*/
#include "includes.h"
-#include "ldb/include/ldb.h"
-#include "ldb/include/ldb_errors.h"
-#include "ldb/include/ldb_module.h"
-#include "libcli/security/dom_sid.h"
+#include <ldb.h>
+#include <ldb_errors.h>
+#include <ldb_module.h>
+#include "libcli/security/security.h"
#include "librpc/gen_ndr/ndr_misc.h"
#include "librpc/gen_ndr/ndr_security.h"
#include "librpc/ndr/libndr.h"
#include "dsdb/samdb/samdb.h"
-#include "util.h"
+#include "dsdb/samdb/ldb_modules/util.h"
struct extended_dn_out_private {
bool dereference;
bool normalise;
struct dsdb_openldap_dereference_control *dereference_control;
+ const char **attrs;
};
+/* Do the lazy init of the derererence control */
+
+static int extended_dn_out_dereference_setup_control(struct ldb_context *ldb, struct extended_dn_out_private *p)
+{
+ const struct dsdb_schema *schema;
+ struct dsdb_openldap_dereference_control *dereference_control;
+ struct dsdb_attribute *cur;
+
+ unsigned int i = 0;
+ if (p->dereference_control) {
+ return LDB_SUCCESS;
+ }
+
+ schema = dsdb_get_schema(ldb, p);
+ if (!schema) {
+ /* No schema on this DB (yet) */
+ return LDB_SUCCESS;
+ }
+
+ p->dereference_control = dereference_control
+ = talloc_zero(p, struct dsdb_openldap_dereference_control);
+
+ if (!p->dereference_control) {
+ return ldb_oom(ldb);
+ }
+
+ for (cur = schema->attributes; cur; cur = cur->next) {
+ if (cur->dn_format != DSDB_NORMAL_DN) {
+ continue;
+ }
+ dereference_control->dereference
+ = talloc_realloc(p, dereference_control->dereference,
+ struct dsdb_openldap_dereference *, i + 2);
+ if (!dereference_control) {
+ return ldb_oom(ldb);
+ }
+ dereference_control->dereference[i] = talloc(dereference_control->dereference,
+ struct dsdb_openldap_dereference);
+ if (!dereference_control->dereference[i]) {
+ return ldb_oom(ldb);
+ }
+ dereference_control->dereference[i]->source_attribute = cur->lDAPDisplayName;
+ dereference_control->dereference[i]->dereference_attribute = p->attrs;
+ i++;
+ dereference_control->dereference[i] = NULL;
+ }
+ return LDB_SUCCESS;
+}
+
static char **copy_attrs(void *mem_ctx, const char * const * attrs)
{
char **nattrs;
cn=Adminstrator,cn=users,dc=samba,dc=example,dc=com becomes
CN=Adminstrator,CN=users,DC=samba,DC=example,DC=com
*/
-
-
static int fix_dn(struct ldb_context *ldb, struct ldb_dn *dn)
{
int i, ret;
return LDB_SUCCESS;
}
+
/* Inject the extended DN components, so the DN cn=Adminstrator,cn=users,dc=samba,dc=example,dc=com becomes
<GUID=541203ae-f7d6-47ef-8390-bfcf019f9583>;<SID=S-1-5-21-4177067393-1453636373-93818737-500>;cn=Adminstrator,cn=users,dc=samba,dc=example,dc=com */
const DATA_BLOB *sid_blob;
guid_blob = ldb_msg_find_ldb_val(ares->message, "objectGUID");
- sid_blob = ldb_msg_find_ldb_val(ares->message, "objectSID");
+ sid_blob = ldb_msg_find_ldb_val(ares->message, "objectSid");
if (!guid_blob) {
ldb_set_errstring(ldb, "Did not find objectGUID to inject into extended DN");
}
if (sid_blob && remove_sid) {
- ldb_msg_remove_attr(ares->message, "objectSID");
+ ldb_msg_remove_attr(ares->message, "objectSid");
}
return LDB_SUCCESS;
ldb_dn_set_extended_component(dn, "GUID", &guid_blob);
}
- sid_blob = ldb_msg_find_ldb_val(&fake_msg, "objectSID");
+ sid_blob = ldb_msg_find_ldb_val(&fake_msg, "objectSid");
- /* Look for the objectSID */
+ /* Look for the objectSid */
if (sid_blob) {
ldb_dn_set_extended_component(dn, "SID", sid_blob);
}
ldb_dn_set_extended_component(dn, "GUID", &guid_blob);
}
- /* Look for the objectSID */
+ /* Look for the objectSid */
sidBlob = ldb_msg_find_ldb_val(&fake_msg, "sambaSID");
if (sidBlob) {
int extended_type;
};
+
+/*
