 856                                            struct tldap_context *ld,
 857                                            struct tldap_req_state **pstate)
 858 {
 859         struct tevent_req *req;
 860         struct tldap_req_state *state;
 861
 862         req = tevent_req_create(mem_ctx, &state, struct tldap_req_state);
 863         if (req == NULL) {
 864                 return NULL;
 865         }
 866         state->out = asn1_init(state, ASN1_MAX_TREE_DEPTH);
 867         if (state->out == NULL) {
 868                 goto err;
 869         }
 870         state->id = tldap_next_msgid(ld);
 871
 872         if (!asn1_push_tag(state->out, ASN1_SEQUENCE(0))) goto err;
 873         if (!asn1_write_Integer(state->out, state->id)) goto err;
 874
 875         *pstate = state;
 876         return req;
 877
 878   err:
 879
 880         TALLOC_FREE(req);
 881         return NULL;
 882 }
 883
 884 static void tldap_save_msg(struct tldap_context *ld, struct tevent_req *req)
 885 {
 886         struct tldap_req_state *state = tevent_req_data(
 887                 req, struct tldap_req_state);
 888
 889         TALLOC_FREE(ld->last_msg);
 890         ld->last_msg = talloc_move(ld, &state->result);
 891 }
 892
 893 static char *blob2string_talloc(TALLOC_CTX *mem_ctx, DATA_BLOB blob)
 894 {
 895         char *result = talloc_array(mem_ctx, char, blob.length+1);
 896
 897         if (result == NULL) {
 898                 return NULL;
 899         }
 900
 901         memcpy(result, blob.data, blob.length);
 902         result[blob.length] = '\0';
 903         return result;
 904 }
 905
 906 static bool asn1_read_OctetString_talloc(TALLOC_CTX *mem_ctx,
 907                                          struct asn1_data *data,
 908                                          char **presult)
 909 {
 910         DATA_BLOB string;
 911         char *result;
 912         if (!asn1_read_OctetString(data, mem_ctx, &string))
 913                 return false;
 914
 915         result = blob2string_talloc(mem_ctx, string);
 916
 917         data_blob_free(&string);
 918
 919         if (result == NULL) {
 920                 return false;
 921         }
 922         *presult = result;
 923         return true;
 924 }
 925
 926 static bool tldap_decode_controls(struct tldap_req_state *state);
 927
 928 static bool tldap_decode_response(struct tldap_req_state *state)
 929 {
 930         struct asn1_data *data = state->result->data;
 931         struct tldap_message *msg = state->result;
 932         int rc;
 933         bool ok = true;
 934
 935         ok &= asn1_read_enumerated(data, &rc);
 936         if (ok) {
 937                 msg->lderr = TLDAP_RC(rc);
 938         }
 939
 940         ok &= asn1_read_OctetString_talloc(msg, data, &msg->res_matcheddn);
 941         ok &= asn1_read_OctetString_talloc(msg, data,
 942                                            &msg->res_diagnosticmessage);
 943         if (!ok) return ok;
 944         if (asn1_peek_tag(data, ASN1_CONTEXT(3))) {
 945                 ok &= asn1_start_tag(data, ASN1_CONTEXT(3));
 946                 ok &= asn1_read_OctetString_talloc(msg, data,
 947                                                    &msg->res_referral);
 948                 ok &= asn1_end_tag(data);
 949         } else {
 950                 msg->res_referral = NULL;
 951         }
 952
 953         return ok;
 954 }
 955
 956 static void tldap_sasl_bind_done(struct tevent_req *subreq);
 957
 958 struct tevent_req *tldap_sasl_bind_send(TALLOC_CTX *mem_ctx,
 959                                         struct tevent_context *ev,
 960                                         struct tldap_context *ld,
 961                                         const char *dn,
 962                                         const char *mechanism,
 963                                         DATA_BLOB *creds,
 964                                         struct tldap_control *sctrls,
 965                                         int num_sctrls,
 966                                         struct tldap_control *cctrls,
 967                                         int num_cctrls)
 968 {
 969         struct tevent_req *req, *subreq;
 970         struct tldap_req_state *state;
 971
 972         req = tldap_req_create(mem_ctx, ld, &state);
 973         if (req == NULL) {
 974                 return NULL;
 975         }
 976
 977         if (dn == NULL) {
 978                 dn = "";
 979         }
 980
 981         if (!asn1_push_tag(state->out, TLDAP_REQ_BIND)) goto err;
 982         if (!asn1_write_Integer(state->out, ld->ld_version)) goto err;
 983         if (!asn1_write_OctetString(state->out, dn, strlen(dn))) goto err;
 984
 985         if (mechanism == NULL) {
 986                 if (!asn1_push_tag(state->out, ASN1_CONTEXT_SIMPLE(0))) goto err;
 987                 if (!asn1_write(state->out, creds->data, creds->length)) goto err;
 988                 if (!asn1_pop_tag(state->out)) goto err;
 989         } else {
 990                 if (!asn1_push_tag(state->out, ASN1_CONTEXT(3))) goto err;
 991                 if (!asn1_write_OctetString(state->out, mechanism,
 992                                        strlen(mechanism))) goto err;
 993                 if ((creds != NULL) && (creds->data != NULL)) {
 994                         if (!asn1_write_OctetString(state->out, creds->data,
 995                                                creds->length)) goto err;
 996                 }
 997                 if (!asn1_pop_tag(state->out)) goto err;
 998         }
 999
1000         if (!asn1_pop_tag(state->out)) goto err;
1001
1002         subreq = tldap_msg_send(state, ev, ld, state->id, state->out,
1003                                 sctrls, num_sctrls);
1004         if (tevent_req_nomem(subreq, req)) {
1005                 return tevent_req_post(req, ev);
1006         }
1007         tevent_req_set_callback(subreq, tldap_sasl_bind_done, req);
1008         return req;
1009
1010   err:
1011
1012         tevent_req_ldap_error(req, TLDAP_ENCODING_ERROR);
1013         return tevent_req_post(req, ev);
1014 }
1015
1016 static void tldap_sasl_bind_done(struct tevent_req *subreq)
1017 {
1018         struct tevent_req *req = tevent_req_callback_data(
1019                 subreq, struct tevent_req);
1020         struct tldap_req_state *state = tevent_req_data(
1021                 req, struct tldap_req_state);
1022         TLDAPRC rc;
1023         bool ok;
1024
1025         rc = tldap_msg_recv(subreq, state, &state->result);
1026         TALLOC_FREE(subreq);
1027         if (tevent_req_ldap_error(req, rc)) {
1028                 return;
1029         }
1030         if (state->result->type != TLDAP_RES_BIND) {
1031                 tevent_req_ldap_error(req, TLDAP_PROTOCOL_ERROR);
1032                 return;
1033         }
1034
1035         ok = asn1_start_tag(state->result->data, TLDAP_RES_BIND);
1036         ok &= tldap_decode_response(state);
1037
1038         if (asn1_peek_tag(state->result->data, ASN1_CONTEXT_SIMPLE(7))) {
1039                 int len;
1040
1041                 ok &= asn1_start_tag(state->result->data,
1042                                      ASN1_CONTEXT_SIMPLE(7));
1043                 if (!ok) {
1044                         goto decode_error;
1045                 }
1046
1047                 len = asn1_tag_remaining(state->result->data);
1048                 if (len == -1) {
1049                         goto decode_error;
1050                 }
1051
1052                 state->result->res_serverSaslCreds =
1053                         data_blob_talloc(state->result, NULL, len);
1054                 if (state->result->res_serverSaslCreds.data == NULL) {
1055                         goto decode_error;
1056                 }
1057
1058                 ok = asn1_read(state->result->data,
1059                                state->result->res_serverSaslCreds.data,
1060                                state->result->res_serverSaslCreds.length);
1061
1062                 ok &= asn1_end_tag(state->result->data);
1063         }
1064
1065         ok &= asn1_end_tag(state->result->data);
1066
1067         if (!ok) {
1068                 goto decode_error;
1069         }
1070
1071         if (!TLDAP_RC_IS_SUCCESS(state->result->lderr) &&
1072             !TLDAP_RC_EQUAL(state->result->lderr,
1073                             TLDAP_SASL_BIND_IN_PROGRESS)) {
1074                 tevent_req_ldap_error(req, state->result->lderr);
1075                 return;
1076         }
1077         tevent_req_done(req);
1078         return;
1079
1080 decode_error:
1081         tevent_req_ldap_error(req, TLDAP_DECODING_ERROR);
1082         return;
1083 }
1084
1085 TLDAPRC tldap_sasl_bind_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1086                              DATA_BLOB *serverSaslCreds)
1087 {
1088         struct tldap_req_state *state = tevent_req_data(
1089                 req, struct tldap_req_state);
1090         TLDAPRC rc;
1091
1092         if (tevent_req_is_ldap_error(req, &rc)) {
1093                 return rc;
1094         }
1095
1096         if (serverSaslCreds != NULL) {
1097                 serverSaslCreds->data = talloc_move(
1098                         mem_ctx, &state->result->res_serverSaslCreds.data);
1099                 serverSaslCreds->length =
1100                         state->result->res_serverSaslCreds.length;
1101         }
1102
1103         return state->result->lderr;
1104 }
1105
1106 TLDAPRC tldap_sasl_bind(struct tldap_context *ld,
1107                         const char *dn,
1108                         const char *mechanism,
1109                         DATA_BLOB *creds,
1110                         struct tldap_control *sctrls,
1111                         int num_sctrls,
1112                         struct tldap_control *cctrls,
1113                         int num_cctrls,
1114                         TALLOC_CTX *mem_ctx,
1115                         DATA_BLOB *serverSaslCreds)
1116 {
1117         TALLOC_CTX *frame = talloc_stackframe();
1118         struct tevent_context *ev;
1119         struct tevent_req *req;
1120         TLDAPRC rc = TLDAP_NO_MEMORY;
1121
1122         ev = samba_tevent_context_init(frame);
1123         if (ev == NULL) {
1124                 goto fail;
1125         }
1126         req = tldap_sasl_bind_send(frame, ev, ld, dn, mechanism, creds,
1127                                    sctrls, num_sctrls, cctrls, num_cctrls);
1128         if (req == NULL) {
1129                 goto fail;
1130         }
1131         if (!tevent_req_poll(req, ev)) {
1132                 rc = TLDAP_OPERATIONS_ERROR;
1133                 goto fail;
1134         }
1135         rc = tldap_sasl_bind_recv(req, mem_ctx, serverSaslCreds);
1136         tldap_save_msg(ld, req);
1137  fail:
1138         TALLOC_FREE(frame);
1139         return rc;
1140 }
1141
1142 struct tevent_req *tldap_simple_bind_send(TALLOC_CTX *mem_ctx,
1143                                           struct tevent_context *ev,
1144                                           struct tldap_context *ld,
1145                                           const char *dn,
1146                                           const char *passwd)
1147 {
1148         DATA_BLOB cred;
1149
1150         if (passwd != NULL) {
1151                 cred.data = discard_const_p(uint8_t, passwd);
1152                 cred.length = strlen(passwd);
1153         } else {
1154                 cred.data = discard_const_p(uint8_t, "");
1155                 cred.length = 0;
1156         }
1157         return tldap_sasl_bind_send(mem_ctx, ev, ld, dn, NULL, &cred, NULL, 0,
1158                                     NULL, 0);
1159 }
1160
1161 TLDAPRC tldap_simple_bind_recv(struct tevent_req *req)
