2 ldb database library - ldif handlers for Samba
4 Copyright (C) Andrew Tridgell 2005
5 Copyright (C) Andrew Bartlett 2006-2007
6 ** NOTE! The following LGPL license applies to the ldb
7 ** library. This does NOT imply that all of Samba is released
10 This library is free software; you can redistribute it and/or
11 modify it under the terms of the GNU Lesser General Public
12 License as published by the Free Software Foundation; either
13 version 3 of the License, or (at your option) any later version.
15 This library is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 Lesser General Public License for more details.
20 You should have received a copy of the GNU Lesser General Public
21 License along with this library; if not, see <http://www.gnu.org/licenses/>.
25 #include "ldb_includes.h"
26 #include "ldb_handlers.h"
28 #include "librpc/gen_ndr/ndr_security.h"
29 #include "librpc/gen_ndr/ndr_misc.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "libcli/security/security.h"
34 convert a ldif formatted objectSid to a NDR formatted blob
36 static int ldif_read_objectSid(struct ldb_context *ldb, void *mem_ctx,
37 const struct ldb_val *in, struct ldb_val *out)
39 enum ndr_err_code ndr_err;
41 sid = dom_sid_parse_talloc(mem_ctx, (const char *)in->data);
45 ndr_err = ndr_push_struct_blob(out, mem_ctx, sid,
46 (ndr_push_flags_fn_t)ndr_push_dom_sid);
48 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
55 convert a NDR formatted blob to a ldif formatted objectSid
57 static int ldif_write_objectSid(struct ldb_context *ldb, void *mem_ctx,
58 const struct ldb_val *in, struct ldb_val *out)
61 enum ndr_err_code ndr_err;
63 sid = talloc(mem_ctx, struct dom_sid);
67 ndr_err = ndr_pull_struct_blob(in, sid, sid,
68 (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
69 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
73 out->data = (uint8_t *)dom_sid_string(mem_ctx, sid);
75 if (out->data == NULL) {
78 out->length = strlen((const char *)out->data);
82 static bool ldb_comparision_objectSid_isString(const struct ldb_val *v)
88 if (strncmp("S-", (const char *)v->data, 2) != 0) return false;
94 compare two objectSids
96 static int ldb_comparison_objectSid(struct ldb_context *ldb, void *mem_ctx,
97 const struct ldb_val *v1, const struct ldb_val *v2)
99 if (ldb_comparision_objectSid_isString(v1) && ldb_comparision_objectSid_isString(v2)) {
100 return strcmp((const char *)v1->data, (const char *)v2->data);
101 } else if (ldb_comparision_objectSid_isString(v1)
102 && !ldb_comparision_objectSid_isString(v2)) {
105 if (ldif_read_objectSid(ldb, mem_ctx, v1, &v) != 0) {
108 ret = ldb_comparison_binary(ldb, mem_ctx, &v, v2);
111 } else if (!ldb_comparision_objectSid_isString(v1)
112 && ldb_comparision_objectSid_isString(v2)) {
115 if (ldif_read_objectSid(ldb, mem_ctx, v2, &v) != 0) {
118 ret = ldb_comparison_binary(ldb, mem_ctx, v1, &v);
122 return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
126 canonicalise a objectSid