+ fix one-way links to have the right string DN, to cope with
+ renames of the target
+*/
+static int fix_one_way_link(struct extended_search_context *ac, struct ldb_dn *dn,
+ bool is_deleted_objects, bool *remove_value)
+{
+ struct GUID guid;
+ NTSTATUS status;
+ int ret;
+ struct ldb_dn *real_dn;
+ uint32_t search_flags;
+ TALLOC_CTX *tmp_ctx = talloc_new(ac);
+ const char *attrs[] = { NULL };
+ struct ldb_result *res;
+
+ (*remove_value) = false;
+
+ status = dsdb_get_extended_dn_guid(dn, &guid, "GUID");
+ if (!NT_STATUS_IS_OK(status)) {
+ /* this is a strange DN that doesn't have a GUID! just
+ return the current DN string?? */
+ talloc_free(tmp_ctx);
+ return LDB_SUCCESS;
+ }
+
+ search_flags = DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SEARCH_ALL_PARTITIONS | DSDB_SEARCH_ONE_ONLY;
+
+ if (ldb_request_get_control(ac->req, LDB_CONTROL_SHOW_DEACTIVATED_LINK_OID) ||
+ is_deleted_objects) {
+ search_flags |= DSDB_SEARCH_SHOW_DELETED;
+ }
+
+ ret = dsdb_module_search(ac->module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs,
+ search_flags, ac->req, "objectguid=%s", GUID_string(tmp_ctx, &guid));
+ if (ret != LDB_SUCCESS || res->count != 1) {
+ /* if we can't resolve this GUID, then we don't
+ display the link. This could be a link to a NC that we don't
+ have, or it could be a link to a deleted object
+ */
+ (*remove_value) = true;
+ talloc_free(tmp_ctx);
+ return LDB_SUCCESS;
+ }
+ real_dn = res->msgs[0]->dn;
+
+ if (strcmp(ldb_dn_get_linearized(dn), ldb_dn_get_linearized(real_dn)) == 0) {
+ /* its already correct */
+ talloc_free(tmp_ctx);
+ return LDB_SUCCESS;
+ }
+
+ /* fix the DN by replacing its components with those from the
+ * real DN
+ */
+ if (!ldb_dn_replace_components(dn, real_dn)) {
+ talloc_free(tmp_ctx);
+ return ldb_operr(ldb_module_get_ctx(ac->module));
+ }
+ talloc_free(tmp_ctx);
+
+ return LDB_SUCCESS;
+}
+
+
+/*
+ this is called to post-process the results from the search
+ */
static int extended_callback(struct ldb_request *req, struct ldb_reply *ares,
int (*handle_dereference)(struct ldb_dn *dn,
struct dsdb_openldap_dereference_result **dereference_attrs,
struct dsdb_openldap_dereference_result_control *dereference_control = NULL;
int ret;
unsigned int i, j;
- struct ldb_message *msg = ares->message;
+ struct ldb_message *msg;
struct extended_dn_out_private *p;
struct ldb_context *ldb;
- bool have_reveal_control, checked_reveal_control=false;
+ bool have_reveal_control=false, checked_reveal_control=false;
ac = talloc_get_type(req->context, struct extended_search_context);
p = talloc_get_type(ldb_module_get_private(ac->module), struct extended_dn_out_private);
ares->response, ares->error);
}
+ msg = ares->message;
+
switch (ares->type) {
case LDB_REPLY_REFERRAL:
return ldb_module_send_referral(ac->req, ares->referral);
for (i = 0; ac->schema && i < msg->num_elements; i++) {
bool make_extended_dn;
const struct dsdb_attribute *attribute;
+
attribute = dsdb_attribute_by_lDAPDisplayName(ac->schema, msg->elements[i].name);
if (!attribute) {
continue;
}
/* Look to see if this attributeSyntax is a DN */
- if (dsdb_dn_oid_to_format(attribute->syntax->ldap_oid) == DSDB_INVALID_DN) {
+ if (attribute->dn_format == DSDB_INVALID_DN) {
continue;
}
struct ldb_dn *dn;
struct dsdb_dn *dsdb_dn = NULL;
struct ldb_val *plain_dn = &msg->elements[i].values[j];
+ bool is_deleted_objects = false;
if (!checked_reveal_control) {
have_reveal_control =
}
dn = dsdb_dn->dn;
+ /* we need to know if this is a link to the
+ deleted objects container for fixing one way
+ links */
+ if (dsdb_dn->extra_part.length == 16) {
+ char *hex_string = data_blob_hex_string_upper(req, &dsdb_dn->extra_part);