1162 {
1163         return tldap_sasl_bind_recv(req, NULL, NULL);
1164 }
1165
1166 TLDAPRC tldap_simple_bind(struct tldap_context *ld, const char *dn,
1167                           const char *passwd)
1168 {
1169         DATA_BLOB cred;
1170
1171         if (passwd != NULL) {
1172                 cred.data = discard_const_p(uint8_t, passwd);
1173                 cred.length = strlen(passwd);
1174         } else {
1175                 cred.data = discard_const_p(uint8_t, "");
1176                 cred.length = 0;
1177         }
1178         return tldap_sasl_bind(ld, dn, NULL, &cred, NULL, 0, NULL, 0,
1179                                NULL, NULL);
1180 }
1181
1182 /*****************************************************************************/
1183
1184 /* can't use isalpha() as only a strict set is valid for LDAP */
1185
1186 static bool tldap_is_alpha(char c)
1187 {
1188         return (((c >= 'a') && (c <= 'z')) || \
1189                 ((c >= 'A') && (c <= 'Z')));
1190 }
1191
1192 static bool tldap_is_adh(char c)
1193 {
1194         return tldap_is_alpha(c) || isdigit(c) || (c == '-');
1195 }
1196
1197 #define TLDAP_FILTER_AND  ASN1_CONTEXT(0)
1198 #define TLDAP_FILTER_OR   ASN1_CONTEXT(1)
1199 #define TLDAP_FILTER_NOT  ASN1_CONTEXT(2)
1200 #define TLDAP_FILTER_EQ   ASN1_CONTEXT(3)
1201 #define TLDAP_FILTER_SUB  ASN1_CONTEXT(4)
1202 #define TLDAP_FILTER_LE   ASN1_CONTEXT(5)
1203 #define TLDAP_FILTER_GE   ASN1_CONTEXT(6)
1204 #define TLDAP_FILTER_PRES ASN1_CONTEXT_SIMPLE(7)
1205 #define TLDAP_FILTER_APX  ASN1_CONTEXT(8)
1206 #define TLDAP_FILTER_EXT  ASN1_CONTEXT(9)
1207
1208 #define TLDAP_SUB_INI ASN1_CONTEXT_SIMPLE(0)
1209 #define TLDAP_SUB_ANY ASN1_CONTEXT_SIMPLE(1)
1210 #define TLDAP_SUB_FIN ASN1_CONTEXT_SIMPLE(2)
1211
1212
1213 /* oid's should be numerical only in theory,
1214  * but apparently some broken servers may have alphanum aliases instead.
1215  * Do like openldap libraries and allow alphanum aliases for oids, but
1216  * do not allow Tagging options in that case.
1217  */
1218 static bool tldap_is_attrdesc(const char *s, int len, bool no_tagopts)
1219 {
1220         bool is_oid = false;
1221         bool dot = false;
1222         int i;
1223
1224         /* first char has stricter rules */
1225         if (isdigit(*s)) {
1226                 is_oid = true;
1227         } else if (!tldap_is_alpha(*s)) {
1228                 /* bad first char */
1229                 return false;
1230         }
1231
1232         for (i = 1; i < len; i++) {
1233
1234                 if (is_oid) {
1235                         if (isdigit(s[i])) {
1236                                 dot = false;
1237                                 continue;
1238                         }
1239                         if (s[i] == '.') {
1240                                 if (dot) {
1241                                         /* malformed */
1242                                         return false;
1243                                 }
1244                                 dot = true;
1245                                 continue;
1246                         }
1247                 } else {
1248                         if (tldap_is_adh(s[i])) {
1249                                 continue;
1250                         }
1251                 }
1252
1253                 if (s[i] == ';') {
1254                         if (no_tagopts) {
1255                                 /* no tagging options */
1256                                 return false;
1257                         }
1258                         if (dot) {
1259                                 /* malformed */
1260                                 return false;
1261                         }
1262                         if ((i + 1) == len) {
1263                                 /* malformed */
1264                                 return false;
1265                         }
1266
1267                         is_oid = false;
1268                         continue;
1269                 }
1270         }
1271
1272         if (dot) {
1273                 /* malformed */
1274                 return false;
1275         }
1276
1277         return true;
1278 }
1279
1280 /* this function copies the value until the closing parenthesis is found. */
1281 static char *tldap_get_val(TALLOC_CTX *memctx,
1282                            const char *value, const char **_s)
1283 {
1284         const char *s = value;
1285
1286         /* find terminator */
1287         while (*s) {
1288                 s = strchr(s, ')');
1289                 if (s && (*(s - 1) == '\\')) {
1290                         s++;
1291                         continue;
1292                 }
1293                 break;
1294         }
1295         if (!s || !(*s == ')')) {
1296                 /* malformed filter */
1297                 return NULL;
1298         }
1299
1300         *_s = s;
1301
1302         return talloc_strndup(memctx, value, s - value);
1303 }
1304
1305 static int tldap_hex2char(const char *x)
1306 {
1307         if (isxdigit(x[0]) && isxdigit(x[1])) {
1308                 const char h1 = x[0], h2 = x[1];
1309                 int c = 0;
1310
1311                 if (h1 >= 'a') c = h1 - (int)'a' + 10;
1312                 else if (h1 >= 'A') c = h1 - (int)'A' + 10;
1313                 else if (h1 >= '0') c = h1 - (int)'0';
1314                 c = c << 4;
1315                 if (h2 >= 'a') c += h2 - (int)'a' + 10;
1316                 else if (h2 >= 'A') c += h2 - (int)'A' + 10;
1317                 else if (h2 >= '0') c += h2 - (int)'0';
1318
1319                 return c;
1320         }
1321
1322         return -1;
1323 }
1324
1325 static bool tldap_find_first_star(const char *val, const char **star)
1326 {
1327         const char *s;
1328
1329         for (s = val; *s; s++) {
1330                 switch (*s) {
1331                 case '\\':
1332                         if (isxdigit(s[1]) && isxdigit(s[2])) {
1333                                 s += 2;
1334                                 break;
1335                         }
1336                         /* not hex based escape, check older syntax */
1337                         switch (s[1]) {
1338                         case '(':
1339                         case ')':
1340                         case '*':
1341                         case '\\':
1342                                 s++;
1343                                 break;
1344                         default:
1345                                 /* invalid escape sequence */
1346                                 return false;
1347                         }
1348                         break;
1349                 case ')':
1350                         /* end of val, nothing found */
1351                         *star = s;
1352                         return true;
1353
1354                 case '*':
1355                         *star = s;
1356                         return true;
1357                 }
1358         }
1359
1360         /* string ended without closing parenthesis, filter is malformed */
1361         return false;
1362 }
1363
1364 static bool tldap_unescape_inplace(char *value, size_t *val_len)
1365 {
1366         int c;
1367         size_t i, p;
1368
1369         for (i = 0,p = 0; i < *val_len; i++) {
1370
1371                 switch (value[i]) {
1372                 case '(':
1373                 case ')':
1374                 case '*':
1375                         /* these must be escaped */
1376                         return false;
1377
1378                 case '\\':
1379                         if (!value[i + 1]) {
1380                                 /* invalid EOL */
1381                                 return false;
1382                         }
1383                         i++;
1384
1385                         /* LDAPv3 escaped */
1386                         c = tldap_hex2char(&value[i]);
1387                         if (c >= 0 && c < 256) {
1388                                 value[p] = c;
1389                                 i++;
1390                                 p++;
1391                                 break;
1392                         }
1393
1394                         /* LDAPv2 escaped */
1395                         switch (value[i]) {
1396                         case '(':
1397                         case ')':
1398                         case '*':
1399                         case '\\':
1400                                 value[p] = value[i];
1401                                 p++;
1402
1403                                 break;
1404                         default:
1405                                 /* invalid */
1406                                 return false;
1407                         }
1408                         break;
1409
1410                 default:
1411                         value[p] = value[i];
1412                         p++;
1413                 }
1414         }
1415         value[p] = '\0';
1416         *val_len = p;
1417         return true;
1418 }
1419
1420 static bool tldap_push_filter_basic(struct tldap_context *ld,
1421                                     struct asn1_data *data,
1422                                     const char **_s);
1423 static bool tldap_push_filter_substring(struct tldap_context *ld,
1424                                         struct asn1_data *data,
1425                                         const char *val,
1426                                         const char **_s);
1427 static bool tldap_push_filter_int(struct tldap_context *ld,
1428                                   struct asn1_data *data,
1429                                   const char **_s)
1430 {
1431         const char *s = *_s;
1432         bool ret;
1433
1434         if (*s != '(') {
1435                 tldap_debug(ld, TLDAP_DEBUG_ERROR,
1436                             "Incomplete or malformed filter\n");
1437                 return false;
1438         }
1439         s++;
1440
1441         /* we are right after a parenthesis,
1442          * find out what op we have at hand */
1443         switch (*s) {
1444         case '&':
1445                 tldap_debug(ld, TLDAP_DEBUG_TRACE, "Filter op: AND\n");
1446                 if (!asn1_push_tag(data, TLDAP_FILTER_AND)) return false;
1447                 s++;
1448                 break;
1449
1450         case '|':
1451                 tldap_debug(ld, TLDAP_DEBUG_TRACE, "Filter op: OR\n");
1452                 if (!asn1_push_tag(data, TLDAP_FILTER_OR)) return false;
1453                 s++;
1454                 break;
1455
1456         case '!':
1457                 tldap_debug(ld, TLDAP_DEBUG_TRACE, "Filter op: NOT\n");
1458                 if (!asn1_push_tag(data, TLDAP_FILTER_NOT)) return false;
1459                 s++;
1460                 ret = tldap_push_filter_int(ld, data, &s);
1461                 if (!ret) {
1462                         return false;
1463                 }
1464                 if (!asn1_pop_tag(data)) return false;
1465                 goto done;
1466
1467         case '(':
1468         case ')':
1469                 tldap_debug(ld, TLDAP_DEBUG_ERROR,
1470                             "Invalid parenthesis '%c'\n", *s);
1471                 return false;
1472
1473         case '\0':
1474                 tldap_debug(ld, TLDAP_DEBUG_ERROR,
1475                             "Invalid filter termination\n");
1476                 return false;
1477
1478         default:
1479                 ret = tldap_push_filter_basic(ld, data, &s);
1480                 if (!ret) {
1481                         return false;
1482                 }
1483                 goto done;
1484         }
1485
1486         /* only and/or filters get here.
