a6753d46fa737cdc9407cecf67da5d1139430814
[samba.git] / source4 / ldap_server / ldap_server.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    LDAP server
5
6    Copyright (C) Andrew Tridgell 2005
7    Copyright (C) Volker Lendecke 2004
8    Copyright (C) Stefan Metzmacher 2004
9    
10    This program is free software; you can redistribute it and/or modify
11    it under the terms of the GNU General Public License as published by
12    the Free Software Foundation; either version 3 of the License, or
13    (at your option) any later version.
14    
15    This program is distributed in the hope that it will be useful,
16    but WITHOUT ANY WARRANTY; without even the implied warranty of
17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18    GNU General Public License for more details.
19    
20    You should have received a copy of the GNU General Public License
21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "lib/events/events.h"
26 #include "auth/auth.h"
27 #include "auth/credentials/credentials.h"
28 #include "librpc/gen_ndr/ndr_samr.h"
29 #include "lib/util/dlinklist.h"
30 #include "libcli/util/asn_1.h"
31 #include "ldap_server/ldap_server.h"
32 #include "smbd/service_task.h"
33 #include "smbd/service_stream.h"
34 #include "smbd/service.h"
35 #include "smbd/process_model.h"
36 #include "lib/tls/tls.h"
37 #include "lib/messaging/irpc.h"
38 #include "lib/ldb/include/ldb.h"
39 #include "lib/ldb/include/ldb_errors.h"
40 #include "system/network.h"
41 #include "lib/socket/netif.h"
42 #include "dsdb/samdb/samdb.h"
43 #include "param/param.h"
44 /*
45   close the socket and shutdown a server_context
46 */
47 void ldapsrv_terminate_connection(struct ldapsrv_connection *conn, 
48                                          const char *reason)
49 {
50         stream_terminate_connection(conn->connection, reason);
51 }
52
53 /*
54   handle packet errors
55 */
56 static void ldapsrv_error_handler(void *private, NTSTATUS status)
57 {
58         struct ldapsrv_connection *conn = talloc_get_type(private, 
59                                                           struct ldapsrv_connection);
60         ldapsrv_terminate_connection(conn, nt_errstr(status));
61 }
62
63 /*
64   process a decoded ldap message
65 */
66 static void ldapsrv_process_message(struct ldapsrv_connection *conn,
67                                     struct ldap_message *msg)
68 {
69         struct ldapsrv_call *call;
70         NTSTATUS status;
71         DATA_BLOB blob;
72
73         call = talloc(conn, struct ldapsrv_call);
74         if (!call) {
75                 ldapsrv_terminate_connection(conn, "no memory");
76                 return;         
77         }
78         
79         call->request = talloc_steal(call, msg);
80         call->conn = conn;
81         call->replies = NULL;
82         call->send_callback = NULL;
83         call->send_private = NULL;
84         
85         /* make the call */
86         status = ldapsrv_do_call(call);
87         if (!NT_STATUS_IS_OK(status)) {
88                 talloc_free(call);
89                 return;
90         }
91         
92         blob = data_blob(NULL, 0);
93
94         if (call->replies == NULL) {
95                 talloc_free(call);
96                 return;
97         }
98
99         /* build all the replies into a single blob */
100         while (call->replies) {
101                 DATA_BLOB b;
102                 bool ret;
103
104                 msg = call->replies->msg;
105                 if (!ldap_encode(msg, &b, call)) {
106                         DEBUG(0,("Failed to encode ldap reply of type %d\n", msg->type));
107                         talloc_free(call);
108                         return;
109                 }
110
111                 ret = data_blob_append(call, &blob, b.data, b.length);
112                 data_blob_free(&b);
113
114                 talloc_set_name_const(blob.data, "Outgoing, encoded LDAP packet");
115
116                 if (!ret) {
117                         talloc_free(call);
118                         return;
119                 }
120
121                 DLIST_REMOVE(call->replies, call->replies);
122         }
123
124         packet_send_callback(conn->packet, blob, 
125                              call->send_callback, call->send_private);
