4 Copyright (C) Simo Sorce 2005-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2007-2008
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * Component: ldb extended dn control module
26 * Description: this module interprets DNs of the form <SID=S-1-2-4456> into normal DNs.
34 #include <ldb_errors.h>
35 #include <ldb_module.h>
38 TODO: if relax is not set then we need to reject the fancy RMD_* and
39 DELETED extended DN codes
43 struct extended_search_context {
44 struct ldb_module *module;
45 struct ldb_request *req;
46 struct ldb_dn *basedn;
47 char *wellknown_object;
51 /* An extra layer of indirection because LDB does not allow the original request to be altered */
53 static int extended_final_callback(struct ldb_request *req, struct ldb_reply *ares)
55 int ret = LDB_ERR_OPERATIONS_ERROR;
56 struct extended_search_context *ac;
57 ac = talloc_get_type(req->context, struct extended_search_context);
59 if (ares->error != LDB_SUCCESS) {
60 ret = ldb_module_done(ac->req, ares->controls,
61 ares->response, ares->error);
66 ret = ldb_module_send_entry(ac->req, ares->message, ares->controls);
68 case LDB_REPLY_REFERRAL:
70 ret = ldb_module_send_referral(ac->req, ares->referral);
74 ret = ldb_module_done(ac->req, ares->controls,
75 ares->response, ares->error);
82 static int extended_base_callback(struct ldb_request *req, struct ldb_reply *ares)
84 struct extended_search_context *ac;
85 struct ldb_request *down_req;
86 struct ldb_message_element *el;
91 const char *found = NULL;
93 ac = talloc_get_type(req->context, struct extended_search_context);
96 return ldb_module_done(ac->req, NULL, NULL,
97 LDB_ERR_OPERATIONS_ERROR);
99 if (ares->error != LDB_SUCCESS) {
100 return ldb_module_done(ac->req, ares->controls,
101 ares->response, ares->error);
104 switch (ares->type) {
105 case LDB_REPLY_ENTRY:
106 if (!ac->wellknown_object) {
107 ac->basedn = talloc_steal(ac, ares->message->dn);
111 wkn_len = strlen(ac->wellknown_object);
113 el = ldb_msg_find_element(ares->message, "wellKnownObjects");
119 for (i=0; i < el->num_values; i++) {
120 valstr = talloc_strndup(ac,
121 (const char *)el->values[i].data,
122 el->values[i].length);
124 ldb_oom(ldb_module_get_ctx(ac->module));
125 return ldb_module_done(ac->req, NULL, NULL,
126 LDB_ERR_OPERATIONS_ERROR);
129 if (strncasecmp(valstr, ac->wellknown_object, wkn_len) != 0) {
134 found = &valstr[wkn_len];
142 ac->basedn = ldb_dn_new(ac, ldb_module_get_ctx(ac->module), found);
145 ldb_oom(ldb_module_get_ctx(ac->module));
146 return ldb_module_done(ac->req, NULL, NULL,
147 LDB_ERR_OPERATIONS_ERROR);
152 case LDB_REPLY_REFERRAL:
158 const char *str = talloc_asprintf(req, "Base-DN '%s' not found",
159 ldb_dn_get_extended_linearized(req, ac->req->op.search.base, 1));
160 ldb_set_errstring(ldb_module_get_ctx(ac->module), str);
161 return ldb_module_done(ac->req, NULL, NULL,
162 LDB_ERR_NO_SUCH_OBJECT);
165 switch (ac->req->operation) {
167 ret = ldb_build_search_req_ex(&down_req,
168 ldb_module_get_ctx(ac->module), ac->req,
170 ac->req->op.search.scope,
171 ac->req->op.search.tree,
172 ac->req->op.search.attrs,
174 ac, extended_final_callback,
176 LDB_REQ_SET_LOCATION(down_req);
180 struct ldb_message *add_msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
182 ldb_oom(ldb_module_get_ctx(ac->module));