1487          * go through the list of filters */
1488
1489         if (*s == ')') {
1490                 /* RFC 4526: empty and/or */
1491                 if (!asn1_pop_tag(data)) return false;
1492                 goto done;
1493         }
1494
1495         while (*s) {
1496                 ret = tldap_push_filter_int(ld, data, &s);
1497                 if (!ret) {
1498                         return false;
1499                 }
1500
1501                 if (*s == ')') {
1502                         /* end of list, return */
1503                         if (!asn1_pop_tag(data)) return false;
1504                         break;
1505                 }
1506         }
1507
1508 done:
1509         if (*s != ')') {
1510                 tldap_debug(ld, TLDAP_DEBUG_ERROR,
1511                             "Incomplete or malformed filter\n");
1512                 return false;
1513         }
1514         s++;
1515
1516         if (asn1_has_error(data)) {
1517                 return false;
1518         }
1519
1520         *_s = s;
1521         return true;
1522 }
1523
1524
1525 static bool tldap_push_filter_basic(struct tldap_context *ld,
1526                                     struct asn1_data *data,
1527                                     const char **_s)
1528 {
1529         TALLOC_CTX *tmpctx = talloc_tos();
1530         const char *s = *_s;
1531         const char *e;
1532         const char *eq;
1533         const char *val;
1534         const char *type;
1535         const char *dn;
1536         const char *rule;
1537         const char *star;
1538         size_t type_len = 0;
1539         char *uval;
1540         size_t uval_len;
1541         bool write_octect = true;
1542         bool ret;
1543
1544         eq = strchr(s, '=');
1545         if (!eq) {
1546                 tldap_debug(ld, TLDAP_DEBUG_ERROR,
1547                             "Invalid filter, missing equal sign\n");
1548                 return false;
1549         }
1550
1551         val = eq + 1;
1552         e = eq - 1;
1553
1554         switch (*e) {
1555         case '<':
1556                 if (!asn1_push_tag(data, TLDAP_FILTER_LE)) return false;
1557                 break;
1558
1559         case '>':
1560                 if (!asn1_push_tag(data, TLDAP_FILTER_GE)) return false;
1561                 break;
1562
1563         case '~':
1564                 if (!asn1_push_tag(data, TLDAP_FILTER_APX)) return false;
1565                 break;
1566
1567         case ':':
1568                 if (!asn1_push_tag(data, TLDAP_FILTER_EXT)) return false;
1569                 write_octect = false;
1570
1571                 type = NULL;
1572                 dn = NULL;
1573                 rule = NULL;
1574
1575                 if (*s == ':') { /* [:dn]:rule:= value */
1576                         if (s == e) {
1577                                 /* malformed filter */
1578                                 return false;
1579                         }
1580                         dn = s;
1581                 } else { /* type[:dn][:rule]:= value */
1582                         type = s;
1583                         dn = strchr(s, ':');
1584                         type_len = dn - type;
1585                         if (dn == e) { /* type:= value */
1586                                 dn = NULL;
1587                         }
1588                 }
1589                 if (dn) {
1590                         dn++;
1591
1592                         rule = strchr(dn, ':');
1593                         if (rule == NULL) {
1594                                 return false;
1595                         }
1596                         if ((rule == dn + 1) || rule + 1 == e) {
1597                                 /* malformed filter, contains "::" */
1598                                 return false;
1599                         }
1600
1601                         if (strncasecmp_m(dn, "dn:", 3) != 0) {
1602                                 if (rule == e) {
1603                                         rule = dn;
1604                                         dn = NULL;
1605                                 } else {
1606                                         /* malformed filter. With two
1607                                          * optionals, the first must be "dn"
1608                                          */
1609                                         return false;
1610                                 }
1611                         } else {
1612                                 if (rule == e) {
1613                                         rule = NULL;
1614                                 } else {
1615                                         rule++;
1616                                 }
1617                         }
1618                 }
1619
1620                 if (!type && !dn && !rule) {
1621                         /* malformed filter, there must be at least one */
1622                         return false;
1623                 }
1624
1625                 /*
1626                   MatchingRuleAssertion ::= SEQUENCE {
1627                   matchingRule    [1] MatchingRuleID OPTIONAL,
1628                   type      [2] AttributeDescription OPTIONAL,
1629                   matchValue      [3] AssertionValue,
1630                   dnAttributes    [4] BOOLEAN DEFAULT FALSE
1631                   }
1632                 */
1633
1634                 /* check and add rule */
1635                 if (rule) {
1636                         ret = tldap_is_attrdesc(rule, e - rule, true);
1637                         if (!ret) {
1638                                 return false;
1639                         }
1640                         if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(1))) return false;
1641                         if (!asn1_write(data, rule, e - rule)) return false;
1642                         if (!asn1_pop_tag(data)) return false;
1643                 }
1644
1645                 /* check and add type */
1646                 if (type) {
1647                         ret = tldap_is_attrdesc(type, type_len, false);
1648                         if (!ret) {
1649                                 return false;
1650                         }
1651                         if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(2))) return false;
1652                         if (!asn1_write(data, type, type_len)) return false;
1653                         if (!asn1_pop_tag(data)) return false;
1654                 }
1655
1656                 uval = tldap_get_val(tmpctx, val, _s);
1657                 if (!uval) {
1658                         return false;
1659                 }
1660                 uval_len = *_s - val;
1661                 ret = tldap_unescape_inplace(uval, &uval_len);
1662                 if (!ret) {
1663                         return false;
1664                 }
1665
1666                 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(3))) return false;
1667                 if (!asn1_write(data, uval, uval_len)) return false;
1668                 if (!asn1_pop_tag(data)) return false;
1669
1670                 if (!asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(4))) return false;
1671                 if (!asn1_write_uint8(data, dn?1:0)) return false;
1672                 if (!asn1_pop_tag(data)) return false;
1673                 break;
1674
1675         default:
1676                 e = eq;
1677
1678                 ret = tldap_is_attrdesc(s, e - s, false);
1679                 if (!ret) {
1680                         return false;
1681                 }
1682
1683                 if (strncmp(val, "*)", 2) == 0) {
1684                         /* presence */
1685                         if (!asn1_push_tag(data, TLDAP_FILTER_PRES)) return false;
1686                         if (!asn1_write(data, s, e - s)) return false;
1687                         *_s = val + 1;
1688                         write_octect = false;
1689                         break;
1690                 }
1691
1692                 ret = tldap_find_first_star(val, &star);
1693                 if (!ret) {
1694                         return false;
1695                 }
1696                 if (*star == '*') {
1697                         /* substring */
1698                         if (!asn1_push_tag(data, TLDAP_FILTER_SUB)) return false;
1699                         if (!asn1_write_OctetString(data, s, e - s)) return false;
1700                         ret = tldap_push_filter_substring(ld, data, val, &s);
1701                         if (!ret) {
1702                                 return false;
1703                         }
1704                         *_s = s;
1705                         write_octect = false;
1706                         break;
1707                 }
1708
1709                 /* if nothing else, then it is just equality */
1710                 if (!asn1_push_tag(data, TLDAP_FILTER_EQ)) return false;
1711                 write_octect = true;
1712                 break;
1713         }
1714
1715         if (write_octect) {
1716                 uval = tldap_get_val(tmpctx, val, _s);
1717                 if (!uval) {
1718                         return false;
1719                 }
1720                 uval_len = *_s - val;
1721                 ret = tldap_unescape_inplace(uval, &uval_len);
1722                 if (!ret) {
1723                         return false;
1724                 }
1725
1726                 if (!asn1_write_OctetString(data, s, e - s)) return false;
1727                 if (!asn1_write_OctetString(data, uval, uval_len)) return false;
1728         }
1729
1730         if (asn1_has_error(data)) {
1731                 return false;
1732         }
1733         return asn1_pop_tag(data);
1734 }
1735
1736 static bool tldap_push_filter_substring(struct tldap_context *ld,
1737                                         struct asn1_data *data,
1738                                         const char *val,
1739                                         const char **_s)
1740 {
1741         TALLOC_CTX *tmpctx = talloc_tos();
1742         bool initial = true;
1743         const char *star;
1744         char *chunk;
1745         size_t chunk_len;
1746         bool ret;
1747
1748         /*
1749           SubstringFilter ::= SEQUENCE {
1750                   type      AttributeDescription,
1751                   -- at least one must be present
1752                   substrings      SEQUENCE OF CHOICE {
1753                           initial [0] LDAPString,
1754                           any     [1] LDAPString,
1755                           final   [2] LDAPString } }
1756         */
1757         if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) return false;
1758
1759         do {
1760                 ret = tldap_find_first_star(val, &star);
1761                 if (!ret) {
1762                         return false;
1763                 }
1764                 chunk_len = star - val;
1765
1766                 switch (*star) {
1767                 case '*':
1768                         if (!initial && chunk_len == 0) {
1769                                 /* found '**', which is illegal */
1770                                 return false;
1771                         }
1772                         break;
1773                 case ')':
1774                         if (initial) {
1775                                 /* no stars ?? */
1776                                 return false;
1777                         }
1778                         /* we are done */
1779                         break;
1780                 default:
1781                         /* ?? */
1782                         return false;
1783                 }
1784
1785                 if (initial && chunk_len == 0) {
1786                         val = star + 1;
1787                         initial = false;
1788                         continue;
1789                 }
1790
1791                 chunk = talloc_strndup(tmpctx, val, chunk_len);
1792                 if (!chunk) {
1793                         return false;
1794                 }
1795                 ret = tldap_unescape_inplace(chunk, &chunk_len);
1796                 if (!ret) {
1797                         return false;
1798                 }
1799                 switch (*star) {
1800                 case '*':
1801                         if (initial) {
1802                                 if (!asn1_push_tag(data, TLDAP_SUB_INI)) return false;
1803                                 initial = false;
1804                         } else {
1805                                 if (!asn1_push_tag(data, TLDAP_SUB_ANY)) return false;
1806                         }
1807                         break;
1808                 case ')':
1809                         if (!asn1_push_tag(data, TLDAP_SUB_FIN)) return false;
1810                         break;
1811                 default:
1812                         /* ?? */
1813                         return false;
1814                 }
1815                 if (!asn1_write(data, chunk, chunk_len)) return false;
1816                 if (!asn1_pop_tag(data)) return false;
1817
1818                 val = star + 1;
1819
1820         } while (*star == '*');
1821
1822         *_s = star;
1823
1824         /* end of sequence */
1825         return asn1_pop_tag(data);
1826 }
1827
1828 /* NOTE: although openldap libraries allow for spaces in some places, mostly
1829  * around parentheses, we do not allow any spaces (except in values of
1830  * course) as I couldn't find any place in RFC 4512 or RFC 4515 where
1831  * leading or trailing spaces were allowed.
