2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Tridgell 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 see RFC1798 for details of CLDAP
27 - carried over UDP on port 389
28 - request and response matched by message ID
29 - request consists of only a single searchRequest element
30 - response can be in one of two forms
31 - a single searchResponse, followed by a searchResult
32 - a single searchResult
36 #include "lib/events/events.h"
37 #include "dlinklist.h"
38 #include "libcli/ldap/ldap.h"
39 #include "libcli/cldap/cldap.h"
40 #include "lib/socket/socket.h"
41 #include "include/asn_1.h"
44 destroy a pending request
46 static int cldap_request_destructor(void *ptr)
48 struct cldap_request *req = talloc_get_type(ptr, struct cldap_request);
49 if (req->state == CLDAP_REQUEST_SEND) {
50 DLIST_REMOVE(req->cldap->send_queue, req);
52 if (!req->is_reply && req->message_id != 0) {
53 idr_remove(req->cldap->idr, req->message_id);
60 handle recv events on a cldap socket
62 static void cldap_socket_recv(struct cldap_socket *cldap)
64 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
70 struct asn1_data asn1;
71 struct ldap_message ldap_msg;
72 struct cldap_request *req;
74 status = socket_pending(cldap->sock, &dsize);
75 if (!NT_STATUS_IS_OK(status)) {
80 blob = data_blob_talloc(tmp_ctx, NULL, dsize);
81 if (blob.data == NULL) {
86 status = socket_recvfrom(cldap->sock, blob.data, blob.length, &nread, 0,
87 &src_addr, &src_port);
88 if (!NT_STATUS_IS_OK(status)) {
92 talloc_steal(tmp_ctx, src_addr);
95 DEBUG(2,("Received cldap packet of length %d from %s:%d\n",
96 blob.length, src_addr, src_port));
98 if (!asn1_load(&asn1, blob)) {
99 DEBUG(2,("Failed to setup for asn.1 decode\n"));
100 talloc_free(tmp_ctx);
103 talloc_steal(tmp_ctx, asn1.data);
105 ZERO_STRUCT(ldap_msg);
106 ldap_msg.mem_ctx = tmp_ctx;
108 /* this initial decode is used to find the message id */
109 if (!ldap_decode(&asn1, &ldap_msg)) {
110 DEBUG(2,("Failed to decode ldap message\n"));
111 talloc_free(tmp_ctx);
115 /* find the pending request */
116 req = idr_find(cldap->idr, ldap_msg.messageid);
118 if (cldap->incoming.handler) {
119 cldap->incoming.handler(cldap, &ldap_msg, src_addr, src_port);
121 DEBUG(2,("Mismatched cldap reply %u from %s:%d\n",
122 ldap_msg.messageid, src_addr, src_port));
124 talloc_free(tmp_ctx);
129 talloc_steal(req, asn1.data);
132 req->state = CLDAP_REQUEST_DONE;
133 talloc_free(req->te);
135 talloc_free(tmp_ctx);
143 handle request timeouts
145 static void cldap_request_timeout(struct event_context *event_ctx,
146 struct timed_event *te, struct timeval t,
149 struct cldap_request *req = talloc_get_type(private, struct cldap_request);
151 /* possibly try again */
152 if (req->num_retries != 0) {
153 size_t len = req->encoded.length;
157 socket_sendto(req->cldap->sock, &req->encoded, &len, 0,
158 req->dest_addr, req->dest_port);
160 req->te = event_add_timed(req->cldap->event_ctx, req,
161 timeval_current_ofs(req->timeout, 0),
162 cldap_request_timeout, req);
166 req->state = CLDAP_REQUEST_TIMEOUT;
173 handle send events on a cldap socket
175 static void cldap_socket_send(struct cldap_socket *cldap)
177 struct cldap_request *req;
180 while ((req = cldap->send_queue)) {
183 len = req->encoded.length;
184 status = socket_sendto(cldap->sock, &req->encoded, &len, 0,
185 req->dest_addr, req->dest_port);
186 if (NT_STATUS_IS_ERR(status)) {
187 DEBUG(3,("Failed to send cldap request of length %u to %s:%d\n",
188 req->encoded.length, req->dest_addr, req->dest_port));
189 DLIST_REMOVE(cldap->send_queue, req);
194 if (!NT_STATUS_IS_OK(status)) return;
196 DLIST_REMOVE(cldap->send_queue, req);
201 req->state = CLDAP_REQUEST_WAIT;
