source4/ldap_server/ldap_bind.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    LDAP server
   4    Copyright (C) Stefan Metzmacher 2004
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "ldap_server/ldap_server.h"
  22 #include "auth/auth.h"
  23 #include "smbd/service.h"
  24 #include <ldb.h>
  25 #include <ldb_errors.h>
  26 #include "../lib/util/dlinklist.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "auth/gensec/gensec.h"
  29 #include "auth/gensec/gensec_tstream.h"
  30 #include "param/param.h"
  31 #include "../lib/util/tevent_ntstatus.h"
  32
  33 static char *ldapsrv_bind_error_msg(TALLOC_CTX *mem_ctx,
  34                                     HRESULT hresult,
  35                                     uint32_t DSID,
  36                                     NTSTATUS status)
  37 {
  38         WERROR werr;
  39         char *msg = NULL;
  40
  41         status = nt_status_squash(status);
  42         werr = ntstatus_to_werror(status);
  43
  44         /*
  45          * There are 4 lower case hex digits following 'v' at the end,
  46          * but different Windows Versions return different values:
  47          *
  48          * Windows 2008R2 uses 'v1db1'
  49          * Windows 2012R2 uses 'v2580'
  50          *
  51          * We just match Windows 2008R2 as that's what was referenced
  52          * in https://bugzilla.samba.org/show_bug.cgi?id=9048
  53          */
  54         msg = talloc_asprintf(mem_ctx, "%08X: LdapErr: DSID-%08X, comment: "
  55                               "AcceptSecurityContext error, data %x, v1db1",
  56                               (unsigned)HRES_ERROR_V(hresult),
  57                               (unsigned)DSID,
  58                               (unsigned)W_ERROR_V(werr));
  59
  60         return msg;
  61 }
  62
  63 struct ldapsrv_bind_wait_context {
  64         struct ldapsrv_reply *reply;
  65         struct tevent_req *req;
  66         NTSTATUS status;
  67         bool done;
  68 };
  69
  70 struct ldapsrv_bind_wait_state {
  71         uint8_t dummy;
  72 };
  73
  74 static struct tevent_req *ldapsrv_bind_wait_send(TALLOC_CTX *mem_ctx,
  75                                                  struct tevent_context *ev,
  76                                                  void *private_data)
  77 {
  78         struct ldapsrv_bind_wait_context *bind_wait =
  79                 talloc_get_type_abort(private_data,
  80                 struct ldapsrv_bind_wait_context);
  81         struct tevent_req *req;
  82         struct ldapsrv_bind_wait_state *state;
  83
  84         req = tevent_req_create(mem_ctx, &state,
  85                                 struct ldapsrv_bind_wait_state);
  86         if (req == NULL) {
  87                 return NULL;
  88         }
  89         bind_wait->req = req;
  90
  91         tevent_req_defer_callback(req, ev);
  92
  93         if (!bind_wait->done) {
  94                 return req;
  95         }
  96
  97         if (tevent_req_nterror(req, bind_wait->status)) {
  98                 return tevent_req_post(req, ev);
  99         }
 100
 101         tevent_req_done(req);
 102         return tevent_req_post(req, ev);
 103 }
 104
 105 static NTSTATUS ldapsrv_bind_wait_recv(struct tevent_req *req)
 106 {
 107         return tevent_req_simple_recv_ntstatus(req);
 108 }
 109
 110 static NTSTATUS ldapsrv_bind_wait_setup(struct ldapsrv_call *call,
 111                                         struct ldapsrv_reply *reply)
 112 {
 113         struct ldapsrv_bind_wait_context *bind_wait = NULL;
 114
 115         if (call->wait_private != NULL) {
 116                 return NT_STATUS_INTERNAL_ERROR;
 117         }
 118
 119         bind_wait = talloc_zero(call, struct ldapsrv_bind_wait_context);
 120         if (bind_wait == NULL) {
 121                 return NT_STATUS_NO_MEMORY;
 122         }
 123         bind_wait->reply = reply;
 124
 125         call->wait_private = bind_wait;
 126         call->wait_send = ldapsrv_bind_wait_send;
 127         call->wait_recv = ldapsrv_bind_wait_recv;
 128         return NT_STATUS_OK;
 129 }
 130
 131 static void ldapsrv_bind_wait_finished(struct ldapsrv_call *call,
 132                                        NTSTATUS status)
 133 {
 134         struct ldapsrv_bind_wait_context *bind_wait =
 135                 talloc_get_type_abort(call->wait_private,
 136                 struct ldapsrv_bind_wait_context);
 137
 138         bind_wait->done = true;
 139         bind_wait->status = status;
 140
 141         if (bind_wait->req == NULL) {
 142                 return;
 143         }
 144
 145         if (tevent_req_nterror(bind_wait->req, status)) {
 146                 return;
 147         }
 148
 149         tevent_req_done(bind_wait->req);
 150 }
 151
 152 static void ldapsrv_BindSimple_done(struct tevent_req *subreq);