1832  */
1833 static bool tldap_push_filter(struct tldap_context *ld,
1834                               struct asn1_data *data,
1835                               const char *filter)
1836 {
1837         const char *s = filter;
1838         bool ret;
1839
1840         ret = tldap_push_filter_int(ld, data, &s);
1841         if (ret && *s) {
1842                 tldap_debug(ld, TLDAP_DEBUG_ERROR,
1843                             "Incomplete or malformed filter\n");
1844                 return false;
1845         }
1846         return ret;
1847 }
1848
1849 /*****************************************************************************/
1850
1851 static void tldap_search_done(struct tevent_req *subreq);
1852
1853 struct tevent_req *tldap_search_send(TALLOC_CTX *mem_ctx,
1854                                      struct tevent_context *ev,
1855                                      struct tldap_context *ld,
1856                                      const char *base, int scope,
1857                                      const char *filter,
1858                                      const char **attrs,
1859                                      int num_attrs,
1860                                      int attrsonly,
1861                                      struct tldap_control *sctrls,
1862                                      int num_sctrls,
1863                                      struct tldap_control *cctrls,
1864                                      int num_cctrls,
1865                                      int timelimit,
1866                                      int sizelimit,
1867                                      int deref)
1868 {
1869         struct tevent_req *req, *subreq;
1870         struct tldap_req_state *state;
1871         int i;
1872
1873         req = tldap_req_create(mem_ctx, ld, &state);
1874         if (req == NULL) {
1875                 return NULL;
1876         }
1877
1878         if (!asn1_push_tag(state->out, TLDAP_REQ_SEARCH)) goto encoding_error;
1879         if (!asn1_write_OctetString(state->out, base, strlen(base))) goto encoding_error;
1880         if (!asn1_write_enumerated(state->out, scope)) goto encoding_error;
1881         if (!asn1_write_enumerated(state->out, deref)) goto encoding_error;
1882         if (!asn1_write_Integer(state->out, sizelimit)) goto encoding_error;
1883         if (!asn1_write_Integer(state->out, timelimit)) goto encoding_error;
1884         if (!asn1_write_BOOLEAN(state->out, attrsonly)) goto encoding_error;
1885
1886         if (!tldap_push_filter(ld, state->out, filter)) {
1887                 goto encoding_error;
1888         }
1889
1890         if (!asn1_push_tag(state->out, ASN1_SEQUENCE(0))) goto encoding_error;
1891         for (i=0; i<num_attrs; i++) {
1892                 if (!asn1_write_OctetString(state->out, attrs[i], strlen(attrs[i]))) goto encoding_error;
1893         }
1894         if (!asn1_pop_tag(state->out)) goto encoding_error;
1895         if (!asn1_pop_tag(state->out)) goto encoding_error;
1896
1897         subreq = tldap_msg_send(state, ev, ld, state->id, state->out,
1898                                 sctrls, num_sctrls);
1899         if (tevent_req_nomem(subreq, req)) {
1900                 return tevent_req_post(req, ev);
1901         }
1902         tevent_req_set_callback(subreq, tldap_search_done, req);
1903         return req;
1904
1905  encoding_error:
1906         tevent_req_ldap_error(req, TLDAP_ENCODING_ERROR);
1907         return tevent_req_post(req, ev);
1908 }
1909
1910 static void tldap_search_done(struct tevent_req *subreq)
1911 {
1912         struct tevent_req *req = tevent_req_callback_data(
1913                 subreq, struct tevent_req);
1914         struct tldap_req_state *state = tevent_req_data(
1915                 req, struct tldap_req_state);
1916         TLDAPRC rc;
1917
1918         rc = tldap_msg_recv(subreq, state, &state->result);
1919         if (tevent_req_ldap_error(req, rc)) {
1920                 return;
1921         }
1922         switch (state->result->type) {
1923         case TLDAP_RES_SEARCH_ENTRY:
1924         case TLDAP_RES_SEARCH_REFERENCE:
1925                 if (!tldap_msg_set_pending(subreq)) {
1926                         tevent_req_oom(req);
1927                         return;
1928                 }
1929                 tevent_req_notify_callback(req);
1930                 break;
1931         case TLDAP_RES_SEARCH_RESULT:
1932                 TALLOC_FREE(subreq);
1933                 if (!asn1_start_tag(state->result->data,
1934                                     state->result->type) ||
1935                     !tldap_decode_response(state) ||
1936                     !asn1_end_tag(state->result->data) ||
1937                     !tldap_decode_controls(state)) {
1938                         tevent_req_ldap_error(req, TLDAP_DECODING_ERROR);
1939                         return;
1940                 }
1941                 tevent_req_done(req);
1942                 break;
1943         default:
1944                 tevent_req_ldap_error(req, TLDAP_PROTOCOL_ERROR);
1945                 return;
1946         }
1947 }
1948
1949 TLDAPRC tldap_search_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1950                           struct tldap_message **pmsg)
1951 {
1952         struct tldap_req_state *state = tevent_req_data(
1953                 req, struct tldap_req_state);
1954         TLDAPRC rc;
1955
1956         if (!tevent_req_is_in_progress(req)
1957             && tevent_req_is_ldap_error(req, &rc)) {
1958                 return rc;
1959         }
1960
1961         if (tevent_req_is_in_progress(req)) {
1962                 switch (state->result->type) {
1963                 case TLDAP_RES_SEARCH_ENTRY:
1964                 case TLDAP_RES_SEARCH_REFERENCE:
1965                         break;
1966                 default:
1967                         return TLDAP_OPERATIONS_ERROR;
1968                 }
1969         }
1970
1971         *pmsg = talloc_move(mem_ctx, &state->result);
1972         return TLDAP_SUCCESS;
1973 }
1974
1975 struct tldap_search_all_state {
1976         struct tldap_message **msgs;
1977         struct tldap_message *result;
1978 };
1979
1980 static void tldap_search_all_done(struct tevent_req *subreq);
1981
1982 struct tevent_req *tldap_search_all_send(
1983         TALLOC_CTX *mem_ctx, struct tevent_context *ev,
1984         struct tldap_context *ld, const char *base, int scope,
1985         const char *filter, const char **attrs, int num_attrs, int attrsonly,
1986         struct tldap_control *sctrls, int num_sctrls,
1987         struct tldap_control *cctrls, int num_cctrls,
1988         int timelimit, int sizelimit, int deref)
1989 {
1990         struct tevent_req *req, *subreq;
1991         struct tldap_search_all_state *state;
1992
1993         req = tevent_req_create(mem_ctx, &state,
1994                                 struct tldap_search_all_state);
1995         if (req == NULL) {
1996                 return NULL;
1997         }
1998
1999         subreq = tldap_search_send(state, ev, ld, base, scope, filter,
2000                                    attrs, num_attrs, attrsonly,
2001                                    sctrls, num_sctrls, cctrls, num_cctrls,
2002                                    timelimit, sizelimit, deref);
2003         if (tevent_req_nomem(subreq, req)) {
2004                 return tevent_req_post(req, ev);
2005         }
2006         tevent_req_set_callback(subreq, tldap_search_all_done, req);
2007         return req;
2008 }
2009
2010 static void tldap_search_all_done(struct tevent_req *subreq)
2011 {
2012         struct tevent_req *req = tevent_req_callback_data(
2013                 subreq, struct tevent_req);
2014         struct tldap_search_all_state *state = tevent_req_data(
2015                 req, struct tldap_search_all_state);
2016         struct tldap_message *msg, **tmp;
2017         size_t num_msgs;
2018         TLDAPRC rc;
2019         int msgtype;
2020
2021         rc = tldap_search_recv(subreq, state, &msg);
2022         /* No TALLOC_FREE(subreq), this is multi-step */
2023         if (tevent_req_ldap_error(req, rc)) {
2024                 return;
2025         }
2026
2027         msgtype = tldap_msg_type(msg);
2028         if (msgtype == TLDAP_RES_SEARCH_RESULT) {
2029                 state->result = msg;
2030                 tevent_req_done(req);
2031                 return;
2032         }
2033
2034         num_msgs = talloc_array_length(state->msgs);
2035
2036         tmp = talloc_realloc(state, state->msgs, struct tldap_message *,
2037                              num_msgs + 1);
2038         if (tevent_req_nomem(tmp, req)) {
2039                 return;
2040         }
2041         state->msgs = tmp;
2042         state->msgs[num_msgs] = talloc_move(state->msgs, &msg);
2043 }
2044
2045 TLDAPRC tldap_search_all_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
2046                               struct tldap_message ***msgs,
