2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Tridgell 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 see RFC1798 for details of CLDAP
26 - carried over UDP on port 389
27 - request and response matched by message ID
28 - request consists of only a single searchRequest element
29 - response can be in one of two forms
30 - a single searchResponse, followed by a searchResult
31 - a single searchResult
35 #include "lib/events/events.h"
36 #include "lib/util/dlinklist.h"
37 #include "libcli/ldap/ldap.h"
38 #include "libcli/ldap/ldap_ndr.h"
39 #include "libcli/cldap/cldap.h"
40 #include "lib/socket/socket.h"
41 #include "libcli/security/security.h"
42 #include "librpc/gen_ndr/ndr_nbt.h"
43 #include "param/param.h"
46 destroy a pending request
48 static int cldap_request_destructor(struct cldap_request *req)
50 if (req->state == CLDAP_REQUEST_SEND) {
51 DLIST_REMOVE(req->cldap->send_queue, req);
53 if (!req->is_reply && req->message_id != 0) {
54 idr_remove(req->cldap->idr, req->message_id);
61 handle recv events on a cldap socket
63 static void cldap_socket_recv(struct cldap_socket *cldap)
65 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
67 struct socket_address *src;
70 struct asn1_data *asn1 = asn1_init(tmp_ctx);
71 struct ldap_message *ldap_msg;
72 struct cldap_request *req;
76 status = socket_pending(cldap->sock, &dsize);
77 if (!NT_STATUS_IS_OK(status)) {
82 blob = data_blob_talloc(tmp_ctx, NULL, dsize);
83 if (blob.data == NULL) {
88 status = socket_recvfrom(cldap->sock, blob.data, blob.length, &nread,
90 if (!NT_STATUS_IS_OK(status)) {
96 DEBUG(2,("Received cldap packet of length %d from %s:%d\n",
97 (int)blob.length, src->addr, src->port));
99 if (!asn1_load(asn1, blob)) {
100 DEBUG(2,("Failed to setup for asn.1 decode\n"));
101 talloc_free(tmp_ctx);
105 ldap_msg = talloc(tmp_ctx, struct ldap_message);
106 if (ldap_msg == NULL) {
107 talloc_free(tmp_ctx);
111 /* this initial decode is used to find the message id */
112 status = ldap_decode(asn1, ldap_msg);
113 if (!NT_STATUS_IS_OK(status)) {
114 DEBUG(2,("Failed to decode ldap message: %s\n", nt_errstr(status)));
115 talloc_free(tmp_ctx);
119 /* find the pending request */
120 req = idr_find(cldap->idr, ldap_msg->messageid);
122 if (cldap->incoming.handler) {
123 cldap->incoming.handler(cldap, ldap_msg, src);
125 DEBUG(2,("Mismatched cldap reply %u from %s:%d\n",
126 ldap_msg->messageid, src->addr, src->port));
128 talloc_free(tmp_ctx);
132 req->asn1 = talloc_steal(req, asn1);
135 req->state = CLDAP_REQUEST_DONE;
136 talloc_free(req->te);
138 talloc_free(tmp_ctx);
146 handle request timeouts
148 static void cldap_request_timeout(struct event_context *event_ctx,
149 struct timed_event *te, struct timeval t,
152 struct cldap_request *req = talloc_get_type(private, struct cldap_request);
154 /* possibly try again */
155 if (req->num_retries != 0) {
156 size_t len = req->encoded.length;
160 socket_sendto(req->cldap->sock, &req->encoded, &len,
163 req->te = event_add_timed(req->cldap->event_ctx, req,
164 timeval_current_ofs(req->timeout, 0),
165 cldap_request_timeout, req);
169 req->state = CLDAP_REQUEST_ERROR;
170 req->status = NT_STATUS_IO_TIMEOUT;
177 handle send events on a cldap socket