 153
 154 static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
 155 {
 156         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 157         struct ldapsrv_reply *reply = NULL;
 158         struct ldap_BindResponse *resp = NULL;
 159         int result;
 160         const char *errstr = NULL;
 161         NTSTATUS status;
 162         bool using_tls = call->conn->sockets.active == call->conn->sockets.tls;
 163         struct tevent_req *subreq = NULL;
 164
 165         DEBUG(10, ("BindSimple dn: %s\n",req->dn));
 166
 167         reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 168         if (!reply) {
 169                 return NT_STATUS_NO_MEMORY;
 170         }
 171
 172         if (req->dn != NULL &&
 173             strlen(req->dn) != 0 &&
 174             call->conn->require_strong_auth > LDAP_SERVER_REQUIRE_STRONG_AUTH_NO &&
 175             !using_tls)
 176         {
 177                 status = NT_STATUS_NETWORK_ACCESS_DENIED;
 178                 result = LDAP_STRONG_AUTH_REQUIRED;
 179                 errstr = talloc_asprintf(reply,
 180                                          "BindSimple: Transport encryption required.");
 181                 goto do_reply;
 182         }
 183
 184         subreq = authenticate_ldap_simple_bind_send(call,
 185                                         call->conn->connection->event.ctx,
 186                                         call->conn->connection->msg_ctx,
 187                                         call->conn->lp_ctx,
 188                                         call->conn->connection->remote_address,
 189                                         call->conn->connection->local_address,
 190                                         using_tls,
 191                                         req->dn,
 192                                         req->creds.password);
 193         if (subreq == NULL) {
 194                 return NT_STATUS_NO_MEMORY;
 195         }
 196         tevent_req_set_callback(subreq, ldapsrv_BindSimple_done, call);
 197
 198         status = ldapsrv_bind_wait_setup(call, reply);
 199         if (!NT_STATUS_IS_OK(status)) {
 200                 TALLOC_FREE(subreq);
 201                 return status;
 202         }
 203
 204         /*
 205          * The rest will be async.
 206          */
 207         return NT_STATUS_OK;
 208
 209 do_reply:
 210         resp = &reply->msg->r.BindResponse;
 211         resp->response.resultcode = result;
 212         resp->response.errormessage = errstr;
 213         resp->response.dn = NULL;
 214         resp->response.referral = NULL;
 215         resp->SASL.secblob = NULL;
 216
 217         ldapsrv_queue_reply(call, reply);
 218         return NT_STATUS_OK;
 219 }
 220
 221 static void ldapsrv_BindSimple_done(struct tevent_req *subreq)
 222 {
 223         struct ldapsrv_call *call =
 224                 tevent_req_callback_data(subreq,
 225                 struct ldapsrv_call);
 226         struct ldapsrv_bind_wait_context *bind_wait =
 227                 talloc_get_type_abort(call->wait_private,
 228                 struct ldapsrv_bind_wait_context);
 229         struct ldapsrv_reply *reply = bind_wait->reply;
 230         struct auth_session_info *session_info = NULL;
 231         NTSTATUS status;
 232         struct ldap_BindResponse *resp = NULL;
 233         int result;
 234         const char *errstr = NULL;
 235
 236         status = authenticate_ldap_simple_bind_recv(subreq,
 237                                                     call,
 238                                                     &session_info);
 239         if (NT_STATUS_IS_OK(status)) {
 240                 result = LDAP_SUCCESS;
 241                 errstr = NULL;
 242
 243                 talloc_unlink(call->conn, call->conn->session_info);
 244                 call->conn->session_info = talloc_steal(call->conn, session_info);
 245
 246                 call->conn->authz_logged = true;
 247
 248                 /* don't leak the old LDB */
 249                 talloc_unlink(call->conn, call->conn->ldb);
 250
 251                 status = ldapsrv_backend_Init(call->conn);
 252
 253                 if (!NT_STATUS_IS_OK(status)) {
 254                         result = LDAP_OPERATIONS_ERROR;
 255                         errstr = talloc_asprintf(reply, "Simple Bind: Failed to advise ldb new credentials: %s", nt_errstr(status));
 256                 }
 257         } else {
 258                 status = nt_status_squash(status);
 259
 260                 result = LDAP_INVALID_CREDENTIALS;
 261                 errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_INVALID_TOKEN,
 262                                                 0x0C0903A9, status);
 263         }
 264
 265         resp = &reply->msg->r.BindResponse;
 266         resp->response.resultcode = result;