2047                               struct tldap_message **result)
2048 {
2049         struct tldap_search_all_state *state = tevent_req_data(
2050                 req, struct tldap_search_all_state);
2051         TLDAPRC rc;
2052
2053         if (tevent_req_is_ldap_error(req, &rc)) {
2054                 return rc;
2055         }
2056
2057         if (msgs != NULL) {
2058                 *msgs = talloc_move(mem_ctx, &state->msgs);
2059         }
2060         if (result != NULL) {
2061                 *result = talloc_move(mem_ctx, &state->result);
2062         }
2063
2064         return TLDAP_SUCCESS;
2065 }
2066
2067 TLDAPRC tldap_search(struct tldap_context *ld,
2068                      const char *base, int scope, const char *filter,
2069                      const char **attrs, int num_attrs, int attrsonly,
2070                      struct tldap_control *sctrls, int num_sctrls,
2071                      struct tldap_control *cctrls, int num_cctrls,
2072                      int timelimit, int sizelimit, int deref,
2073                      TALLOC_CTX *mem_ctx, struct tldap_message ***pmsgs)
2074 {
2075         TALLOC_CTX *frame;
2076         struct tevent_context *ev;
2077         struct tevent_req *req;
2078         TLDAPRC rc = TLDAP_NO_MEMORY;
2079         struct tldap_message **msgs;
2080         struct tldap_message *result;
2081
2082         if (tldap_pending_reqs(ld)) {
2083                 return TLDAP_BUSY;
2084         }
2085
2086         frame = talloc_stackframe();
2087
2088         ev = samba_tevent_context_init(frame);
2089         if (ev == NULL) {
2090                 goto fail;
2091         }
2092         req = tldap_search_all_send(frame, ev, ld, base, scope, filter,
2093                                     attrs, num_attrs, attrsonly,
2094                                     sctrls, num_sctrls, cctrls, num_cctrls,
2095                                     timelimit, sizelimit, deref);
2096         if (req == NULL) {
2097                 goto fail;
2098         }
2099         if (!tevent_req_poll(req, ev)) {
2100                 rc = TLDAP_OPERATIONS_ERROR;
2101                 goto fail;
2102         }
2103         rc = tldap_search_all_recv(req, frame, &msgs, &result);
2104         TALLOC_FREE(req);
2105         if (!TLDAP_RC_IS_SUCCESS(rc)) {
2106                 goto fail;
2107         }
2108
2109         TALLOC_FREE(ld->last_msg);
2110         ld->last_msg = talloc_move(ld, &result);
2111
2112         if (pmsgs != NULL) {
2113                 *pmsgs = talloc_move(mem_ctx, &msgs);
2114         }
2115 fail:
2116         TALLOC_FREE(frame);
2117         return rc;
2118 }
2119
2120 static bool tldap_parse_search_entry(struct tldap_message *msg)
2121 {
2122         int num_attribs = 0;
2123
2124         if (msg->type != TLDAP_RES_SEARCH_ENTRY) {
2125                 return false;
2126         }
2127         if (!asn1_start_tag(msg->data, TLDAP_RES_SEARCH_ENTRY)) {
2128                 return false;
2129         }
2130
2131         /* dn */
2132
2133         if (!asn1_read_OctetString_talloc(msg, msg->data, &msg->dn)) return false;
2134
2135         if (msg->dn == NULL) {
2136                 return false;
2137         }
2138
2139         /*
2140          * Attributes: We overallocate msg->attribs by one, so that while
2141          * looping over the attributes we can directly parse into the last
2142          * array element. Same for the values in the inner loop.
2143          */
2144
2145         msg->attribs = talloc_array(msg, struct tldap_attribute, 1);
2146         if (msg->attribs == NULL) {
2147                 return false;
2148         }
2149
2150         if (!asn1_start_tag(msg->data, ASN1_SEQUENCE(0))) return false;
2151         while (asn1_peek_tag(msg->data, ASN1_SEQUENCE(0))) {
2152                 struct tldap_attribute *attrib;
2153                 int num_values = 0;
2154
2155                 attrib = &msg->attribs[num_attribs];
2156                 attrib->values = talloc_array(msg->attribs, DATA_BLOB, 1);
2157                 if (attrib->values == NULL) {
2158                         return false;
2159                 }
2160                 if (!asn1_start_tag(msg->data, ASN1_SEQUENCE(0))) return false;
2161                 if (!asn1_read_OctetString_talloc(msg->attribs, msg->data,
2162                                              &attrib->name)) return false;
2163                 if (!asn1_start_tag(msg->data, ASN1_SET)) return false;
2164
2165                 while (asn1_peek_tag(msg->data, ASN1_OCTET_STRING)) {
2166                         if (!asn1_read_OctetString(msg->data, msg,
2167                                               &attrib->values[num_values])) return false;
2168
2169                         attrib->values = talloc_realloc(
2170                                 msg->attribs, attrib->values, DATA_BLOB,
2171                                 num_values + 2);
2172                         if (attrib->values == NULL) {
2173                                 return false;
2174                         }
2175                         num_values += 1;
2176                 }
2177                 attrib->values = talloc_realloc(msg->attribs, attrib->values,
2178                                                 DATA_BLOB, num_values);
2179                 attrib->num_values = num_values;
2180
2181                 if (!asn1_end_tag(msg->data)) return false; /* ASN1_SET */
2182                 if (!asn1_end_tag(msg->data)) return false; /* ASN1_SEQUENCE(0) */
2183                 msg->attribs = talloc_realloc(
2184                         msg, msg->attribs, struct tldap_attribute,
2185                         num_attribs + 2);
2186                 if (msg->attribs == NULL) {
2187                         return false;
2188                 }
2189                 num_attribs += 1;
2190         }
2191         msg->attribs = talloc_realloc(
2192                 msg, msg->attribs, struct tldap_attribute, num_attribs);
2193         return asn1_end_tag(msg->data);
2194 }
2195
2196 bool tldap_entry_dn(struct tldap_message *msg, char **dn)
2197 {
2198         if ((msg->dn == NULL) && (!tldap_parse_search_entry(msg))) {
2199                 return false;
2200         }
2201         *dn = msg->dn;
2202         return true;
2203 }
2204
2205 bool tldap_entry_attributes(struct tldap_message *msg,
2206                             struct tldap_attribute **attributes,
2207                             int *num_attributes)
2208 {
2209         if ((msg->dn == NULL) && (!tldap_parse_search_entry(msg))) {
2210                 return false;
2211         }
2212         *attributes = msg->attribs;
2213         *num_attributes = talloc_array_length(msg->attribs);
2214         return true;
2215 }
2216
2217 static bool tldap_decode_controls(struct tldap_req_state *state)
2218 {
2219         struct tldap_message *msg = state->result;
2220         struct asn1_data *data = msg->data;
2221         struct tldap_control *sctrls = NULL;
2222         int num_controls = 0;
2223         bool ret = false;
2224
2225         msg->res_sctrls = NULL;
2226
2227         if (!asn1_peek_tag(data, ASN1_CONTEXT(0))) {
2228                 return true;
2229         }
2230
2231         if (!asn1_start_tag(data, ASN1_CONTEXT(0))) goto out;
2232
2233         while (asn1_peek_tag(data, ASN1_SEQUENCE(0))) {
2234                 struct tldap_control *c;
2235                 char *oid = NULL;
2236
2237                 sctrls = talloc_realloc(msg, sctrls, struct tldap_control,
2238                                         num_controls + 1);
2239                 if (sctrls == NULL) {
2240                         goto out;
2241                 }
2242                 c = &sctrls[num_controls];
2243
2244                 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) goto out;
2245                 if (!asn1_read_OctetString_talloc(msg, data, &oid)) goto out;
2246                 if (asn1_has_error(data) || (oid == NULL)) {
2247                         goto out;
2248                 }
2249                 c->oid = oid;
2250                 if (asn1_peek_tag(data, ASN1_BOOLEAN)) {
2251                         if (!asn1_read_BOOLEAN(data, &c->critical)) goto out;
2252                 } else {
2253                         c->critical = false;
2254                 }
2255                 c->value = data_blob_null;
2256                 if (asn1_peek_tag(data, ASN1_OCTET_STRING) &&
2257                     !asn1_read_OctetString(data, msg, &c->value)) {
2258                         goto out;
2259                 }
2260                 if (!asn1_end_tag(data)) goto out; /* ASN1_SEQUENCE(0) */
2261
2262                 num_controls += 1;
2263         }
2264
2265         if (!asn1_end_tag(data)) goto out;      /* ASN1_CONTEXT(0) */
2266
2267         ret = true;
2268
2269  out:
2270
2271         if (ret) {
2272                 msg->res_sctrls = sctrls;
2273         } else {
2274                 TALLOC_FREE(sctrls);