+ if (hex_string && strcmp(hex_string, DS_GUID_DELETED_OBJECTS_CONTAINER) == 0) {
+ is_deleted_objects = true;
+ }
+ talloc_free(hex_string);
+ }
+
/* don't let users see the internal extended
GUID components */
if (!have_reveal_control) {
- const char *accept[] = { "GUID", "SID", "WKGUID", NULL };
+ const char *accept[] = { "GUID", "SID", NULL };
ldb_dn_extended_filter(dn, accept);
}
return ldb_module_done(ac->req, NULL, NULL, ret);
}
}
+
+ /* note that we don't fixup objectCategory as
+ it should not be possible to move
+ objectCategory elements in the schema */
+ if (attribute->one_way_link &&
+ strcasecmp(attribute->lDAPDisplayName, "objectCategory") != 0) {
+ bool remove_value;
+ ret = fix_one_way_link(ac, dn, is_deleted_objects, &remove_value);
+ if (ret != LDB_SUCCESS) {
+ talloc_free(dsdb_dn);
+ return ldb_module_done(ac->req, NULL, NULL, ret);
+ }
+ if (remove_value &&
+ !ldb_request_get_control(req, LDB_CONTROL_REVEAL_INTERNALS)) {
+ /* we show these with REVEAL
+ to allow dbcheck to find and
+ cleanup these orphaned links */
+ memmove(&msg->elements[i].values[j],
+ &msg->elements[i].values[j+1],
+ (msg->elements[i].num_values-(j+1))*sizeof(struct ldb_val));
+ msg->elements[i].num_values--;
+ j--;
+ continue;
+ }
+ }
if (make_extended_dn) {
dn_str = dsdb_dn_get_extended_linearized(msg->elements[i].values,
if (! is_attr_in_list(req->op.search.attrs, "objectGUID")) {
ac->remove_guid = true;
}
- if (! is_attr_in_list(req->op.search.attrs, "objectSID")) {
+ if (! is_attr_in_list(req->op.search.attrs, "objectSid")) {
ac->remove_sid = true;
}
if (ac->remove_guid || ac->remove_sid) {
return ldb_operr(ldb);
}
if (ac->remove_sid) {
- if (!add_attrs(ac, &new_attrs, "objectSID"))
+ if (!add_attrs(ac, &new_attrs, "objectSid"))
return ldb_operr(ldb);
}
const_attrs = (const char * const *)new_attrs;
req->controls,
ac, callback,
req);
+ LDB_REQ_SET_LOCATION(down_req);
if (ret != LDB_SUCCESS) {
return ret;
}
/* Add in dereference control, if we were asked to, we are
* using the 'dereference' mode (such as with an OpenLDAP
* backend) and have the control prepared */
- if (control && p && p->dereference && p->dereference_control) {
- ret = ldb_request_add_control(down_req,
- DSDB_OPENLDAP_DEREFERENCE_CONTROL,
- false, p->dereference_control);
+ if (control && p && p->dereference) {
+ ret = extended_dn_out_dereference_setup_control(ldb, p);
if (ret != LDB_SUCCESS) {
return ret;
}
+
+ /* We should always have this, but before the schema
+ * is with us, things get tricky */
+ if (p->dereference_control) {
+
+ /* This control must *not* be critical,
+ * because if this particular request did not
+ * return any dereferencable attributes in the
+ * end, then OpenLDAP will reply with
+ * unavailableCriticalExtension, rather than
+ * just an empty return control */
+ ret = ldb_request_add_control(down_req,
+ DSDB_OPENLDAP_DEREFERENCE_CONTROL,
+ false, p->dereference_control);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
}
/* perform the search */
static int extended_dn_out_dereference_init(struct ldb_module *module, const char *attrs[])
{
int ret;
- unsigned int i = 0;
struct extended_dn_out_private *p = talloc_zero(module, struct extended_dn_out_private);
struct dsdb_extended_dn_store_format *dn_format;
- struct dsdb_openldap_dereference_control *dereference_control;
- struct dsdb_attribute *cur;
- struct ldb_context *ldb = ldb_module_get_ctx(module);
- const struct dsdb_schema *schema;
ldb_module_set_private(module, p);
if (!p) {
- return ldb_oom(ldb);
+ return ldb_module_oom(module);
}