 267         resp->response.errormessage = errstr;
 268         resp->response.dn = NULL;
 269         resp->response.referral = NULL;
 270         resp->SASL.secblob = NULL;
 271
 272         ldapsrv_queue_reply(call, reply);
 273         ldapsrv_bind_wait_finished(call, NT_STATUS_OK);
 274 }
 275
 276 struct ldapsrv_sasl_postprocess_context {
 277         struct ldapsrv_connection *conn;
 278         struct tstream_context *sasl;
 279 };
 280
 281 struct ldapsrv_sasl_postprocess_state {
 282         uint8_t dummy;
 283 };
 284
 285 static struct tevent_req *ldapsrv_sasl_postprocess_send(TALLOC_CTX *mem_ctx,
 286                                                 struct tevent_context *ev,
 287                                                 void *private_data)
 288 {
 289         struct ldapsrv_sasl_postprocess_context *context =
 290                 talloc_get_type_abort(private_data,
 291                 struct ldapsrv_sasl_postprocess_context);
 292         struct tevent_req *req;
 293         struct ldapsrv_sasl_postprocess_state *state;
 294
 295         req = tevent_req_create(mem_ctx, &state,
 296                                 struct ldapsrv_sasl_postprocess_state);
 297         if (req == NULL) {
 298                 return NULL;
 299         }
 300
 301         TALLOC_FREE(context->conn->sockets.sasl);
 302         context->conn->sockets.sasl = talloc_move(context->conn, &context->sasl);
 303         context->conn->sockets.active = context->conn->sockets.sasl;
 304
 305         tevent_req_done(req);
 306         return tevent_req_post(req, ev);
 307 }
 308
 309 static NTSTATUS ldapsrv_sasl_postprocess_recv(struct tevent_req *req)
 310 {
 311         return tevent_req_simple_recv_ntstatus(req);
 312 }
 313
 314 static NTSTATUS ldapsrv_setup_gensec(struct ldapsrv_connection *conn,
 315                                      const char *sasl_mech,
 316                                      struct gensec_security **_gensec_security)
 317 {
 318         NTSTATUS status;
 319
 320         struct gensec_security *gensec_security;
 321
 322         status = samba_server_gensec_start(conn,
 323                                            conn->connection->event.ctx,
 324                                            conn->connection->msg_ctx,
 325                                            conn->lp_ctx,
 326                                            conn->server_credentials,
 327                                            "ldap",
 328                                            &gensec_security);
 329         if (!NT_STATUS_IS_OK(status)) {
 330                 return status;
 331         }
 332
 333         status = gensec_set_target_service_description(gensec_security,
 334                                                        "LDAP");
 335         if (!NT_STATUS_IS_OK(status)) {
 336                 return status;
 337         }
 338
 339         status = gensec_set_remote_address(gensec_security,
 340                                            conn->connection->remote_address);
 341         if (!NT_STATUS_IS_OK(status)) {
 342                 return status;
 343         }
 344
 345         status = gensec_set_local_address(gensec_security,
 346                                           conn->connection->local_address);
 347         if (!NT_STATUS_IS_OK(status)) {
 348                 return status;
 349         }
 350
 351         gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES);
 352         gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAP_STYLE);
 353
 354         if (conn->sockets.active == conn->sockets.tls) {
 355                 gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAPS_TRANSPORT);
 356         }
 357
 358         status = gensec_start_mech_by_sasl_name(gensec_security, sasl_mech);
 359
 360         if (!NT_STATUS_IS_OK(status)) {
 361                 return status;
 362         }
 363
 364         *_gensec_security = gensec_security;
 365         return status;
 366 }
 367
 368 static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
 369 {
 370         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 371         struct ldapsrv_reply *reply;
 372         struct ldap_BindResponse *resp;
 373         struct ldapsrv_connection *conn;
 374         int result = 0;
 375         const char *errstr=NULL;
 376         NTSTATUS status = NT_STATUS_OK;
 377
 378         DEBUG(10, ("BindSASL dn: %s\n",req->dn));
 379
 380         reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 381         if (!reply) {
 382                 return NT_STATUS_NO_MEMORY;
 383         }
 384         resp = &reply->msg->r.BindResponse;
 385
 386         conn = call->conn;
 387
 388         /*
 389          * TODO: a SASL bind with a different mechanism
 390          *       should cancel an inprogress SASL bind.