2275         }
2276         return ret;
2277 }
2278
2279 static void tldap_simple_done(struct tevent_req *subreq, int type)
2280 {
2281         struct tevent_req *req = tevent_req_callback_data(
2282                 subreq, struct tevent_req);
2283         struct tldap_req_state *state = tevent_req_data(
2284                 req, struct tldap_req_state);
2285         TLDAPRC rc;
2286
2287         rc = tldap_msg_recv(subreq, state, &state->result);
2288         TALLOC_FREE(subreq);
2289         if (tevent_req_ldap_error(req, rc)) {
2290                 return;
2291         }
2292         if (state->result->type != type) {
2293                 tevent_req_ldap_error(req, TLDAP_PROTOCOL_ERROR);
2294                 return;
2295         }
2296         if (!asn1_start_tag(state->result->data, state->result->type) ||
2297             !tldap_decode_response(state) ||
2298             !asn1_end_tag(state->result->data) ||
2299             !tldap_decode_controls(state)) {
2300                 tevent_req_ldap_error(req, TLDAP_DECODING_ERROR);
2301                 return;
2302         }
2303         if (!TLDAP_RC_IS_SUCCESS(state->result->lderr)) {
2304                 tevent_req_ldap_error(req, state->result->lderr);
2305                 return;
2306         }
2307         tevent_req_done(req);
2308 }
2309
2310 static TLDAPRC tldap_simple_recv(struct tevent_req *req)
2311 {
2312         TLDAPRC rc;
2313         if (tevent_req_is_ldap_error(req, &rc)) {
2314                 return rc;
2315         }
2316         return TLDAP_SUCCESS;
2317 }
2318
2319 static void tldap_add_done(struct tevent_req *subreq);
2320
2321 struct tevent_req *tldap_add_send(TALLOC_CTX *mem_ctx,
2322                                   struct tevent_context *ev,
2323                                   struct tldap_context *ld,
2324                                   const char *dn,
2325                                   struct tldap_mod *attributes,
2326                                   int num_attributes,
2327                                   struct tldap_control *sctrls,
2328                                   int num_sctrls,
2329                                   struct tldap_control *cctrls,
2330                                   int num_cctrls)
2331 {
2332         struct tevent_req *req, *subreq;
2333         struct tldap_req_state *state;
2334         int i, j;
2335
2336         req = tldap_req_create(mem_ctx, ld, &state);
2337         if (req == NULL) {
2338                 return NULL;
2339         }
2340
2341         if (!asn1_push_tag(state->out, TLDAP_REQ_ADD)) goto err;
2342         if (!asn1_write_OctetString(state->out, dn, strlen(dn))) goto err;
2343         if (!asn1_push_tag(state->out, ASN1_SEQUENCE(0))) goto err;
2344
2345         for (i=0; i<num_attributes; i++) {
2346                 struct tldap_mod *attrib = &attributes[i];
2347                 if (!asn1_push_tag(state->out, ASN1_SEQUENCE(0))) goto err;
2348                 if (!asn1_write_OctetString(state->out, attrib->attribute,
2349                                        strlen(attrib->attribute))) goto err;
2350                 if (!asn1_push_tag(state->out, ASN1_SET)) goto err;
2351                 for (j=0; j<attrib->num_values; j++) {
2352                         if (!asn1_write_OctetString(state->out,
2353                                                attrib->values[j].data,
2354                                                attrib->values[j].length)) goto err;
2355                 }
2356                 if (!asn1_pop_tag(state->out)) goto err;
2357                 if (!asn1_pop_tag(state->out)) goto err;
2358         }
2359
2360         if (!asn1_pop_tag(state->out)) goto err;
2361         if (!asn1_pop_tag(state->out)) goto err;
2362
2363         subreq = tldap_msg_send(state, ev, ld, state->id, state->out,
2364                                 sctrls, num_sctrls);
2365         if (tevent_req_nomem(subreq, req)) {
2366                 return tevent_req_post(req, ev);
2367         }
2368         tevent_req_set_callback(subreq, tldap_add_done, req);
2369         return req;
2370
2371   err:
2372
2373         tevent_req_ldap_error(req, TLDAP_ENCODING_ERROR);
2374         return tevent_req_post(req, ev);
2375 }
2376
2377 static void tldap_add_done(struct tevent_req *subreq)
2378 {
2379         tldap_simple_done(subreq, TLDAP_RES_ADD);
2380 }
2381
2382 TLDAPRC tldap_add_recv(struct tevent_req *req)
2383 {
2384         return tldap_simple_recv(req);
2385 }
2386
2387 TLDAPRC tldap_add(struct tldap_context *ld, const char *dn,
2388                   struct tldap_mod *attributes, int num_attributes,
2389                   struct tldap_control *sctrls, int num_sctrls,
2390                   struct tldap_control *cctrls, int num_cctrls)
2391 {
2392         TALLOC_CTX *frame = talloc_stackframe();
2393         struct tevent_context *ev;
2394         struct tevent_req *req;
2395         TLDAPRC rc = TLDAP_NO_MEMORY;
2396
2397         ev = samba_tevent_context_init(frame);
2398         if (ev == NULL) {
2399                 goto fail;
2400         }
2401         req = tldap_add_send(frame, ev, ld, dn, attributes, num_attributes,
2402                              sctrls, num_sctrls, cctrls, num_cctrls);
2403         if (req == NULL) {
2404                 goto fail;
2405         }
2406         if (!tevent_req_poll(req, ev)) {
2407                 rc = TLDAP_OPERATIONS_ERROR;
2408                 goto fail;
2409         }
2410         rc = tldap_add_recv(req);
2411         tldap_save_msg(ld, req);
2412  fail:
2413         TALLOC_FREE(frame);
2414         return rc;
2415 }
2416
2417 static void tldap_modify_done(struct tevent_req *subreq);
2418
2419 struct tevent_req *tldap_modify_send(TALLOC_CTX *mem_ctx,
2420                                      struct tevent_context *ev,
2421                                      struct tldap_context *ld,
2422                                      const char *dn,
2423                                      struct tldap_mod *mods, int num_mods,
2424                                      struct tldap_control *sctrls,
2425                                      int num_sctrls,
2426                                      struct tldap_control *cctrls,
2427                                      int num_cctrls)
2428 {
2429         struct tevent_req *req, *subreq;
2430         struct tldap_req_state *state;
2431         int i, j;
2432
2433         req = tldap_req_create(mem_ctx, ld, &state);
2434         if (req == NULL) {
2435                 return NULL;
2436         }
2437
2438         if (!asn1_push_tag(state->out, TLDAP_REQ_MODIFY)) goto err;
2439         if (!asn1_write_OctetString(state->out, dn, strlen(dn))) goto err;
2440         if (!asn1_push_tag(state->out, ASN1_SEQUENCE(0))) goto err;
2441
2442         for (i=0; i<num_mods; i++) {
2443                 struct tldap_mod *mod = &mods[i];
2444                 if (!asn1_push_tag(state->out, ASN1_SEQUENCE(0))) goto err;
2445                 if (!asn1_write_enumerated(state->out, mod->mod_op)) goto err;
2446                 if (!asn1_push_tag(state->out, ASN1_SEQUENCE(0))) goto err;
2447                 if (!asn1_write_OctetString(state->out, mod->attribute,
2448                                        strlen(mod->attribute))) goto err;
2449                 if (!asn1_push_tag(state->out, ASN1_SET)) goto err;
2450                 for (j=0; j<mod->num_values; j++) {
2451                         if (!asn1_write_OctetString(state->out,
2452                                                mod->values[j].data,
2453                                                mod->values[j].length)) goto err;
2454                 }
2455                 if (!asn1_pop_tag(state->out)) goto err;
2456                 if (!asn1_pop_tag(state->out)) goto err;
2457                 if (!asn1_pop_tag(state->out)) goto err;
2458         }
2459
2460         if (!asn1_pop_tag(state->out)) goto err;
2461         if (!asn1_pop_tag(state->out)) goto err;
2462
2463         subreq = tldap_msg_send(state, ev, ld, state->id, state->out,
2464                                 sctrls, num_sctrls);
2465         if (tevent_req_nomem(subreq, req)) {
2466                 return tevent_req_post(req, ev);
2467         }
2468         tevent_req_set_callback(subreq, tldap_modify_done, req);
2469         return req;
2470
2471   err:
2472
2473         tevent_req_ldap_error(req, TLDAP_ENCODING_ERROR);
2474         return tevent_req_post(req, ev);
2475 }
2476
2477 static void tldap_modify_done(struct tevent_req *subreq)
2478 {
2479         tldap_simple_done(subreq, TLDAP_RES_MODIFY);
2480 }
2481
2482 TLDAPRC tldap_modify_recv(struct tevent_req *req)
2483 {
2484         return tldap_simple_recv(req);
2485 }
2486
2487 TLDAPRC tldap_modify(struct tldap_context *ld, const char *dn,
2488                      struct tldap_mod *mods, int num_mods,
2489                      struct tldap_control *sctrls, int num_sctrls,