179 static void cldap_socket_send(struct cldap_socket *cldap)
181 struct cldap_request *req;
184 while ((req = cldap->send_queue)) {
187 len = req->encoded.length;
188 status = socket_sendto(cldap->sock, &req->encoded, &len,
190 if (NT_STATUS_IS_ERR(status)) {
191 DEBUG(0,("Failed to send cldap request of length %u to %s:%d\n",
192 (unsigned)req->encoded.length, req->dest->addr, req->dest->port));
193 DLIST_REMOVE(cldap->send_queue, req);
194 req->state = CLDAP_REQUEST_ERROR;
195 req->status = status;
202 if (!NT_STATUS_IS_OK(status)) return;
204 DLIST_REMOVE(cldap->send_queue, req);
209 req->state = CLDAP_REQUEST_WAIT;
211 req->te = event_add_timed(cldap->event_ctx, req,
212 timeval_current_ofs(req->timeout, 0),
213 cldap_request_timeout, req);
215 EVENT_FD_READABLE(cldap->fde);
219 EVENT_FD_NOT_WRITEABLE(cldap->fde);
225 handle fd events on a cldap_socket
227 static void cldap_socket_handler(struct event_context *ev, struct fd_event *fde,
228 uint16_t flags, void *private)
230 struct cldap_socket *cldap = talloc_get_type(private, struct cldap_socket);
231 if (flags & EVENT_FD_WRITE) {
232 cldap_socket_send(cldap);
234 if (flags & EVENT_FD_READ) {
235 cldap_socket_recv(cldap);
240 initialise a cldap_socket. The event_ctx is optional, if provided
241 then operations will use that event context
243 struct cldap_socket *cldap_socket_init(TALLOC_CTX *mem_ctx,
244 struct event_context *event_ctx)
246 struct cldap_socket *cldap;
249 cldap = talloc(mem_ctx, struct cldap_socket);
250 if (cldap == NULL) goto failed;
252 if (event_ctx == NULL) {
253 cldap->event_ctx = event_context_init(cldap);
255 cldap->event_ctx = talloc_reference(cldap, event_ctx);
257 if (cldap->event_ctx == NULL) goto failed;
259 cldap->idr = idr_init(cldap);
260 if (cldap->idr == NULL) goto failed;
262 status = socket_create("ip", SOCKET_TYPE_DGRAM, &cldap->sock, 0);
263 if (!NT_STATUS_IS_OK(status)) goto failed;
265 talloc_steal(cldap, cldap->sock);
267 cldap->fde = event_add_fd(cldap->event_ctx, cldap,
268 socket_get_fd(cldap->sock), 0,
269 cldap_socket_handler, cldap);
271 cldap->send_queue = NULL;
272 cldap->incoming.handler = NULL;
283 setup a handler for incoming requests
285 NTSTATUS cldap_set_incoming_handler(struct cldap_socket *cldap,
286 void (*handler)(struct cldap_socket *, struct ldap_message *,
287 struct socket_address *),
290 cldap->incoming.handler = handler;
291 cldap->incoming.private = private;
292 EVENT_FD_READABLE(cldap->fde);
297 queue a cldap request for send
299 struct cldap_request *cldap_search_send(struct cldap_socket *cldap,
300 struct cldap_search *io)
302 struct ldap_message *msg;
303 struct cldap_request *req;
304 struct ldap_SearchRequest *search;
306 req = talloc_zero(cldap, struct cldap_request);
307 if (req == NULL) goto failed;
310 req->state = CLDAP_REQUEST_SEND;
311 req->timeout = io->in.timeout;
312 req->num_retries = io->in.retries;
313 req->is_reply = false;
314 req->asn1 = asn1_init(req);
319 req->dest = socket_address_from_strings(req, cldap->sock->backend_name,
322 if (!req->dest) goto failed;
324 req->message_id = idr_get_new_random(cldap->idr, req, UINT16_MAX);
325 if (req->message_id == -1) goto failed;
327 talloc_set_destructor(req, cldap_request_destructor);