 391          *       (see RFC 4513)
 392          */
 393
 394         if (!conn->gensec) {
 395                 status = ldapsrv_setup_gensec(conn, req->creds.SASL.mechanism,
 396                                               &conn->gensec);
 397                 if (!NT_STATUS_IS_OK(status)) {
 398                         DEBUG(1, ("Failed to start GENSEC server for [%s] code: %s\n",
 399                                   ldb_binary_encode_string(call, req->creds.SASL.mechanism),
 400                                   nt_errstr(status)));
 401                         result = LDAP_OPERATIONS_ERROR;
 402                         errstr = talloc_asprintf(reply, "SASL: Failed to start authentication system: %s",
 403                                                  nt_errstr(status));
 404                         goto do_reply;
 405                 }
 406         }
 407
 408         if (NT_STATUS_IS_OK(status)) {
 409                 DATA_BLOB input = data_blob(NULL, 0);
 410                 DATA_BLOB output = data_blob(NULL, 0);
 411
 412                 if (req->creds.SASL.secblob) {
 413                         input = *req->creds.SASL.secblob;
 414                 }
 415
 416                 status = gensec_update_ev(conn->gensec, reply, conn->connection->event.ctx,
 417                                           input, &output);
 418
 419                 /* Windows 2000 mmc doesn't like secblob == NULL and reports a decoding error */
 420                 resp->SASL.secblob = talloc(reply, DATA_BLOB);
 421                 NT_STATUS_HAVE_NO_MEMORY(resp->SASL.secblob);
 422                 *resp->SASL.secblob = output;
 423         } else {
 424                 resp->SASL.secblob = NULL;
 425         }
 426
 427         if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED, status)) {
 428                 result = LDAP_SASL_BIND_IN_PROGRESS;
 429                 errstr = NULL;
 430                 goto do_reply;
 431         } else if (NT_STATUS_IS_OK(status)) {
 432                 struct ldapsrv_sasl_postprocess_context *context = NULL;
 433
 434                 result = LDAP_SUCCESS;
 435                 errstr = NULL;
 436
 437                 if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
 438                     gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
 439
 440                         context = talloc(call, struct ldapsrv_sasl_postprocess_context);
 441
 442                         if (!context) {
 443                                 status = NT_STATUS_NO_MEMORY;
 444                         }
 445                 }
 446
 447                 if (context && conn->sockets.tls) {
 448                         TALLOC_FREE(context);
 449                         status = NT_STATUS_NOT_SUPPORTED;
 450                         result = LDAP_UNWILLING_TO_PERFORM;
 451                         errstr = talloc_asprintf(reply,
 452                                                  "SASL:[%s]: Sign or Seal are not allowed if TLS is used",
 453                                                  req->creds.SASL.mechanism);
 454                         goto do_reply;
 455                 }
 456
 457                 if (context && conn->sockets.sasl) {
 458                         TALLOC_FREE(context);
 459                         status = NT_STATUS_NOT_SUPPORTED;
 460                         result = LDAP_UNWILLING_TO_PERFORM;
 461                         errstr = talloc_asprintf(reply,
 462                                                  "SASL:[%s]: Sign or Seal are not allowed if SASL encryption has already been set up",
 463                                                  req->creds.SASL.mechanism);
 464                         goto do_reply;
 465                 }
 466
 467                 if (context) {
 468                         context->conn = conn;
 469                         status = gensec_create_tstream(context,
 470                                                        context->conn->gensec,
 471                                                        context->conn->sockets.raw,
 472                                                        &context->sasl);
 473                         if (NT_STATUS_IS_OK(status)) {
 474                                 if (!talloc_reference(context->sasl, conn->gensec)) {
 475                                         status = NT_STATUS_NO_MEMORY;
 476                                 }
 477                         }
 478                 } else {
 479                         switch (call->conn->require_strong_auth) {
 480                         case LDAP_SERVER_REQUIRE_STRONG_AUTH_NO:
 481                                 break;
 482                         case LDAP_SERVER_REQUIRE_STRONG_AUTH_ALLOW_SASL_OVER_TLS:
 483                                 if (call->conn->sockets.active == call->conn->sockets.tls) {
 484                                         break;
 485                                 }
 486                                 status = NT_STATUS_NETWORK_ACCESS_DENIED;
 487                                 result = LDAP_STRONG_AUTH_REQUIRED;
 488                                 errstr = talloc_asprintf(reply,
 489                                                 "SASL:[%s]: not allowed if TLS is used.",
 490                                                  req->creds.SASL.mechanism);
 491                                 goto do_reply;