2490                      struct tldap_control *cctrls, int num_cctrls)
2491  {
2492         TALLOC_CTX *frame = talloc_stackframe();
2493         struct tevent_context *ev;
2494         struct tevent_req *req;
2495         TLDAPRC rc = TLDAP_NO_MEMORY;
2496
2497         ev = samba_tevent_context_init(frame);
2498         if (ev == NULL) {
2499                 goto fail;
2500         }
2501         req = tldap_modify_send(frame, ev, ld, dn, mods, num_mods,
2502                                 sctrls, num_sctrls, cctrls, num_cctrls);
2503         if (req == NULL) {
2504                 goto fail;
2505         }
2506         if (!tevent_req_poll(req, ev)) {
2507                 rc = TLDAP_OPERATIONS_ERROR;
2508                 goto fail;
2509         }
2510         rc = tldap_modify_recv(req);
2511         tldap_save_msg(ld, req);
2512  fail:
2513         TALLOC_FREE(frame);
2514         return rc;
2515 }
2516
2517 static void tldap_delete_done(struct tevent_req *subreq);
2518
2519 struct tevent_req *tldap_delete_send(TALLOC_CTX *mem_ctx,
2520                                      struct tevent_context *ev,
2521                                      struct tldap_context *ld,
2522                                      const char *dn,
2523                                      struct tldap_control *sctrls,
2524                                      int num_sctrls,
2525                                      struct tldap_control *cctrls,
2526                                      int num_cctrls)
2527 {
2528         struct tevent_req *req, *subreq;
2529         struct tldap_req_state *state;
2530
2531         req = tldap_req_create(mem_ctx, ld, &state);
2532         if (req == NULL) {
2533                 return NULL;
2534         }
2535
2536         if (!asn1_push_tag(state->out, TLDAP_REQ_DELETE)) goto err;
2537         if (!asn1_write(state->out, dn, strlen(dn))) goto err;
2538         if (!asn1_pop_tag(state->out)) goto err;
2539
2540         subreq = tldap_msg_send(state, ev, ld, state->id, state->out,
2541                                 sctrls, num_sctrls);
2542         if (tevent_req_nomem(subreq, req)) {
2543                 return tevent_req_post(req, ev);
2544         }
2545         tevent_req_set_callback(subreq, tldap_delete_done, req);
2546         return req;
2547
2548   err:
2549
2550         tevent_req_ldap_error(req, TLDAP_ENCODING_ERROR);
2551         return tevent_req_post(req, ev);
2552 }
2553
2554 static void tldap_delete_done(struct tevent_req *subreq)
2555 {
2556         tldap_simple_done(subreq, TLDAP_RES_DELETE);
2557 }
2558
2559 TLDAPRC tldap_delete_recv(struct tevent_req *req)
2560 {
2561         return tldap_simple_recv(req);
2562 }
2563
2564 TLDAPRC tldap_delete(struct tldap_context *ld, const char *dn,
2565                      struct tldap_control *sctrls, int num_sctrls,
2566                      struct tldap_control *cctrls, int num_cctrls)
2567 {
2568         TALLOC_CTX *frame = talloc_stackframe();
2569         struct tevent_context *ev;
2570         struct tevent_req *req;
2571         TLDAPRC rc = TLDAP_NO_MEMORY;
2572
2573         ev = samba_tevent_context_init(frame);
2574         if (ev == NULL) {
2575                 goto fail;
2576         }
2577         req = tldap_delete_send(frame, ev, ld, dn, sctrls, num_sctrls,
2578                                 cctrls, num_cctrls);
2579         if (req == NULL) {
2580                 goto fail;
2581         }
2582         if (!tevent_req_poll(req, ev)) {
2583                 rc = TLDAP_OPERATIONS_ERROR;
2584                 goto fail;
2585         }
2586         rc = tldap_delete_recv(req);
2587         tldap_save_msg(ld, req);
2588  fail:
2589         TALLOC_FREE(frame);
2590         return rc;
2591 }
2592
2593 static void tldap_extended_done(struct tevent_req *subreq);
2594
2595 struct tevent_req *tldap_extended_send(TALLOC_CTX *mem_ctx,
2596                                        struct tevent_context *ev,
2597                                        struct tldap_context *ld,
2598                                        const char *in_oid,
2599                                        const DATA_BLOB *in_blob,
2600                                        struct tldap_control *sctrls,
2601                                        int num_sctrls,
2602                                        struct tldap_control *cctrls,
2603                                        int num_cctrls)
2604 {
2605         struct tevent_req *req, *subreq;
2606         struct tldap_req_state *state;
2607
2608         req = tldap_req_create(mem_ctx, ld, &state);
2609         if (req == NULL) {
2610                 return NULL;
2611         }
2612
2613         if (!asn1_push_tag(state->out, TLDAP_REQ_EXTENDED)) goto err;
2614
2615         if (!asn1_push_tag(state->out, ASN1_CONTEXT_SIMPLE(0))) goto err;
2616         if (!asn1_write(state->out, in_oid, strlen(in_oid))) goto err;
2617         if (!asn1_pop_tag(state->out)) goto err;
2618
2619         if (in_blob != NULL) {
2620                 if (!asn1_push_tag(state->out, ASN1_CONTEXT_SIMPLE(1))) goto err;
2621                 if (!asn1_write_OctetString(state->out, in_blob->data, in_blob->length)) goto err;
2622                 if (!asn1_pop_tag(state->out)) goto err;
2623         }
2624
2625         if (!asn1_pop_tag(state->out)) goto err;
2626
2627         subreq = tldap_msg_send(state, ev, ld, state->id, state->out,
2628                                 sctrls, num_sctrls);
2629         if (tevent_req_nomem(subreq, req)) {
2630                 return tevent_req_post(req, ev);
2631         }
2632         tevent_req_set_callback(subreq, tldap_extended_done, req);
2633         return req;
2634
2635   err:
2636
2637         tevent_req_ldap_error(req, TLDAP_ENCODING_ERROR);
2638         return tevent_req_post(req, ev);
2639 }
2640
2641 static void tldap_extended_done(struct tevent_req *subreq)
2642 {
2643         struct tevent_req *req = tevent_req_callback_data(
2644                 subreq, struct tevent_req);
2645         struct tldap_req_state *state = tevent_req_data(
2646                 req, struct tldap_req_state);
2647         TLDAPRC rc;
2648         bool ok;
2649
2650         rc = tldap_msg_recv(subreq, state, &state->result);
2651         TALLOC_FREE(subreq);
2652         if (tevent_req_ldap_error(req, rc)) {
2653                 return;
2654         }
2655         if (state->result->type != TLDAP_RES_EXTENDED) {
2656                 tevent_req_ldap_error(req, TLDAP_PROTOCOL_ERROR);
2657                 return;
2658         }
2659
2660         ok = asn1_start_tag(state->result->data, TLDAP_RES_EXTENDED);
2661         ok &= tldap_decode_response(state);
2662
2663         if (asn1_peek_tag(state->result->data, ASN1_CONTEXT_SIMPLE(10))) {
2664                 ok &= asn1_start_tag(state->result->data,
2665                                      ASN1_CONTEXT_SIMPLE(10));
2666                 if (!ok) {
2667                         goto decode_error;
2668                 }
2669
2670                 ok &= asn1_read_LDAPString(state->result->data,
2671                                            state->result,
2672                                            &state->result->res_extended.oid);
2673
2674                 ok &= asn1_end_tag(state->result->data);
2675         }
2676
2677         if (asn1_peek_tag(state->result->data, ASN1_CONTEXT_SIMPLE(11))) {
2678                 int len;
2679
2680                 ok &= asn1_start_tag(state->result->data,
2681                                      ASN1_CONTEXT_SIMPLE(11));
2682                 if (!ok) {
2683                         goto decode_error;
2684                 }
2685
2686                 len = asn1_tag_remaining(state->result->data);
2687                 if (len == -1) {
2688                         goto decode_error;
2689                 }
2690
2691                 state->result->res_extended.blob =
2692                         data_blob_talloc(state->result, NULL, len);
2693                 if (state->result->res_extended.blob.data == NULL) {
2694                         goto decode_error;
2695                 }
2696
2697                 ok = asn1_read(state->result->data,
2698                                state->result->res_extended.blob.data,
2699                                state->result->res_extended.blob.length);
2700
2701                 ok &= asn1_end_tag(state->result->data);
2702         }
2703
2704         ok &= asn1_end_tag(state->result->data);
2705
2706         if (!ok) {
2707                 goto decode_error;
2708         }
2709
2710         if (!TLDAP_RC_IS_SUCCESS(state->result->lderr)) {
2711                 tevent_req_ldap_error(req, state->result->lderr);
2712                 return;
2713         }
2714         tevent_req_done(req);
2715         return;
2716
2717 decode_error:
2718         tevent_req_ldap_error(req, TLDAP_DECODING_ERROR);
2719         return;
2720 }
2721
2722 TLDAPRC tldap_extended_recv(struct tevent_req *req,