126         talloc_free(call);
127         return;
128 }
129
130 /*
131   decode/process data
132 */
133 static NTSTATUS ldapsrv_decode(void *private, DATA_BLOB blob)
134 {
135         NTSTATUS status;
136         struct ldapsrv_connection *conn = talloc_get_type(private, 
137                                                           struct ldapsrv_connection);
138         struct asn1_data *asn1 = asn1_init(conn);
139         struct ldap_message *msg = talloc(conn, struct ldap_message);
140
141         if (asn1 == NULL || msg == NULL) {
142                 return NT_STATUS_NO_MEMORY;
143         }
144
145         if (!asn1_load(asn1, blob)) {
146                 talloc_free(msg);
147                 talloc_free(asn1);
148                 return NT_STATUS_NO_MEMORY;
149         }
150
151         status = ldap_decode(asn1, msg);
152         if (!NT_STATUS_IS_OK(status)) {
153                 asn1_free(asn1);
154                 return status;
155         }
156
157         data_blob_free(&blob);
158         ldapsrv_process_message(conn, msg);
159         asn1_free(asn1);
160         return NT_STATUS_OK;
161 }
162
163 /*
164  Idle timeout handler
165 */
166 static void ldapsrv_conn_idle_timeout(struct event_context *ev,
167                                       struct timed_event *te,
168                                       struct timeval t,
169                                       void *private)
170 {
171         struct ldapsrv_connection *conn = talloc_get_type(private, struct ldapsrv_connection);
172
173         ldapsrv_terminate_connection(conn, "Timeout. No requests after bind");
174 }
175
176 /*
177   called when a LDAP socket becomes readable
178 */
179 void ldapsrv_recv(struct stream_connection *c, uint16_t flags)
180 {
181         struct ldapsrv_connection *conn = 
182                 talloc_get_type(c->private, struct ldapsrv_connection);
183
184         if (conn->limits.ite) { /* clean initial timeout if any */
185                 talloc_free(conn->limits.ite);
186                 conn->limits.ite = NULL;
187         }
188
189         if (conn->limits.te) { /* clean idle timeout if any */
190                 talloc_free(conn->limits.te);
191                 conn->limits.te = NULL;
192         }
193
194         packet_recv(conn->packet);
195
196         /* set idle timeout */
197         conn->limits.te = event_add_timed(c->event.ctx, conn, 
198                                            timeval_current_ofs(conn->limits.conn_idle_time, 0),
199                                            ldapsrv_conn_idle_timeout, conn);
200 }
201
202 /*
203   called when a LDAP socket becomes writable
204 */
205 static void ldapsrv_send(struct stream_connection *c, uint16_t flags)
206 {
207         struct ldapsrv_connection *conn = 
208                 talloc_get_type(c->private, struct ldapsrv_connection);
209         
210         packet_queue_run(conn->packet);
211 }
212
213 static void ldapsrv_conn_init_timeout(struct event_context *ev,
214                                       struct timed_event *te,
215                                       struct timeval t,
216                                       void *private)
217 {
218         struct ldapsrv_connection *conn = talloc_get_type(private, struct ldapsrv_connection);
219
220         ldapsrv_terminate_connection(conn, "Timeout. No requests after initial connection");
221 }
222
223 static int ldapsrv_load_limits(struct ldapsrv_connection *conn)
224 {
225         TALLOC_CTX *tmp_ctx;
226         const char *attrs[] = { "configurationNamingContext", NULL };
227         const char *attrs2[] = { "lDAPAdminLimits", NULL };
228         struct ldb_message_element *el;
229         struct ldb_result *res = NULL;
230         struct ldb_dn *basedn;
231         struct ldb_dn *conf_dn;
232         struct ldb_dn *policy_dn;
233         int i,ret;
234
235         /* set defaults limits in case of failure */
236         conn->limits.initial_timeout = 120;
237         conn->limits.conn_idle_time = 900;
238         conn->limits.max_page_size = 1000;
239         conn->limits.search_timeout = 120;
240
241
242         tmp_ctx = talloc_new(conn);
243         if (tmp_ctx == NULL) {
244                 return -1;
245         }
246
247         basedn = ldb_dn_new(tmp_ctx, conn->ldb, NULL);