 492
 493                         case LDAP_SERVER_REQUIRE_STRONG_AUTH_YES:
 494                                 status = NT_STATUS_NETWORK_ACCESS_DENIED;
 495                                 result = LDAP_STRONG_AUTH_REQUIRED;
 496                                 errstr = talloc_asprintf(reply,
 497                                                  "SASL:[%s]: Sign or Seal are required.",
 498                                                  req->creds.SASL.mechanism);
 499                                 goto do_reply;
 500                         }
 501                 }
 502
 503                 if (result != LDAP_SUCCESS) {
 504                 } else if (!NT_STATUS_IS_OK(status)) {
 505                         result = LDAP_OPERATIONS_ERROR;
 506                         errstr = talloc_asprintf(reply,
 507                                                  "SASL:[%s]: Failed to setup SASL socket: %s",
 508                                                  req->creds.SASL.mechanism, nt_errstr(status));
 509                         goto do_reply;
 510                 } else {
 511                         struct auth_session_info *old_session_info=NULL;
 512
 513                         old_session_info = conn->session_info;
 514                         conn->session_info = NULL;
 515                         status = gensec_session_info(conn->gensec, conn, &conn->session_info);
 516                         if (!NT_STATUS_IS_OK(status)) {
 517                                 conn->session_info = old_session_info;
 518                                 result = LDAP_OPERATIONS_ERROR;
 519                                 errstr = talloc_asprintf(reply,
 520                                                          "SASL:[%s]: Failed to get session info: %s",
 521                                                          req->creds.SASL.mechanism, nt_errstr(status));
 522                                 goto do_reply;
 523                         } else {
 524                                 talloc_unlink(conn, old_session_info);
 525
 526                                 /* don't leak the old LDB */
 527                                 talloc_unlink(conn, conn->ldb);
 528
 529                                 call->conn->authz_logged = true;
 530
 531                                 status = ldapsrv_backend_Init(conn);
 532
 533                                 if (!NT_STATUS_IS_OK(status)) {
 534                                         result = LDAP_OPERATIONS_ERROR;
 535                                         errstr = talloc_asprintf(reply,
 536                                                                  "SASL:[%s]: Failed to advise samdb of new credentials: %s",
 537                                                                  req->creds.SASL.mechanism,
 538                                                                  nt_errstr(status));
 539                                         goto do_reply;
 540                                 }
 541                         }
 542                 }
 543
 544                 if (NT_STATUS_IS_OK(status) && context) {
 545                         call->postprocess_send = ldapsrv_sasl_postprocess_send;
 546                         call->postprocess_recv = ldapsrv_sasl_postprocess_recv;
 547                         call->postprocess_private = context;
 548                 }
 549                 talloc_unlink(conn, conn->gensec);
 550                 conn->gensec = NULL;
 551         } else {
 552                 status = nt_status_squash(status);
 553                 if (result == 0) {
 554                         result = LDAP_INVALID_CREDENTIALS;
 555                         errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_LOGON_DENIED,
 556                                                         0x0C0904DC, status);
 557                 }
 558                 talloc_unlink(conn, conn->gensec);
 559                 conn->gensec = NULL;
 560                 goto do_reply;
 561         }
 562
 563 do_reply:
 564         resp->response.resultcode = result;
 565         resp->response.dn = NULL;
 566         resp->response.errormessage = errstr;
 567         resp->response.referral = NULL;
 568
 569         ldapsrv_queue_reply(call, reply);
 570         return NT_STATUS_OK;
 571 }
 572
 573 NTSTATUS ldapsrv_BindRequest(struct ldapsrv_call *call)
 574 {
 575         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 576         struct ldapsrv_reply *reply;
 577         struct ldap_BindResponse *resp;
 578
 579         if (call->conn->pending_calls != NULL) {
 580                 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 581                 if (!reply) {
 582                         return NT_STATUS_NO_MEMORY;
 583                 }
 584
 585                 resp = &reply->msg->r.BindResponse;
 586                 resp->response.resultcode = LDAP_BUSY;
 587                 resp->response.dn = NULL;
 588                 resp->response.errormessage = talloc_asprintf(reply, "Pending requests on this LDAP session");
 589                 resp->response.referral = NULL;
 590                 resp->SASL.secblob = NULL;
 591
 592                 ldapsrv_queue_reply(call, reply);
 593                 return NT_STATUS_OK;
 594         }
 595
 596         /*
 597          * TODO: a simple bind should cancel an
 598          *       inprogress SASL bind.