203 req->te = event_add_timed(cldap->event_ctx, req,
204 timeval_current_ofs(req->timeout, 0),
205 cldap_request_timeout, req);
207 EVENT_FD_READABLE(cldap->fde);
211 EVENT_FD_NOT_WRITEABLE(cldap->fde);
217 handle fd events on a cldap_socket
219 static void cldap_socket_handler(struct event_context *ev, struct fd_event *fde,
220 uint16_t flags, void *private)
222 struct cldap_socket *cldap = talloc_get_type(private, struct cldap_socket);
223 if (flags & EVENT_FD_WRITE) {
224 cldap_socket_send(cldap);
225 } else if (flags & EVENT_FD_READ) {
226 cldap_socket_recv(cldap);
231 initialise a cldap_socket. The event_ctx is optional, if provided
232 then operations will use that event context
234 struct cldap_socket *cldap_socket_init(TALLOC_CTX *mem_ctx,
235 struct event_context *event_ctx)
237 struct cldap_socket *cldap;
240 cldap = talloc(mem_ctx, struct cldap_socket);
241 if (cldap == NULL) goto failed;
243 if (event_ctx == NULL) {
244 cldap->event_ctx = event_context_init(cldap);
246 cldap->event_ctx = talloc_reference(cldap, event_ctx);
248 if (cldap->event_ctx == NULL) goto failed;
250 cldap->idr = idr_init(cldap);
251 if (cldap->idr == NULL) goto failed;
253 status = socket_create("ip", SOCKET_TYPE_DGRAM, &cldap->sock, 0);
254 if (!NT_STATUS_IS_OK(status)) goto failed;
256 talloc_steal(cldap, cldap->sock);
258 cldap->fde = event_add_fd(cldap->event_ctx, cldap,
259 socket_get_fd(cldap->sock), 0,
260 cldap_socket_handler, cldap);
262 cldap->send_queue = NULL;
263 cldap->incoming.handler = NULL;
274 setup a handler for incoming requests
276 NTSTATUS cldap_set_incoming_handler(struct cldap_socket *cldap,
277 void (*handler)(struct cldap_socket *, struct ldap_message *,
281 cldap->incoming.handler = handler;
282 cldap->incoming.private = private;
283 EVENT_FD_READABLE(cldap->fde);
288 queue a cldap request for send
290 struct cldap_request *cldap_search_send(struct cldap_socket *cldap,
291 struct cldap_search *io)
293 struct ldap_message msg;
294 struct cldap_request *req;
295 struct ldap_SearchRequest *search;
297 req = talloc_zero(cldap, struct cldap_request);
298 if (req == NULL) goto failed;
301 req->state = CLDAP_REQUEST_SEND;
302 req->timeout = io->in.timeout;
303 req->num_retries = io->in.retries;
304 req->is_reply = False;
306 req->dest_addr = talloc_strdup(req, io->in.dest_address);
307 if (req->dest_addr == NULL) goto failed;
308 req->dest_port = lp_cldap_port();
310 req->message_id = idr_get_new_random(cldap->idr, req, UINT16_MAX);
311 if (req->message_id == -1) goto failed;
313 talloc_set_destructor(req, cldap_request_destructor);
316 msg.messageid = req->message_id;
317 msg.type = LDAP_TAG_SearchRequest;
318 msg.num_controls = 0;
320 search = &msg.r.SearchRequest;
323 search->scope = LDAP_SEARCH_SCOPE_BASE;
324 search->deref = LDAP_DEREFERENCE_NEVER;
325 search->timelimit = 0;
326 search->sizelimit = 0;
327 search->attributesonly = False;
328 search->num_attributes = str_list_length(io->in.attributes);
329 search->attributes = io->in.attributes;
330 search->filter = io->in.filter;
332 if (!ldap_encode(&msg, &req->encoded)) {
333 DEBUG(0,("Failed to encode cldap message to %s:%d\n",
334 req->dest_addr, req->dest_port));
337 talloc_steal(req, req->encoded.data);
339 DLIST_ADD_END(cldap->send_queue, req, struct cldap_request *);
341 EVENT_FD_WRITEABLE(cldap->fde);
352 queue a cldap reply for send
354 NTSTATUS cldap_reply_send(struct cldap_socket *cldap, struct cldap_reply *io)
356 struct ldap_message msg;
357 struct cldap_request *req;
358 DATA_BLOB blob1, blob2;
359 NTSTATUS status = NT_STATUS_NO_MEMORY;
361 req = talloc_zero(cldap, struct cldap_request);
362 if (req == NULL) goto failed;
365 req->state = CLDAP_REQUEST_SEND;
366 req->is_reply = True;