248         if ( ! ldb_dn_validate(basedn)) {
249                 goto failed;
250         }
251
252         ret = ldb_search(conn->ldb, basedn, LDB_SCOPE_BASE, NULL, attrs, &res);
253         if (ret != LDB_SUCCESS) {
254                 goto failed;
255         }
256
257         talloc_steal(tmp_ctx, res);
258
259         if (res->count != 1) {
260                 goto failed;
261         }
262
263         conf_dn = ldb_msg_find_attr_as_dn(conn->ldb, tmp_ctx, res->msgs[0], "configurationNamingContext");
264         if (conf_dn == NULL) {
265                 goto failed;
266         }
267
268         policy_dn = ldb_dn_copy(tmp_ctx, conf_dn);
269         ldb_dn_add_child_fmt(policy_dn, "CN=Default Query Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services");
270         if (policy_dn == NULL) {
271                 goto failed;
272         }
273
274         ret = ldb_search(conn->ldb, policy_dn, LDB_SCOPE_BASE, NULL, attrs2, &res);
275         if (ret != LDB_SUCCESS) {
276                 goto failed;
277         }
278
279         talloc_steal(tmp_ctx, res);
280
281         if (res->count != 1) {
282                 goto failed;
283         }
284
285         el = ldb_msg_find_element(res->msgs[0], "lDAPAdminLimits");
286         if (el == NULL) {
287                 goto failed;
288         }
289
290         for (i = 0; i < el->num_values; i++) {
291                 char policy_name[256];
292                 int policy_value, s;
293
294                 s = sscanf((const char *)el->values[i].data, "%255[^=]=%d", policy_name, &policy_value);
295                 if (ret != 2 || policy_value == 0)
296                         continue;
297                 
298                 if (strcasecmp("InitRecvTimeout", policy_name) == 0) {
299                         conn->limits.initial_timeout = policy_value;
300                         continue;
301                 }
302                 if (strcasecmp("MaxConnIdleTime", policy_name) == 0) {
303                         conn->limits.conn_idle_time = policy_value;
304                         continue;
305                 }
306                 if (strcasecmp("MaxPageSize", policy_name) == 0) {
307                         conn->limits.max_page_size = policy_value;
308                         continue;
309                 }
310                 if (strcasecmp("MaxQueryDuration", policy_name) == 0) {
311                         conn->limits.search_timeout = policy_value;
312                         continue;
313                 }
314         }
315
316         return 0;
317
318 failed:
319         DEBUG(0, ("Failed to load ldap server query policies\n"));
320         talloc_free(tmp_ctx);
321         return -1;
322 }
323
324 /*
325   initialise a server_context from a open socket and register a event handler
326   for reading from that socket
327 */
328 static void ldapsrv_accept(struct stream_connection *c)
329 {
330         struct ldapsrv_service *ldapsrv_service = 
331                 talloc_get_type(c->private, struct ldapsrv_service);
332         struct ldapsrv_connection *conn;
333         struct cli_credentials *server_credentials;
334         struct socket_address *socket_address;
335         NTSTATUS status;
336         int port;
337
338         conn = talloc_zero(c, struct ldapsrv_connection);
339         if (!conn) {
340                 stream_terminate_connection(c, "ldapsrv_accept: out of memory");
341                 return;
342         }
343
344         conn->packet      = NULL;
345         conn->connection  = c;
346         conn->service     = ldapsrv_service;
347         conn->sockets.raw = c->socket;
348
349         c->private        = conn;
350
351         socket_address = socket_get_my_addr(c->socket, conn);
352         if (!socket_address) {
353                 ldapsrv_terminate_connection(conn, "ldapsrv_accept: failed to obtain local socket address!");
354                 return;
355         }
356         port = socket_address->port;
357         talloc_free(socket_address);
358
359         if (port == 636) {
360                 struct socket_context *tls_socket = tls_init_server(ldapsrv_service->tls_params, c->socket, 
361                                                                     c->event.fde, NULL);
362                 if (!tls_socket) {