2723                             TALLOC_CTX *mem_ctx,
2724                             char **out_oid,
2725                             DATA_BLOB *out_blob)
2726 {
2727         struct tldap_req_state *state = tevent_req_data(
2728                 req, struct tldap_req_state);
2729         TLDAPRC rc;
2730
2731         if (tevent_req_is_ldap_error(req, &rc)) {
2732                 return rc;
2733         }
2734
2735         if (out_oid != NULL) {
2736                 *out_oid = talloc_move(mem_ctx,
2737                                 &state->result->res_extended.oid);
2738         }
2739
2740         if (out_blob != NULL) {
2741                 out_blob->data = talloc_move(mem_ctx,
2742                                 &state->result->res_extended.blob.data);
2743                 out_blob->length =
2744                                 state->result->res_extended.blob.length;
2745         }
2746
2747         return state->result->lderr;
2748 }
2749
2750 TLDAPRC tldap_extended(struct tldap_context *ld,
2751                         const char *in_oid,
2752                         const DATA_BLOB *in_blob,
2753                         struct tldap_control *sctrls,
2754                         int num_sctrls,
2755                         struct tldap_control *cctrls,
2756                         int num_cctrls,
2757                         TALLOC_CTX *mem_ctx,
2758                         char **out_oid,
2759                         DATA_BLOB *out_blob)
2760 {
2761         TALLOC_CTX *frame = talloc_stackframe();
2762         struct tevent_context *ev;
2763         struct tevent_req *req;
2764         TLDAPRC rc = TLDAP_NO_MEMORY;
2765
2766         ev = samba_tevent_context_init(frame);
2767         if (ev == NULL) {
2768                 goto fail;
2769         }
2770         req = tldap_extended_send(frame, ev, ld,
2771                                   in_oid, in_blob,
2772                                   sctrls, num_sctrls,
2773                                   cctrls, num_cctrls);
2774         if (req == NULL) {
2775                 goto fail;
2776         }
2777         if (!tevent_req_poll(req, ev)) {
2778                 rc = TLDAP_OPERATIONS_ERROR;
2779                 goto fail;
2780         }
2781         rc = tldap_extended_recv(req, mem_ctx, out_oid, out_blob);
2782         tldap_save_msg(ld, req);
2783  fail:
2784         TALLOC_FREE(frame);
2785         return rc;
2786 }
2787
2788 int tldap_msg_id(const struct tldap_message *msg)
2789 {
2790         return msg->id;
2791 }
2792
2793 int tldap_msg_type(const struct tldap_message *msg)
2794 {
2795         return msg->type;
2796 }
2797
2798 const char *tldap_msg_matcheddn(struct tldap_message *msg)
2799 {
2800         if (msg == NULL) {
2801                 return NULL;
2802         }
2803         return msg->res_matcheddn;
2804 }
2805
2806 const char *tldap_msg_diagnosticmessage(struct tldap_message *msg)
2807 {
2808         if (msg == NULL) {
2809                 return NULL;
2810         }
2811         return msg->res_diagnosticmessage;
2812 }
2813
2814 const char *tldap_msg_referral(struct tldap_message *msg)
2815 {
2816         if (msg == NULL) {
2817                 return NULL;
2818         }
2819         return msg->res_referral;
2820 }
2821
2822 void tldap_msg_sctrls(struct tldap_message *msg, int *num_sctrls,
2823                       struct tldap_control **sctrls)
2824 {
2825         if (msg == NULL) {
2826                 *sctrls = NULL;
2827                 *num_sctrls = 0;
2828                 return;
2829         }
2830         *sctrls = msg->res_sctrls;
2831         *num_sctrls = talloc_array_length(msg->res_sctrls);
2832 }
2833
2834 struct tldap_message *tldap_ctx_lastmsg(struct tldap_context *ld)
2835 {
2836         return ld->last_msg;
2837 }
2838
2839 static const struct { TLDAPRC rc; const char *string; } tldaprc_errmap[] =
2840 {
2841         { TLDAP_SUCCESS,
2842           "TLDAP_SUCCESS" },
2843         { TLDAP_OPERATIONS_ERROR,
2844           "TLDAP_OPERATIONS_ERROR" },
2845         { TLDAP_PROTOCOL_ERROR,
2846           "TLDAP_PROTOCOL_ERROR" },
2847         { TLDAP_TIMELIMIT_EXCEEDED,
2848           "TLDAP_TIMELIMIT_EXCEEDED" },
2849         { TLDAP_SIZELIMIT_EXCEEDED,
2850           "TLDAP_SIZELIMIT_EXCEEDED" },
2851         { TLDAP_COMPARE_FALSE,
2852           "TLDAP_COMPARE_FALSE" },
2853         { TLDAP_COMPARE_TRUE,
2854           "TLDAP_COMPARE_TRUE" },
2855         { TLDAP_STRONG_AUTH_NOT_SUPPORTED,
2856           "TLDAP_STRONG_AUTH_NOT_SUPPORTED" },
2857         { TLDAP_STRONG_AUTH_REQUIRED,
2858           "TLDAP_STRONG_AUTH_REQUIRED" },
2859         { TLDAP_REFERRAL,
2860           "TLDAP_REFERRAL" },
2861         { TLDAP_ADMINLIMIT_EXCEEDED,
2862           "TLDAP_ADMINLIMIT_EXCEEDED" },
2863         { TLDAP_UNAVAILABLE_CRITICAL_EXTENSION,
2864           "TLDAP_UNAVAILABLE_CRITICAL_EXTENSION" },
2865         { TLDAP_CONFIDENTIALITY_REQUIRED,
2866           "TLDAP_CONFIDENTIALITY_REQUIRED" },
2867         { TLDAP_SASL_BIND_IN_PROGRESS,
2868           "TLDAP_SASL_BIND_IN_PROGRESS" },
2869         { TLDAP_NO_SUCH_ATTRIBUTE,
2870           "TLDAP_NO_SUCH_ATTRIBUTE" },
2871         { TLDAP_UNDEFINED_TYPE,
2872           "TLDAP_UNDEFINED_TYPE" },
2873         { TLDAP_INAPPROPRIATE_MATCHING,
2874           "TLDAP_INAPPROPRIATE_MATCHING" },
2875         { TLDAP_CONSTRAINT_VIOLATION,
2876           "TLDAP_CONSTRAINT_VIOLATION" },
2877         { TLDAP_TYPE_OR_VALUE_EXISTS,
2878           "TLDAP_TYPE_OR_VALUE_EXISTS" },
2879         { TLDAP_INVALID_SYNTAX,
2880           "TLDAP_INVALID_SYNTAX" },
2881         { TLDAP_NO_SUCH_OBJECT,
2882           "TLDAP_NO_SUCH_OBJECT" },
2883         { TLDAP_ALIAS_PROBLEM,
2884           "TLDAP_ALIAS_PROBLEM" },
2885         { TLDAP_INVALID_DN_SYNTAX,
2886           "TLDAP_INVALID_DN_SYNTAX" },
2887         { TLDAP_IS_LEAF,
2888           "TLDAP_IS_LEAF" },
2889         { TLDAP_ALIAS_DEREF_PROBLEM,
2890           "TLDAP_ALIAS_DEREF_PROBLEM" },
2891         { TLDAP_INAPPROPRIATE_AUTH,
2892           "TLDAP_INAPPROPRIATE_AUTH" },
2893         { TLDAP_INVALID_CREDENTIALS,
2894           "TLDAP_INVALID_CREDENTIALS" },
2895         { TLDAP_INSUFFICIENT_ACCESS,
2896           "TLDAP_INSUFFICIENT_ACCESS" },
2897         { TLDAP_BUSY,
2898           "TLDAP_BUSY" },
2899         { TLDAP_UNAVAILABLE,
2900           "TLDAP_UNAVAILABLE" },
2901         { TLDAP_UNWILLING_TO_PERFORM,
2902           "TLDAP_UNWILLING_TO_PERFORM" },
2903         { TLDAP_LOOP_DETECT,
2904           "TLDAP_LOOP_DETECT" },
2905         { TLDAP_NAMING_VIOLATION,
2906           "TLDAP_NAMING_VIOLATION" },
2907         { TLDAP_OBJECT_CLASS_VIOLATION,
2908           "TLDAP_OBJECT_CLASS_VIOLATION" },
2909         { TLDAP_NOT_ALLOWED_ON_NONLEAF,
2910           "TLDAP_NOT_ALLOWED_ON_NONLEAF" },
2911         { TLDAP_NOT_ALLOWED_ON_RDN,
2912           "TLDAP_NOT_ALLOWED_ON_RDN" },
2913         { TLDAP_ALREADY_EXISTS,
2914           "TLDAP_ALREADY_EXISTS" },
2915         { TLDAP_NO_OBJECT_CLASS_MODS,
2916           "TLDAP_NO_OBJECT_CLASS_MODS" },
2917         { TLDAP_RESULTS_TOO_LARGE,
2918           "TLDAP_RESULTS_TOO_LARGE" },
2919         { TLDAP_AFFECTS_MULTIPLE_DSAS,
2920           "TLDAP_AFFECTS_MULTIPLE_DSAS" },
2921         { TLDAP_OTHER,
2922           "TLDAP_OTHER" },
2923         { TLDAP_SERVER_DOWN,
2924           "TLDAP_SERVER_DOWN" },
2925         { TLDAP_LOCAL_ERROR,
2926           "TLDAP_LOCAL_ERROR" },
2927         { TLDAP_ENCODING_ERROR,
2928           "TLDAP_ENCODING_ERROR" },
2929         { TLDAP_DECODING_ERROR,
2930           "TLDAP_DECODING_ERROR" },
2931         { TLDAP_TIMEOUT,
2932           "TLDAP_TIMEOUT" },
2933         { TLDAP_AUTH_UNKNOWN,
2934           "TLDAP_AUTH_UNKNOWN" },
2935         { TLDAP_FILTER_ERROR,
2936           "TLDAP_FILTER_ERROR" },
2937         { TLDAP_USER_CANCELLED,
2938           "TLDAP_USER_CANCELLED" },
2939         { TLDAP_PARAM_ERROR,
2940           "TLDAP_PARAM_ERROR" },
2941         { TLDAP_NO_MEMORY,
2942           "TLDAP_NO_MEMORY" },
2943         { TLDAP_CONNECT_ERROR,
2944           "TLDAP_CONNECT_ERROR" },
2945         { TLDAP_NOT_SUPPORTED,
2946           "TLDAP_NOT_SUPPORTED" },
2947         { TLDAP_CONTROL_NOT_FOUND,
2948           "TLDAP_CONTROL_NOT_FOUND" },
2949         { TLDAP_NO_RESULTS_RETURNED,
2950           "TLDAP_NO_RESULTS_RETURNED" },
2951         { TLDAP_MORE_RESULTS_TO_RETURN,
2952           "TLDAP_MORE_RESULTS_TO_RETURN" },
2953         { TLDAP_CLIENT_LOOP,
2954           "TLDAP_CLIENT_LOOP" },
2955         { TLDAP_REFERRAL_LIMIT_EXCEEDED,
2956           "TLDAP_REFERRAL_LIMIT_EXCEEDED" },
2957 };
2958
2959 const char *tldap_rc2string(TLDAPRC rc)
2960 {
2961         size_t i;
2962
2963         for (i=0; i<ARRAY_SIZE(tldaprc_errmap); i++) {
2964                 if (TLDAP_RC_EQUAL(rc, tldaprc_errmap[i].rc)) {
2965                         return tldaprc_errmap[i].string;
2966                 }
2967         }
2968
2969         return "Unknown LDAP Error";
2970 }