128 static int ldb_canonicalise_objectSid(struct ldb_context *ldb, void *mem_ctx,
129 const struct ldb_val *in, struct ldb_val *out)
131 if (ldb_comparision_objectSid_isString(in)) {
132 return ldif_read_objectSid(ldb, mem_ctx, in, out);
134 return ldb_handler_copy(ldb, mem_ctx, in, out);
138 convert a ldif formatted objectGUID to a NDR formatted blob
140 static int ldif_read_objectGUID(struct ldb_context *ldb, void *mem_ctx,
141 const struct ldb_val *in, struct ldb_val *out)
145 enum ndr_err_code ndr_err;
147 status = GUID_from_string((const char *)in->data, &guid);
148 if (!NT_STATUS_IS_OK(status)) {
152 ndr_err = ndr_push_struct_blob(out, mem_ctx, &guid,
153 (ndr_push_flags_fn_t)ndr_push_GUID);
154 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
161 convert a NDR formatted blob to a ldif formatted objectGUID
163 static int ldif_write_objectGUID(struct ldb_context *ldb, void *mem_ctx,
164 const struct ldb_val *in, struct ldb_val *out)
167 enum ndr_err_code ndr_err;
168 ndr_err = ndr_pull_struct_blob(in, mem_ctx, &guid,
169 (ndr_pull_flags_fn_t)ndr_pull_GUID);
170 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
173 out->data = (uint8_t *)GUID_string(mem_ctx, &guid);
174 if (out->data == NULL) {
177 out->length = strlen((const char *)out->data);
181 static bool ldb_comparision_objectGUID_isString(const struct ldb_val *v)
186 if (v->length < 33) return false;
188 /* see if the input if null-terninated (safety check for the below) */
189 if (v->data[v->length] != '\0') return false;
191 status = GUID_from_string((const char *)v->data, &guid);
192 if (!NT_STATUS_IS_OK(status)) {
200 compare two objectGUIDs
202 static int ldb_comparison_objectGUID(struct ldb_context *ldb, void *mem_ctx,
203 const struct ldb_val *v1, const struct ldb_val *v2)
205 if (ldb_comparision_objectGUID_isString(v1) && ldb_comparision_objectGUID_isString(v2)) {
206 return strcmp((const char *)v1->data, (const char *)v2->data);
207 } else if (ldb_comparision_objectGUID_isString(v1)
208 && !ldb_comparision_objectGUID_isString(v2)) {
211 if (ldif_read_objectGUID(ldb, mem_ctx, v1, &v) != 0) {
214 ret = ldb_comparison_binary(ldb, mem_ctx, &v, v2);
217 } else if (!ldb_comparision_objectGUID_isString(v1)
218 && ldb_comparision_objectGUID_isString(v2)) {
221 if (ldif_read_objectGUID(ldb, mem_ctx, v2, &v) != 0) {
224 ret = ldb_comparison_binary(ldb, mem_ctx, v1, &v);
228 return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
232 canonicalise a objectGUID
234 static int ldb_canonicalise_objectGUID(struct ldb_context *ldb, void *mem_ctx,
235 const struct ldb_val *in, struct ldb_val *out)
237 if (ldb_comparision_objectGUID_isString(in)) {
238 return ldif_read_objectGUID(ldb, mem_ctx, in, out);
240 return ldb_handler_copy(ldb, mem_ctx, in, out);
245 convert a ldif (SDDL) formatted ntSecurityDescriptor to a NDR formatted blob
247 static int ldif_read_ntSecurityDescriptor(struct ldb_context *ldb, void *mem_ctx,
248 const struct ldb_val *in, struct ldb_val *out)
250 struct security_descriptor *sd;
251 enum ndr_err_code ndr_err;