368 req->dest_addr = talloc_strdup(req, io->dest_address);
369 if (req->dest_addr == NULL) goto failed;
370 req->dest_port = io->dest_port;
372 talloc_set_destructor(req, cldap_request_destructor);
375 msg.messageid = io->messageid;
376 msg.num_controls = 0;
380 msg.type = LDAP_TAG_SearchResultEntry;
381 msg.r.SearchResultEntry = *io->response;
383 if (!ldap_encode(&msg, &blob1)) {
384 DEBUG(0,("Failed to encode cldap message to %s:%d\n",
385 req->dest_addr, req->dest_port));
386 status = NT_STATUS_INVALID_PARAMETER;
389 talloc_steal(req, blob1.data);
391 blob1 = data_blob(NULL, 0);
394 msg.type = LDAP_TAG_SearchResultDone;
395 msg.r.SearchResultDone = *io->result;
397 if (!ldap_encode(&msg, &blob2)) {
398 DEBUG(0,("Failed to encode cldap message to %s:%d\n",
399 req->dest_addr, req->dest_port));
400 status = NT_STATUS_INVALID_PARAMETER;
403 talloc_steal(req, blob2.data);
405 req->encoded = data_blob_talloc(req, NULL, blob1.length + blob2.length);
406 if (req->encoded.data == NULL) goto failed;
408 memcpy(req->encoded.data, blob1.data, blob1.length);
409 memcpy(req->encoded.data+blob1.length, blob2.data, blob2.length);
411 DLIST_ADD_END(cldap->send_queue, req, struct cldap_request *);
413 EVENT_FD_WRITEABLE(cldap->fde);
423 receive a cldap reply
425 NTSTATUS cldap_search_recv(struct cldap_request *req,
427 struct cldap_search *io)
429 struct ldap_message ldap_msg;
432 return NT_STATUS_NO_MEMORY;
435 while (req->state < CLDAP_REQUEST_DONE) {
436 if (event_loop_once(req->cldap->event_ctx) != 0) {
438 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
442 if (req->state == CLDAP_REQUEST_TIMEOUT) {
444 return NT_STATUS_IO_TIMEOUT;
447 ZERO_STRUCT(ldap_msg);
448 ldap_msg.mem_ctx = mem_ctx;
450 if (!ldap_decode(&req->asn1, &ldap_msg)) {
452 return NT_STATUS_INVALID_PARAMETER;
455 ZERO_STRUCT(io->out);
457 /* the first possible form has a search result in first place */
458 if (ldap_msg.type == LDAP_TAG_SearchResultEntry) {
459 io->out.response = talloc(mem_ctx, struct ldap_SearchResEntry);
460 NT_STATUS_HAVE_NO_MEMORY(io->out.response);
461 *io->out.response = ldap_msg.r.SearchResultEntry;
463 /* decode the 2nd part */
464 if (!ldap_decode(&req->asn1, &ldap_msg)) {
466 return NT_STATUS_INVALID_PARAMETER;
470 if (ldap_msg.type != LDAP_TAG_SearchResultDone) {
472 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
475 io->out.result = talloc(mem_ctx, struct ldap_Result);
476 NT_STATUS_HAVE_NO_MEMORY(io->out.result);
477 *io->out.result = ldap_msg.r.SearchResultDone;
485 synchronous cldap search
487 NTSTATUS cldap_search(struct cldap_socket *cldap,
489 struct cldap_search *io)
491 struct cldap_request *req = cldap_search_send(cldap, io);
492 return cldap_search_recv(req, mem_ctx, io);
498 queue a cldap netlogon for send
500 struct cldap_request *cldap_netlogon_send(struct cldap_socket *cldap,
501 struct cldap_netlogon *io)
503 struct cldap_search search;
505 struct cldap_request *req;
506 const char *attr[] = { "NetLogon", NULL };
507 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
509 filter = talloc_asprintf(tmp_ctx, "(&(NtVer=%s)",
510 ldap_encode_ndr_uint32(tmp_ctx, io->in.version));
511 if (filter == NULL) goto failed;
513 filter = talloc_asprintf_append(filter, "(User=%s)", io->in.user);
514 if (filter == NULL) goto failed;
517 filter = talloc_asprintf_append(filter, "(Host=%s)", io->in.host);
518 if (filter == NULL) goto failed;
521 filter = talloc_asprintf_append(filter, "(DnsDomain=%s)", io->in.realm);
522 if (filter == NULL) goto failed;
524 if (io->in.acct_control != -1) {
525 filter = talloc_asprintf_append(filter, "(AAC=%s)",
526 ldap_encode_ndr_uint32(tmp_ctx, io->in.acct_control));
527 if (filter == NULL) goto failed;