183 return ldb_module_done(ac->req, NULL, NULL,
184 LDB_ERR_OPERATIONS_ERROR);
187 add_msg->dn = ac->basedn;
189 ret = ldb_build_add_req(&down_req,
190 ldb_module_get_ctx(ac->module), ac->req,
193 ac, extended_final_callback,
195 LDB_REQ_SET_LOCATION(down_req);
200 struct ldb_message *mod_msg = ldb_msg_copy_shallow(ac, ac->req->op.mod.message);
202 ldb_oom(ldb_module_get_ctx(ac->module));
203 return ldb_module_done(ac->req, NULL, NULL,
204 LDB_ERR_OPERATIONS_ERROR);
207 mod_msg->dn = ac->basedn;
209 ret = ldb_build_mod_req(&down_req,
210 ldb_module_get_ctx(ac->module), ac->req,
213 ac, extended_final_callback,
215 LDB_REQ_SET_LOCATION(down_req);
219 ret = ldb_build_del_req(&down_req,
220 ldb_module_get_ctx(ac->module), ac->req,
223 ac, extended_final_callback,
225 LDB_REQ_SET_LOCATION(down_req);
228 ret = ldb_build_rename_req(&down_req,
229 ldb_module_get_ctx(ac->module), ac->req,
231 ac->req->op.rename.newdn,
233 ac, extended_final_callback,
235 LDB_REQ_SET_LOCATION(down_req);
238 return ldb_module_done(ac->req, NULL, NULL, LDB_ERR_OPERATIONS_ERROR);
241 if (ret != LDB_SUCCESS) {
242 return ldb_module_done(ac->req, NULL, NULL, ret);
245 return ldb_next_request(ac->module, down_req);
251 static int extended_dn_in_fix(struct ldb_module *module, struct ldb_request *req, struct ldb_dn *dn)
253 struct extended_search_context *ac;
254 struct ldb_request *down_req;
256 struct ldb_dn *base_dn = NULL;
257 enum ldb_scope base_dn_scope = LDB_SCOPE_BASE;
258 const char *base_dn_filter = NULL;
259 const char * const *base_dn_attrs = NULL;
260 char *wellknown_object = NULL;
261 static const char *no_attr[] = {
264 static const char *wkattr[] = {
268 bool all_partitions = false;
270 if (!ldb_dn_has_extended(dn)) {
271 /* Move along there isn't anything to see here */
272 return ldb_next_request(module, req);
274 /* It looks like we need to map the DN */
275 const struct ldb_val *sid_val, *guid_val, *wkguid_val;
276 int num_components = ldb_dn_get_comp_num(dn);
277 int num_ex_components = ldb_dn_get_extended_comp_num(dn);
280 windows ldap searchs don't allow a baseDN with more
281 than one extended component, or an extended
282 component and a string DN
284 We only enforce this over ldap, not for internal
285 use, as there are just too many places where we
286 internally want to use a DN that has come from a
287 search with extended DN enabled, or comes from a DRS
290 Enforcing this would also make debugging samba much
291 harder, as we'd need to use ldb_dn_minimise() in a
292 lot of places, and that would lose the DN string
293 which is so useful for working out what a request is
296 if ((num_components != 0 || num_ex_components != 1) &&
297 ldb_req_is_untrusted(req)) {
298 return ldb_error(ldb_module_get_ctx(module),
299 LDB_ERR_INVALID_DN_SYNTAX, "invalid number of DN components");
302 sid_val = ldb_dn_get_extended_component(dn, "SID");
303 guid_val = ldb_dn_get_extended_component(dn, "GUID");
304 wkguid_val = ldb_dn_get_extended_component(dn, "WKGUID");
307 all_partitions = true;
308 base_dn = ldb_get_default_basedn(ldb_module_get_ctx(module));
309 base_dn_filter = talloc_asprintf(req, "(objectSid=%s)",
310 ldb_binary_encode(req, *sid_val));
311 if (!base_dn_filter) {
312 return ldb_oom(ldb_module_get_ctx(module));
314 base_dn_scope = LDB_SCOPE_SUBTREE;
