#include "includes.h"
#include "lib/ldb/include/ldb.h"
+#include "lib/ldb/include/ldb_errors.h"
#include "lib/ldb/include/ldb_private.h"
#include "system/time.h"
#include "librpc/gen_ndr/ndr_security.h"
#define SAM_ACCOUNT_NAME_BASE "$000000-000000000000"
-struct private_data {
- const char *error_string;
-};
-
-static int samldb_search(struct ldb_module *module, const char *base,
- enum ldb_scope scope, const char *expression,
- const char * const *attrs, struct ldb_message ***res)
-{
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_search\n");
- return ldb_next_search(module, base, scope, expression, attrs, res);
-}
-
-static int samldb_search_bytree(struct ldb_module *module, const char *base,
- enum ldb_scope scope, struct ldb_parse_tree *tree,
- const char * const *attrs, struct ldb_message ***res)
-{
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_search\n");
- return ldb_next_search_bytree(module, base, scope, tree, attrs, res);
-}
-
/*
allocate a new id, attempting to do it atomically
return 0 on failure, the id on success
*/
static int samldb_allocate_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
- const char *dn, uint32_t *id)
+ const struct ldb_dn *dn, uint32_t *id)
{
const char * const attrs[2] = { "nextRid", NULL };
- struct ldb_message **res = NULL;
+ struct ldb_result *res = NULL;
struct ldb_message msg;
int ret;
const char *str;
struct ldb_message_element els[2];
ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, "nextRid=*", attrs, &res);
- if (ret != 1) {
+ if (ret != LDB_SUCCESS || res->count != 1) {
if (res) talloc_free(res);
return -1;
}
- str = ldb_msg_find_string(res[0], "nextRid", NULL);
+ str = ldb_msg_find_string(res->msgs[0], "nextRid", NULL);
if (str == NULL) {
- ldb_debug(ldb, LDB_DEBUG_FATAL, "attribute nextRid not found in %s\n", dn);
+ ldb_debug(ldb, LDB_DEBUG_FATAL, "attribute nextRid not found in %s\n", ldb_dn_linearize(res, dn));
talloc_free(res);
return -1;
}
/* we do a delete and add as a single operation. That prevents
a race */
ZERO_STRUCT(msg);
- msg.dn = talloc_strdup(mem_ctx, dn);
+ msg.dn = ldb_dn_copy(mem_ctx, dn);
if (!msg.dn) {
return -1;
}
els[1].flags = LDB_FLAG_MOD_ADD;
els[1].name = els[0].name;
- vals[0].data = talloc_asprintf(mem_ctx, "%u", *id);
+ vals[0].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", *id);
if (!vals[0].data) {
return -1;
}
- vals[0].length = strlen(vals[0].data);
+ vals[0].length = strlen((char *)vals[0].data);
- vals[1].data = talloc_asprintf(mem_ctx, "%u", (*id)+1);
+ vals[1].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", (*id)+1);
if (!vals[1].data) {
return -1;
}
- vals[1].length = strlen(vals[1].data);
+ vals[1].length = strlen((char *)vals[1].data);
ret = ldb_modify(ldb, &msg);
if (ret != 0) {
return 0;
}
-static char *samldb_search_domain(struct ldb_module *module, TALLOC_CTX *mem_ctx, const char *dn)
+static struct ldb_dn *samldb_search_domain(struct ldb_module *module, TALLOC_CTX *mem_ctx, const struct ldb_dn *dn)
{
- const char *sdn;
- struct ldb_message **res = NULL;
+ TALLOC_CTX *local_ctx;
+ struct ldb_dn *sdn;
+ struct ldb_result *res = NULL;
int ret = 0;
- sdn = dn;
- while ((sdn = strchr(sdn, ',')) != NULL) {
-
- sdn++;
+ local_ctx = talloc_new(mem_ctx);
+ if (local_ctx == NULL) return NULL;
+ sdn = ldb_dn_copy(local_ctx, dn);
+ do {
ret = ldb_search(module->ldb, sdn, LDB_SCOPE_BASE, "objectClass=domain", NULL, &res);
- talloc_free(res);
-
- if (ret == 1)
+ talloc_steal(local_ctx, res);
+ if (ret == LDB_SUCCESS && res->count == 1)
break;
- }
+ } while ((sdn = ldb_dn_get_parent(local_ctx, sdn)));
- if (ret != 1) {