253 sd = sddl_decode(mem_ctx, (const char *)in->data, NULL);
257 ndr_err = ndr_push_struct_blob(out, mem_ctx, sd,
258 (ndr_push_flags_fn_t)ndr_push_security_descriptor);
260 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
267 convert a NDR formatted blob to a ldif formatted ntSecurityDescriptor (SDDL format)
269 static int ldif_write_ntSecurityDescriptor(struct ldb_context *ldb, void *mem_ctx,
270 const struct ldb_val *in, struct ldb_val *out)
272 struct security_descriptor *sd;
273 enum ndr_err_code ndr_err;
275 sd = talloc(mem_ctx, struct security_descriptor);
279 ndr_err = ndr_pull_struct_blob(in, sd, sd,
280 (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
281 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
285 out->data = (uint8_t *)sddl_encode(mem_ctx, sd, NULL);
287 if (out->data == NULL) {
290 out->length = strlen((const char *)out->data);
295 canonicolise an objectCategory. We use the short form as the cannoical form:
296 cn=Person,cn=Schema,cn=Configuration,<basedn> becomes 'person'
299 static int ldif_canonicalise_objectCategory(struct ldb_context *ldb, void *mem_ctx,
300 const struct ldb_val *in, struct ldb_val *out)
302 struct ldb_dn *dn1 = NULL;
303 const struct dsdb_schema *schema = dsdb_get_schema(ldb);
304 const struct dsdb_class *class;
305 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
307 return LDB_ERR_OPERATIONS_ERROR;
311 *out = data_blob_talloc(mem_ctx, in->data, in->length);
312 if (in->data && !out->data) {
313 return LDB_ERR_OPERATIONS_ERROR;
317 dn1 = ldb_dn_new(tmp_ctx, ldb, (char *)in->data);
318 if ( ! ldb_dn_validate(dn1)) {
319 const char *lDAPDisplayName = talloc_strndup(tmp_ctx, (char *)in->data, in->length);
320 class = dsdb_class_by_lDAPDisplayName(schema, lDAPDisplayName);
322 struct ldb_dn *dn = ldb_dn_new(mem_ctx, ldb,
323 class->defaultObjectCategory);
324 *out = data_blob_string_const(ldb_dn_alloc_casefold(mem_ctx, dn));
325 talloc_free(tmp_ctx);
328 return LDB_ERR_OPERATIONS_ERROR;
332 *out = data_blob_talloc(mem_ctx, in->data, in->length);
333 talloc_free(tmp_ctx);
335 if (in->data && !out->data) {
336 return LDB_ERR_OPERATIONS_ERROR;
341 *out = data_blob_string_const(ldb_dn_alloc_casefold(mem_ctx, dn1));
342 talloc_free(tmp_ctx);
345 return LDB_ERR_OPERATIONS_ERROR;
350 static int ldif_comparison_objectCategory(struct ldb_context *ldb, void *mem_ctx,
351 const struct ldb_val *v1,
352 const struct ldb_val *v2)
356 struct ldb_val v1_canon, v2_canon;
357 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
359 /* I could try and bail if tmp_ctx was NULL, but what return
362 * It seems easier to continue on the NULL context
364 ret1 = ldif_canonicalise_objectCategory(ldb, tmp_ctx, v1, &v1_canon);
365 ret2 = ldif_canonicalise_objectCategory(ldb, tmp_ctx, v2, &v2_canon);
367 if (ret1 == LDB_SUCCESS && ret2 == LDB_SUCCESS) {
368 ret = data_blob_cmp(&v1_canon, &v2_canon);
370 ret = data_blob_cmp(v1, v2);
372 talloc_free(tmp_ctx);
376 #define LDB_SYNTAX_SAMBA_SID "LDB_SYNTAX_SAMBA_SID"