dn_format = talloc(p, struct dsdb_extended_dn_store_format);
if (!dn_format) {
talloc_free(p);
- return ldb_oom(ldb_module_get_ctx(module));
+ return ldb_module_oom(module);
}
dn_format->store_extended_dn_in_ldb = false;
p->dereference = true;
+ p->attrs = attrs;
/* At the moment, servers that need dereference also need the
* DN and attribute names to be normalised */
p->normalise = true;
ret = ldb_mod_register_control(module, LDB_CONTROL_EXTENDED_DN_OID);
if (ret != LDB_SUCCESS) {
- ldb_debug(ldb, LDB_DEBUG_ERROR,
- "extended_dn_out: Unable to register control with rootdse!\n");
- return ldb_operr(ldb);
- }
-
- ret = ldb_next_init(module);
-
- if (ret != LDB_SUCCESS) {
- return ret;
- }
-
- schema = dsdb_get_schema(ldb, p);
- if (!schema) {
- /* No schema on this DB (yet) */
- return LDB_SUCCESS;
+ ldb_debug(ldb_module_get_ctx(module), LDB_DEBUG_ERROR,
+ "extended_dn_out: Unable to register control with rootdse!\n");
+ return ldb_operr(ldb_module_get_ctx(module));
}
- p->dereference_control = dereference_control
- = talloc_zero(p, struct dsdb_openldap_dereference_control);
-
- if (!p->dereference_control) {
- return ldb_oom(ldb);
- }
-
- for (cur = schema->attributes; cur; cur = cur->next) {
- if (dsdb_dn_oid_to_format(cur->syntax->ldap_oid) == DSDB_INVALID_DN) {
- continue;
- }
- dereference_control->dereference
- = talloc_realloc(p, dereference_control->dereference,
- struct dsdb_openldap_dereference *, i + 2);
- if (!dereference_control) {
- return ldb_oom(ldb);
- }
- dereference_control->dereference[i] = talloc(dereference_control->dereference,
- struct dsdb_openldap_dereference);
- if (!dereference_control->dereference[i]) {
- return ldb_oom(ldb);
- }
- dereference_control->dereference[i]->source_attribute = cur->lDAPDisplayName;
- dereference_control->dereference[i]->dereference_attribute = attrs;
- i++;
- dereference_control->dereference[i] = NULL;
- }
- return LDB_SUCCESS;
+ return ldb_next_init(module);
}
static int extended_dn_out_openldap_init(struct ldb_module *module)
{
static const char *attrs[] = {
"entryUUID",
- "objectSID",
+ "objectSid",
NULL
};
{
static const char *attrs[] = {
"nsUniqueId",
- "objectSID",
+ "sambaSID",
NULL
};
return extended_dn_out_dereference_init(module, attrs);
}
-_PUBLIC_ const struct ldb_module_ops ldb_extended_dn_out_ldb_module_ops = {
+static const struct ldb_module_ops ldb_extended_dn_out_ldb_module_ops = {
.name = "extended_dn_out_ldb",
.search = extended_dn_out_ldb_search,
.init_context = extended_dn_out_ldb_init,
};
-_PUBLIC_ const struct ldb_module_ops ldb_extended_dn_out_openldap_module_ops = {
+static const struct ldb_module_ops ldb_extended_dn_out_openldap_module_ops = {
.name = "extended_dn_out_openldap",
.search = extended_dn_out_openldap_search,
.init_context = extended_dn_out_openldap_init,
};
-_PUBLIC_ const struct ldb_module_ops ldb_extended_dn_out_fds_module_ops = {
+static const struct ldb_module_ops ldb_extended_dn_out_fds_module_ops = {
.name = "extended_dn_out_fds",
.search = extended_dn_out_fds_search,
.init_context = extended_dn_out_fds_init,
};
+
+/*
+ initialise the module
+ */
+_PUBLIC_ int ldb_extended_dn_out_module_init(const char *version)
+{
+ int ret;
+ LDB_MODULE_CHECK_VERSION(version);
+ ret = ldb_register_module(&ldb_extended_dn_out_ldb_module_ops);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ ret = ldb_register_module(&ldb_extended_dn_out_openldap_module_ops);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ ret = ldb_register_module(&ldb_extended_dn_out_fds_module_ops);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ return LDB_SUCCESS;
+}
git.samba.org / mat / samba.git / blobdiff