329 msg = talloc(req, struct ldap_message);
330 if (msg == NULL) goto failed;
331 msg->messageid = req->message_id;
332 msg->type = LDAP_TAG_SearchRequest;
333 msg->controls = NULL;
334 search = &msg->r.SearchRequest;
337 search->scope = LDAP_SEARCH_SCOPE_BASE;
338 search->deref = LDAP_DEREFERENCE_NEVER;
339 search->timelimit = 0;
340 search->sizelimit = 0;
341 search->attributesonly = false;
342 search->num_attributes = str_list_length(io->in.attributes);
343 search->attributes = io->in.attributes;
344 search->tree = ldb_parse_tree(req, io->in.filter);
345 if (search->tree == NULL) {
349 if (!ldap_encode(msg, &req->encoded, req)) {
350 DEBUG(0,("Failed to encode cldap message to %s:%d\n",
351 req->dest->addr, req->dest->port));
355 DLIST_ADD_END(cldap->send_queue, req, struct cldap_request *);
357 EVENT_FD_WRITEABLE(cldap->fde);
368 queue a cldap reply for send
370 NTSTATUS cldap_reply_send(struct cldap_socket *cldap, struct cldap_reply *io)
372 struct ldap_message *msg;
373 struct cldap_request *req;
374 DATA_BLOB blob1, blob2;
375 NTSTATUS status = NT_STATUS_NO_MEMORY;
377 req = talloc_zero(cldap, struct cldap_request);
378 if (req == NULL) goto failed;
381 req->state = CLDAP_REQUEST_SEND;
382 req->is_reply = true;
383 req->asn1 = asn1_init(req);
388 req->dest = io->dest;
389 if (talloc_reference(req, io->dest) == NULL) goto failed;
391 talloc_set_destructor(req, cldap_request_destructor);
393 msg = talloc(req, struct ldap_message);
394 if (msg == NULL) goto failed;
395 msg->messageid = io->messageid;
396 msg->controls = NULL;
399 msg->type = LDAP_TAG_SearchResultEntry;
400 msg->r.SearchResultEntry = *io->response;
402 if (!ldap_encode(msg, &blob1, req)) {
403 DEBUG(0,("Failed to encode cldap message to %s:%d\n",
404 req->dest->addr, req->dest->port));
405 status = NT_STATUS_INVALID_PARAMETER;
409 blob1 = data_blob(NULL, 0);
412 msg->type = LDAP_TAG_SearchResultDone;
413 msg->r.SearchResultDone = *io->result;
415 if (!ldap_encode(msg, &blob2, req)) {
416 DEBUG(0,("Failed to encode cldap message to %s:%d\n",
417 req->dest->addr, req->dest->port));
418 status = NT_STATUS_INVALID_PARAMETER;
422 req->encoded = data_blob_talloc(req, NULL, blob1.length + blob2.length);
423 if (req->encoded.data == NULL) goto failed;
425 memcpy(req->encoded.data, blob1.data, blob1.length);
426 memcpy(req->encoded.data+blob1.length, blob2.data, blob2.length);
428 DLIST_ADD_END(cldap->send_queue, req, struct cldap_request *);
430 EVENT_FD_WRITEABLE(cldap->fde);
440 receive a cldap reply
442 NTSTATUS cldap_search_recv(struct cldap_request *req,
444 struct cldap_search *io)
446 struct ldap_message *ldap_msg;
450 return NT_STATUS_NO_MEMORY;
453 while (req->state < CLDAP_REQUEST_DONE) {
454 if (event_loop_once(req->cldap->event_ctx) != 0) {
456 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
460 if (req->state == CLDAP_REQUEST_ERROR) {
461 status = req->status;
466 ldap_msg = talloc(mem_ctx, struct ldap_message);
467 NT_STATUS_HAVE_NO_MEMORY(ldap_msg);
469 status = ldap_decode(req->asn1, ldap_msg);
470 if (!NT_STATUS_IS_OK(status)) {
471 DEBUG(2,("Failed to decode cldap search reply: %s\n", nt_errstr(status)));
476 ZERO_STRUCT(io->out);