377 #define LDB_SYNTAX_SAMBA_SECURITY_DESCRIPTOR "LDB_SYNTAX_SAMBA_SECURITY_DESCRIPTOR"
378 #define LDB_SYNTAX_SAMBA_GUID "LDB_SYNTAX_SAMBA_GUID"
379 #define LDB_SYNTAX_SAMBA_OBJECT_CATEGORY "LDB_SYNTAX_SAMBA_OBJECT_CATEGORY"
381 static const struct ldb_schema_syntax samba_syntaxes[] = {
383 .name = LDB_SYNTAX_SAMBA_SID,
384 .ldif_read_fn = ldif_read_objectSid,
385 .ldif_write_fn = ldif_write_objectSid,
386 .canonicalise_fn= ldb_canonicalise_objectSid,
387 .comparison_fn = ldb_comparison_objectSid
389 .name = LDB_SYNTAX_SAMBA_SECURITY_DESCRIPTOR,
390 .ldif_read_fn = ldif_read_ntSecurityDescriptor,
391 .ldif_write_fn = ldif_write_ntSecurityDescriptor,
392 .canonicalise_fn= ldb_handler_copy,
393 .comparison_fn = ldb_comparison_binary
395 .name = LDB_SYNTAX_SAMBA_GUID,
396 .ldif_read_fn = ldif_read_objectGUID,
397 .ldif_write_fn = ldif_write_objectGUID,
398 .canonicalise_fn= ldb_canonicalise_objectGUID,
399 .comparison_fn = ldb_comparison_objectGUID
401 .name = LDB_SYNTAX_SAMBA_OBJECT_CATEGORY,
402 .ldif_read_fn = ldb_handler_copy,
403 .ldif_write_fn = ldb_handler_copy,
404 .canonicalise_fn= ldif_canonicalise_objectCategory,
405 .comparison_fn = ldif_comparison_objectCategory
409 static const struct {
412 } samba_attributes[] = {
413 { "objectSid", LDB_SYNTAX_SAMBA_SID },
414 { "securityIdentifier", LDB_SYNTAX_SAMBA_SID },
415 { "ntSecurityDescriptor", LDB_SYNTAX_SAMBA_SECURITY_DESCRIPTOR },
416 { "objectGUID", LDB_SYNTAX_SAMBA_GUID },
417 { "invocationId", LDB_SYNTAX_SAMBA_GUID },
418 { "schemaIDGUID", LDB_SYNTAX_SAMBA_GUID },
419 { "attributeSecurityGUID", LDB_SYNTAX_SAMBA_GUID },
420 { "parentGUID", LDB_SYNTAX_SAMBA_GUID },
421 { "siteGUID", LDB_SYNTAX_SAMBA_GUID },
422 { "pKTGUID", LDB_SYNTAX_SAMBA_GUID },
423 { "fRSVersionGUID", LDB_SYNTAX_SAMBA_GUID },
424 { "fRSReplicaSetGUID", LDB_SYNTAX_SAMBA_GUID },
425 { "netbootGUID", LDB_SYNTAX_SAMBA_GUID },
426 { "objectCategory", LDB_SYNTAX_SAMBA_OBJECT_CATEGORY },
427 { "member", LDB_SYNTAX_DN },
428 { "memberOf", LDB_SYNTAX_DN },
429 { "nCName", LDB_SYNTAX_DN },
430 { "schemaNamingContext", LDB_SYNTAX_DN },
431 { "configurationNamingContext", LDB_SYNTAX_DN },
432 { "rootDomainNamingContext", LDB_SYNTAX_DN },
433 { "defaultNamingContext", LDB_SYNTAX_DN },
434 { "subRefs", LDB_SYNTAX_DN },
435 { "dMDLocation", LDB_SYNTAX_DN },
436 { "serverReference", LDB_SYNTAX_DN },
437 { "masteredBy", LDB_SYNTAX_DN },
438 { "msDs-masteredBy", LDB_SYNTAX_DN },
439 { "fSMORoleOwner", LDB_SYNTAX_DN },
443 register the samba ldif handlers
445 int ldb_register_samba_handlers(struct ldb_context *ldb)
449 for (i=0; i < ARRAY_SIZE(samba_attributes); i++) {
452 const struct ldb_schema_syntax *s = NULL;
454 for (j=0; j < ARRAY_SIZE(samba_syntaxes); j++) {
455 if (strcmp(samba_attributes[i].syntax, samba_syntaxes[j].name) == 0) {
456 s = &samba_syntaxes[j];
462 s = ldb_standard_syntax_by_name(ldb, samba_attributes[i].syntax);
469 ret = ldb_schema_attribute_add_with_syntax(ldb, samba_attributes[i].name, 0, s);
470 if (ret != LDB_SUCCESS) {