 599          *       (see RFC 4513)
 600          */
 601         switch (req->mechanism) {
 602                 case LDAP_AUTH_MECH_SIMPLE:
 603                         return ldapsrv_BindSimple(call);
 604                 case LDAP_AUTH_MECH_SASL:
 605                         return ldapsrv_BindSASL(call);
 606         }
 607
 608         reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 609         if (!reply) {
 610                 return NT_STATUS_NO_MEMORY;
 611         }
 612
 613         resp = &reply->msg->r.BindResponse;
 614         resp->response.resultcode = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 615         resp->response.dn = NULL;
 616         resp->response.errormessage = talloc_asprintf(reply, "Bad AuthenticationChoice [%d]", req->mechanism);
 617         resp->response.referral = NULL;
 618         resp->SASL.secblob = NULL;
 619
 620         ldapsrv_queue_reply(call, reply);
 621         return NT_STATUS_OK;
 622 }
 623
 624 struct ldapsrv_unbind_wait_context {
 625         uint8_t dummy;
 626 };
 627
 628 struct ldapsrv_unbind_wait_state {
 629         uint8_t dummy;
 630 };
 631
 632 static struct tevent_req *ldapsrv_unbind_wait_send(TALLOC_CTX *mem_ctx,
 633                                                  struct tevent_context *ev,
 634                                                  void *private_data)
 635 {
 636         struct ldapsrv_unbind_wait_context *unbind_wait =
 637                 talloc_get_type_abort(private_data,
 638                 struct ldapsrv_unbind_wait_context);
 639         struct tevent_req *req;
 640         struct ldapsrv_unbind_wait_state *state;
 641
 642         req = tevent_req_create(mem_ctx, &state,
 643                                 struct ldapsrv_unbind_wait_state);
 644         if (req == NULL) {
 645                 return NULL;
 646         }
 647
 648         (void)unbind_wait;
 649
 650         tevent_req_nterror(req, NT_STATUS_LOCAL_DISCONNECT);
 651         return tevent_req_post(req, ev);
 652 }
 653
 654 static NTSTATUS ldapsrv_unbind_wait_recv(struct tevent_req *req)
 655 {
 656         return tevent_req_simple_recv_ntstatus(req);
 657 }
 658
 659 static NTSTATUS ldapsrv_unbind_wait_setup(struct ldapsrv_call *call)
 660 {
 661         struct ldapsrv_unbind_wait_context *unbind_wait = NULL;
 662
 663         if (call->wait_private != NULL) {
 664                 return NT_STATUS_INTERNAL_ERROR;
 665         }
 666
 667         unbind_wait = talloc_zero(call, struct ldapsrv_unbind_wait_context);
 668         if (unbind_wait == NULL) {
 669                 return NT_STATUS_NO_MEMORY;
 670         }
 671
 672         call->wait_private = unbind_wait;
 673         call->wait_send = ldapsrv_unbind_wait_send;
 674         call->wait_recv = ldapsrv_unbind_wait_recv;
 675         return NT_STATUS_OK;
 676 }
 677
 678 NTSTATUS ldapsrv_UnbindRequest(struct ldapsrv_call *call)
 679 {
 680         struct ldapsrv_call *c = NULL;
 681         struct ldapsrv_call *n = NULL;
 682
 683         DEBUG(10, ("UnbindRequest\n"));
 684
 685         for (c = call->conn->pending_calls; c != NULL; c = n) {
 686                 n = c->next;
 687
 688                 DLIST_REMOVE(call->conn->pending_calls, c);
 689                 TALLOC_FREE(c);
 690         }
 691
 692         return ldapsrv_unbind_wait_setup(call);
 693 }