478 /* the first possible form has a search result in first place */
479 if (ldap_msg->type == LDAP_TAG_SearchResultEntry) {
480 io->out.response = talloc(mem_ctx, struct ldap_SearchResEntry);
481 NT_STATUS_HAVE_NO_MEMORY(io->out.response);
482 *io->out.response = ldap_msg->r.SearchResultEntry;
484 /* decode the 2nd part */
485 status = ldap_decode(req->asn1, ldap_msg);
486 if (!NT_STATUS_IS_OK(status)) {
487 DEBUG(2,("Failed to decode cldap search result entry: %s\n", nt_errstr(status)));
493 if (ldap_msg->type != LDAP_TAG_SearchResultDone) {
495 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
498 io->out.result = talloc(mem_ctx, struct ldap_Result);
499 NT_STATUS_HAVE_NO_MEMORY(io->out.result);
500 *io->out.result = ldap_msg->r.SearchResultDone;
504 if (io->out.result->resultcode != LDAP_SUCCESS) {
505 return NT_STATUS_LDAP(io->out.result->resultcode);
512 synchronous cldap search
514 NTSTATUS cldap_search(struct cldap_socket *cldap,
516 struct cldap_search *io)
518 struct cldap_request *req = cldap_search_send(cldap, io);
519 return cldap_search_recv(req, mem_ctx, io);
525 queue a cldap netlogon for send
527 struct cldap_request *cldap_netlogon_send(struct cldap_socket *cldap,
528 struct cldap_netlogon *io)
530 struct cldap_search search;
532 struct cldap_request *req;
533 const char *attr[] = { "NetLogon", NULL };
534 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
536 filter = talloc_asprintf(tmp_ctx, "(&(NtVer=%s)",
537 ldap_encode_ndr_uint32(tmp_ctx, io->in.version));
538 if (filter == NULL) goto failed;
540 filter = talloc_asprintf_append_buffer(filter, "(User=%s)", io->in.user);
541 if (filter == NULL) goto failed;
544 filter = talloc_asprintf_append_buffer(filter, "(Host=%s)", io->in.host);
545 if (filter == NULL) goto failed;
548 filter = talloc_asprintf_append_buffer(filter, "(DnsDomain=%s)", io->in.realm);
549 if (filter == NULL) goto failed;
551 if (io->in.acct_control != -1) {
552 filter = talloc_asprintf_append_buffer(filter, "(AAC=%s)",
553 ldap_encode_ndr_uint32(tmp_ctx, io->in.acct_control));
554 if (filter == NULL) goto failed;
556 if (io->in.domain_sid) {
557 struct dom_sid *sid = dom_sid_parse_talloc(tmp_ctx, io->in.domain_sid);
558 if (sid == NULL) goto failed;
559 filter = talloc_asprintf_append_buffer(filter, "(domainSid=%s)",
560 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
561 if (filter == NULL) goto failed;
563 if (io->in.domain_guid) {
566 status = GUID_from_string(io->in.domain_guid, &guid);
567 if (!NT_STATUS_IS_OK(status)) goto failed;
568 filter = talloc_asprintf_append_buffer(filter, "(DomainGuid=%s)",
569 ldap_encode_ndr_GUID(tmp_ctx, &guid));
570 if (filter == NULL) goto failed;
572 filter = talloc_asprintf_append_buffer(filter, ")");
573 if (filter == NULL) goto failed;
575 search.in.dest_address = io->in.dest_address;
576 search.in.dest_port = io->in.dest_port;
577 search.in.filter = filter;
578 search.in.attributes = attr;
579 search.in.timeout = 2;
580 search.in.retries = 2;
582 req = cldap_search_send(cldap, &search);
584 talloc_free(tmp_ctx);
587 talloc_free(tmp_ctx);
593 receive a cldap netlogon reply
595 NTSTATUS cldap_netlogon_recv(struct cldap_request *req,
597 struct cldap_netlogon *io)
600 enum ndr_err_code ndr_err;