315 base_dn_attrs = no_attr;
317 } else if (guid_val) {
319 all_partitions = true;
320 base_dn = ldb_get_default_basedn(ldb_module_get_ctx(module));
321 base_dn_filter = talloc_asprintf(req, "(objectGUID=%s)",
322 ldb_binary_encode(req, *guid_val));
323 if (!base_dn_filter) {
324 return ldb_oom(ldb_module_get_ctx(module));
326 base_dn_scope = LDB_SCOPE_SUBTREE;
327 base_dn_attrs = no_attr;
330 } else if (wkguid_val) {
335 wkguid_dup = talloc_strndup(req, (char *)wkguid_val->data, wkguid_val->length);
337 p = strchr(wkguid_dup, ',');
339 return ldb_error(ldb_module_get_ctx(module), LDB_ERR_INVALID_DN_SYNTAX,
340 "Invalid WKGUID format");
346 wellknown_object = talloc_asprintf(req, "B:32:%s:", wkguid_dup);
347 if (!wellknown_object) {
348 return ldb_oom(ldb_module_get_ctx(module));
353 base_dn = ldb_dn_new(req, ldb_module_get_ctx(module), tail_str);
354 talloc_free(wkguid_dup);
356 return ldb_oom(ldb_module_get_ctx(module));
358 base_dn_filter = talloc_strdup(req, "(objectClass=*)");
359 if (!base_dn_filter) {
360 return ldb_oom(ldb_module_get_ctx(module));
362 base_dn_scope = LDB_SCOPE_BASE;
363 base_dn_attrs = wkattr;
365 return ldb_error(ldb_module_get_ctx(module), LDB_ERR_INVALID_DN_SYNTAX,
366 "Invalid extended DN component");
369 ac = talloc_zero(req, struct extended_search_context);
371 return ldb_oom(ldb_module_get_ctx(module));
376 ac->basedn = NULL; /* Filled in if the search finds the DN by SID/GUID etc */
377 ac->wellknown_object = wellknown_object;
379 /* If the base DN was an extended DN (perhaps a well known
380 * GUID) then search for that, so we can proceed with the original operation */
382 ret = ldb_build_search_req(&down_req,
383 ldb_module_get_ctx(module), ac,
389 ac, extended_base_callback,
391 LDB_REQ_SET_LOCATION(down_req);
392 if (ret != LDB_SUCCESS) {
393 return ldb_operr(ldb_module_get_ctx(module));
396 if (all_partitions) {
397 struct ldb_search_options_control *control;
398 control = talloc(down_req, struct ldb_search_options_control);
399 control->search_options = 2;
400 ret = ldb_request_replace_control(down_req,
401 LDB_CONTROL_SEARCH_OPTIONS_OID,
403 if (ret != LDB_SUCCESS) {
404 ldb_oom(ldb_module_get_ctx(module));
409 /* perform the search */
410 return ldb_next_request(module, down_req);
414 static int extended_dn_in_search(struct ldb_module *module, struct ldb_request *req)
416 return extended_dn_in_fix(module, req, req->op.search.base);
419 static int extended_dn_in_modify(struct ldb_module *module, struct ldb_request *req)
421 return extended_dn_in_fix(module, req, req->op.mod.message->dn);
424 static int extended_dn_in_del(struct ldb_module *module, struct ldb_request *req)
426 return extended_dn_in_fix(module, req, req->op.del.dn);
429 static int extended_dn_in_rename(struct ldb_module *module, struct ldb_request *req)
431 return extended_dn_in_fix(module, req, req->op.rename.olddn);
434 static const struct ldb_module_ops ldb_extended_dn_in_module_ops = {
435 .name = "extended_dn_in",
436 .search = extended_dn_in_search,
437 .modify = extended_dn_in_modify,
438 .del = extended_dn_in_del,
439 .rename = extended_dn_in_rename,
442 int ldb_extended_dn_in_module_init(const char *version)
444 LDB_MODULE_CHECK_VERSION(version);
445 return ldb_register_module(&ldb_extended_dn_in_module_ops);