529 if (io->in.domain_sid) {
530 struct dom_sid *sid = dom_sid_parse_talloc(tmp_ctx, io->in.domain_sid);
531 if (sid == NULL) goto failed;
532 filter = talloc_asprintf_append(filter, "(domainSid=%s)",
533 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
534 if (filter == NULL) goto failed;
536 if (io->in.domain_guid) {
539 status = GUID_from_string(io->in.domain_guid, &guid);
540 if (!NT_STATUS_IS_OK(status)) goto failed;
541 filter = talloc_asprintf_append(filter, "(DomainGuid=%s)",
542 ldap_encode_ndr_GUID(tmp_ctx, &guid));
543 if (filter == NULL) goto failed;
545 filter = talloc_asprintf_append(filter, ")");
546 if (filter == NULL) goto failed;
548 search.in.dest_address = io->in.dest_address;
549 search.in.filter = filter;
550 search.in.attributes = attr;
551 search.in.timeout = 2;
552 search.in.retries = 2;
554 req = cldap_search_send(cldap, &search);
556 talloc_free(tmp_ctx);
559 talloc_free(tmp_ctx);
565 receive a cldap netlogon reply
567 NTSTATUS cldap_netlogon_recv(struct cldap_request *req,
569 struct cldap_netlogon *io)
572 struct cldap_search search;
575 status = cldap_search_recv(req, mem_ctx, &search);
576 if (!NT_STATUS_IS_OK(status)) {
579 if (search.out.response == NULL) {
580 return NT_STATUS_NOT_FOUND;
583 if (search.out.response->num_attributes != 1 ||
584 strcasecmp(search.out.response->attributes[0].name, "netlogon") != 0 ||
585 search.out.response->attributes[0].num_values != 1 ||
586 search.out.response->attributes[0].values->length < 2) {
587 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
589 data = search.out.response->attributes[0].values;
591 status = ndr_pull_union_blob(data, mem_ctx, &io->out.netlogon,
592 io->in.version & 0xF,
593 (ndr_pull_flags_fn_t)ndr_pull_nbt_cldap_netlogon);
594 if (!NT_STATUS_IS_OK(status)) {
595 DEBUG(2,("cldap failed to parse netlogon response of type 0x%02x\n",
596 SVAL(data->data, 0)));
597 dump_data(10, data->data, data->length);
604 sync cldap netlogon search
606 NTSTATUS cldap_netlogon(struct cldap_socket *cldap,
607 TALLOC_CTX *mem_ctx, struct cldap_netlogon *io)
609 struct cldap_request *req = cldap_netlogon_send(cldap, io);
610 return cldap_netlogon_recv(req, mem_ctx, io);
615 send an empty reply (used on any error, so the client doesn't keep waiting
616 or send the bad request again)
618 NTSTATUS cldap_empty_reply(struct cldap_socket *cldap,
620 const char *src_address, int src_port)
623 struct cldap_reply reply;
624 struct ldap_Result result;
626 reply.messageid = message_id;
627 reply.dest_address = src_address;
628 reply.dest_port = src_port;
629 reply.response = NULL;
630 reply.result = &result;
634 status = cldap_reply_send(cldap, &reply);
641 send a netlogon reply
643 NTSTATUS cldap_netlogon_reply(struct cldap_socket *cldap,
645 const char *src_address, int src_port,
647 union nbt_cldap_netlogon *netlogon)
650 struct cldap_reply reply;
651 struct ldap_SearchResEntry response;
652 struct ldap_Result result;
653 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
656 status = ndr_push_union_blob(&blob, tmp_ctx, netlogon, version & 0xF,
657 (ndr_push_flags_fn_t)ndr_push_nbt_cldap_netlogon);
658 if (!NT_STATUS_IS_OK(status)) {
659 talloc_free(tmp_ctx);
663 reply.messageid = message_id;
664 reply.dest_address = src_address;
665 reply.dest_port = src_port;
666 reply.response = &response;
667 reply.result = &result;
672 response.num_attributes = 1;
673 response.attributes = talloc(tmp_ctx, struct ldap_attribute);
674 NT_STATUS_HAVE_NO_MEMORY(response.attributes);
675 response.attributes->name = "netlogon";
676 response.attributes->num_values = 1;
677 response.attributes->values = &blob;
679 status = cldap_reply_send(cldap, &reply);
681 talloc_free(tmp_ctx);