363                         ldapsrv_terminate_connection(conn, "ldapsrv_accept: tls_init_server() failed");
364                         return;
365                 }
366                 talloc_unlink(c, c->socket);
367                 talloc_steal(c, tls_socket);
368                 c->socket = tls_socket;
369                 conn->sockets.tls = tls_socket;
370
371         } else if (port == 3268) /* Global catalog */ {
372                 conn->global_catalog = True;
373         }
374         conn->packet = packet_init(conn);
375         if (conn->packet == NULL) {
376                 ldapsrv_terminate_connection(conn, "out of memory");
377                 return;
378         }
379
380         packet_set_private(conn->packet, conn);
381         packet_set_socket(conn->packet, c->socket);
382         packet_set_callback(conn->packet, ldapsrv_decode);
383         packet_set_full_request(conn->packet, ldap_full_packet);
384         packet_set_error_handler(conn->packet, ldapsrv_error_handler);
385         packet_set_event_context(conn->packet, c->event.ctx);
386         packet_set_fde(conn->packet, c->event.fde);
387         packet_set_serialise(conn->packet);
388         
389         /* Ensure we don't get packets until the database is ready below */
390         packet_recv_disable(conn->packet);
391
392         server_credentials 
393                 = cli_credentials_init(conn);
394         if (!server_credentials) {
395                 stream_terminate_connection(c, "Failed to init server credentials\n");
396                 return;
397         }
398         
399         cli_credentials_set_conf(server_credentials);
400         status = cli_credentials_set_machine_account(server_credentials);
401         if (!NT_STATUS_IS_OK(status)) {
402                 stream_terminate_connection(c, talloc_asprintf(conn, "Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(status)));
403                 return;
404         }
405         conn->server_credentials = server_credentials;
406
407         /* Connections start out anonymous */
408         if (!NT_STATUS_IS_OK(auth_anonymous_session_info(conn, &conn->session_info))) {
409                 ldapsrv_terminate_connection(conn, "failed to setup anonymous session info");
410                 return;
411         }
412
413         if (!NT_STATUS_IS_OK(ldapsrv_backend_Init(conn))) {
414                 ldapsrv_terminate_connection(conn, "backend Init failed");
415                 return;
416         }
417
418         /* load limits from the conf partition */
419         ldapsrv_load_limits(conn); /* should we fail on error ? */
420
421         /* register the server */       
422         irpc_add_name(c->msg_ctx, "ldap_server");
423
424         /* set connections limits */
425         conn->limits.ite = event_add_timed(c->event.ctx, conn, 
426                                            timeval_current_ofs(conn->limits.initial_timeout, 0),
427                                            ldapsrv_conn_init_timeout, conn);
428
429         packet_recv_enable(conn->packet);
430
431 }
432
433 static const struct stream_server_ops ldap_stream_ops = {
434         .name                   = "ldap",
435         .accept_connection      = ldapsrv_accept,
436         .recv_handler           = ldapsrv_recv,
437         .send_handler           = ldapsrv_send,
438 };
439
440 /*
441   add a socket address to the list of events, one event per port
442 */
443 static NTSTATUS add_socket(struct event_context *event_context,
444                            const struct model_ops *model_ops,
445                            const char *address, struct ldapsrv_service *ldap_service)
446 {
447         uint16_t port = 389;
448         NTSTATUS status;
449         const char *attrs[] = { "options", NULL };
450         int ret;
451         struct ldb_result *res;
452         struct ldb_context *ldb;
453         int options;
454
455         status = stream_setup_socket(event_context, model_ops, &ldap_stream_ops, 
456                                      "ipv4", address, &port, ldap_service);
457         if (!NT_STATUS_IS_OK(status)) {
458                 DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
459                          address, port, nt_errstr(status)));
460         }
461