601 struct cldap_search search;
604 status = cldap_search_recv(req, mem_ctx, &search);
605 if (!NT_STATUS_IS_OK(status)) {
608 if (search.out.response == NULL) {
609 return NT_STATUS_NOT_FOUND;
612 if (search.out.response->num_attributes != 1 ||
613 strcasecmp(search.out.response->attributes[0].name, "netlogon") != 0 ||
614 search.out.response->attributes[0].num_values != 1 ||
615 search.out.response->attributes[0].values->length < 2) {
616 return NT_STATUS_UNEXPECTED_NETWORK_ERROR;
618 data = search.out.response->attributes[0].values;
620 ndr_err = ndr_pull_union_blob_all(data, mem_ctx,
621 lp_iconv_convenience(global_loadparm),
623 io->in.version & 0xF,
624 (ndr_pull_flags_fn_t)ndr_pull_nbt_cldap_netlogon);
625 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
626 DEBUG(2,("cldap failed to parse netlogon response of type 0x%02x\n",
627 SVAL(data->data, 0)));
628 dump_data(10, data->data, data->length);
629 return ndr_map_error2ntstatus(ndr_err);
636 sync cldap netlogon search
638 NTSTATUS cldap_netlogon(struct cldap_socket *cldap,
639 TALLOC_CTX *mem_ctx, struct cldap_netlogon *io)
641 struct cldap_request *req = cldap_netlogon_send(cldap, io);
642 return cldap_netlogon_recv(req, mem_ctx, io);
647 send an empty reply (used on any error, so the client doesn't keep waiting
648 or send the bad request again)
650 NTSTATUS cldap_empty_reply(struct cldap_socket *cldap,
652 struct socket_address *src)
655 struct cldap_reply reply;
656 struct ldap_Result result;
658 reply.messageid = message_id;
660 reply.response = NULL;
661 reply.result = &result;
665 status = cldap_reply_send(cldap, &reply);
671 send an error reply (used on any error, so the client doesn't keep waiting
672 or send the bad request again)
674 NTSTATUS cldap_error_reply(struct cldap_socket *cldap,
676 struct socket_address *src,
678 const char *errormessage)
681 struct cldap_reply reply;
682 struct ldap_Result result;
684 reply.messageid = message_id;
686 reply.response = NULL;
687 reply.result = &result;
690 result.resultcode = resultcode;
691 result.errormessage = errormessage;
693 status = cldap_reply_send(cldap, &reply);
700 send a netlogon reply
702 NTSTATUS cldap_netlogon_reply(struct cldap_socket *cldap,
704 struct socket_address *src,
706 union nbt_cldap_netlogon *netlogon)
709 enum ndr_err_code ndr_err;
710 struct cldap_reply reply;
711 struct ldap_SearchResEntry response;
712 struct ldap_Result result;
713 TALLOC_CTX *tmp_ctx = talloc_new(cldap);
716 ndr_err = ndr_push_union_blob(&blob, tmp_ctx,
717 lp_iconv_convenience(global_loadparm),
718 netlogon, version & 0xF,
719 (ndr_push_flags_fn_t)ndr_push_nbt_cldap_netlogon);
720 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
721 talloc_free(tmp_ctx);
722 return ndr_map_error2ntstatus(ndr_err);
725 reply.messageid = message_id;
727 reply.response = &response;
728 reply.result = &result;
733 response.num_attributes = 1;
734 response.attributes = talloc(tmp_ctx, struct ldb_message_element);
735 NT_STATUS_HAVE_NO_MEMORY(response.attributes);
736 response.attributes->name = "netlogon";
737 response.attributes->num_values = 1;
738 response.attributes->values = &blob;
740 status = cldap_reply_send(cldap, &reply);
742 talloc_free(tmp_ctx);