462         if (tls_support(ldap_service->tls_params)) {
463                 /* add ldaps server */
464                 port = 636;
465                 status = stream_setup_socket(event_context, model_ops, &ldap_stream_ops, 
466                                              "ipv4", address, &port, ldap_service);
467                 if (!NT_STATUS_IS_OK(status)) {
468                         DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
469                                  address, port, nt_errstr(status)));
470                 }
471         }
472
473         /* Load LDAP database */
474         ldb = samdb_connect(ldap_service, system_session(ldap_service));
475         if (!ldb) {
476                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
477         }
478         
479         /* Query cn=ntds settings,.... */
480         ret = ldb_search(ldb, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, NULL, attrs, &res);
481         if (ret) {
482                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
483         }
484         if (res->count != 1) {
485                 talloc_free(res);
486                 return NT_STATUS_NOT_FOUND;
487         }
488
489         options = ldb_msg_find_attr_as_int(res->msgs[0], "options", 0);
490         talloc_free(res);
491         talloc_free(ldb);
492
493         /* if options attribute has the 0x00000001 flag set, then enable the global catlog */
494         if (options & 0x000000001) {
495                 port = 3268;
496                 status = stream_setup_socket(event_context, model_ops, &ldap_stream_ops, 
497                                              "ipv4", address, &port, ldap_service);
498                 if (!NT_STATUS_IS_OK(status)) {
499                         DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
500                                  address, port, nt_errstr(status)));
501                 }
502         }
503
504         return status;
505 }
506
507 /*
508   open the ldap server sockets
509 */
510 static void ldapsrv_task_init(struct task_server *task)
511 {       
512         struct ldapsrv_service *ldap_service;
513         NTSTATUS status;
514         const struct model_ops *model_ops;
515
516         task_server_set_title(task, "task[ldapsrv]");
517
518         /* run the ldap server as a single process */
519         model_ops = process_model_byname("single");
520         if (!model_ops) goto failed;
521
522         ldap_service = talloc_zero(task, struct ldapsrv_service);
523         if (ldap_service == NULL) goto failed;
524
525         ldap_service->tls_params = tls_initialise(ldap_service);
526         if (ldap_service->tls_params == NULL) goto failed;
527
528         if (lp_interfaces() && lp_bind_interfaces_only()) {
529                 int num_interfaces = iface_count();
530                 int i;
531
532                 /* We have been given an interfaces line, and been 
533                    told to only bind to those interfaces. Create a
534                    socket per interface and bind to only these.
535                 */
536                 for(i = 0; i < num_interfaces; i++) {
537                         const char *address = iface_n_ip(i);
538                         status = add_socket(task->event_ctx, model_ops, address, ldap_service);
539                         if (!NT_STATUS_IS_OK(status)) goto failed;
540                 }
541         } else {
542                 status = add_socket(task->event_ctx, model_ops, 
543                                     lp_socket_address(), ldap_service);
544                 if (!NT_STATUS_IS_OK(status)) goto failed;
545         }
546
547         return;
548
549 failed:
550         task_server_terminate(task, "Failed to startup ldap server task");      
551 }
552
553 /*
554   called on startup of the web server service It's job is to start
555   listening on all configured sockets
556 */
557 static NTSTATUS ldapsrv_init(struct event_context *event_context, 
558                              const struct model_ops *model_ops)
559 {       
560         return task_server_startup(event_context, model_ops, ldapsrv_task_init);
561 }
562
563
564 NTSTATUS server_service_ldap_init(void)
565 {
566         return register_server_service("ldap", ldapsrv_init);
567 }