+ if (ret != LDB_SUCCESS || res->count != 1) {
+ talloc_free(local_ctx);
return NULL;
}
- return talloc_strdup(mem_ctx, sdn);
+ talloc_steal(mem_ctx, sdn);
+ talloc_free(local_ctx);
+
+ return sdn;
}
/* search the domain related to the provided dn
return the new sid string
*/
static struct dom_sid *samldb_get_new_sid(struct ldb_module *module,
- TALLOC_CTX *mem_ctx, const char *obj_dn)
+ TALLOC_CTX *mem_ctx, const struct ldb_dn *obj_dn)
{
const char * const attrs[2] = { "objectSid", NULL };
- struct ldb_message **res = NULL;
- const char *dom_dn;
+ struct ldb_result *res = NULL;
+ const struct ldb_dn *dom_dn;
uint32_t rid;
- int ret, tries = 10;
+ int ret;
struct dom_sid *dom_sid, *obj_sid;
/* get the domain component part of the provided dn */
dom_dn = samldb_search_domain(module, mem_ctx, obj_dn);
if (dom_dn == NULL) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Invalid dn (%s) not child of a domain object!\n", obj_dn);
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Invalid dn (%s) not child of a domain object!\n", ldb_dn_linearize(mem_ctx, obj_dn));
return NULL;
}
/* find the domain sid */
ret = ldb_search(module->ldb, dom_dn, LDB_SCOPE_BASE, "objectSid=*", attrs, &res);
- if (ret != 1) {
+ if (ret != LDB_SUCCESS || res->count != 1) {
ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_get_new_sid: error retrieving domain sid!\n");
talloc_free(res);
return NULL;
}
- dom_sid = samdb_result_dom_sid(res, res[0], "objectSid");
+ dom_sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
if (dom_sid == NULL) {
ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_get_new_sid: error retrieving domain sid!\n");
talloc_free(res);
}
/* allocate a new Rid for the domain */
-
- /* we need to try multiple times to cope with two account
- creations at the same time */
- while (tries--) {
- ret = samldb_allocate_next_rid(module->ldb, mem_ctx, dom_dn, &rid);
- if (ret != 1) {
- break;
- }
- }
+ ret = samldb_allocate_next_rid(module->ldb, mem_ctx, dom_dn, &rid);
if (ret != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s\n", dom_dn);
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s\n", ldb_dn_linearize(mem_ctx, dom_dn));
talloc_free(res);
return NULL;
}
return name;
}
-static BOOL samldb_get_rdn_and_basedn(void *mem_ctx, const char *dn, struct ldb_dn_component **rdn, char **base_dn)
-{
- struct ldb_dn *dn_exploded = ldb_dn_explode(mem_ctx, dn);
- struct ldb_dn base_dn_exploded;
-
- if (!dn_exploded) {
- return False;
- }
-
- if (dn_exploded->comp_num < 1) {
- return False;
- }
-
- if (dn_exploded->comp_num < 2) {
- *base_dn = NULL;
- } else {
- base_dn_exploded.comp_num = dn_exploded->comp_num - 1;
- base_dn_exploded.components = &dn_exploded->components[1];
-
- *base_dn = ldb_dn_linearize(mem_ctx, &base_dn_exploded);
- }
-
- *rdn = &dn_exploded->components[0];
- return True;
-}
-
/* if value is not null also check for attribute to have exactly that value */
static struct ldb_message_element *samldb_find_attribute(const struct ldb_message *msg, const char *name, const char *value)
{
return &msg->elements[i];
}
for (j = 0; j < msg->elements[i].num_values; j++) {
- if (strcasecmp(value, msg->elements[i].values[j].data) == 0) {
+ if (strcasecmp(value,
+ (char *)msg->elements[i].values[j].data) == 0) {
return &msg->elements[i];
}
}
return False;
}
- if (ldb_msg_add_string(module->ldb, msg, aname, aval) != 0) {
+ if (ldb_msg_add_string(msg, aname, aval) != 0) {
return False;
}
if (!NT_STATUS_IS_OK(status)) {
return -1;
}
- return (ldb_msg_add_value(module->ldb, msg, name, &v) == 0);
+ return (ldb_msg_add_value(msg, name, &v) == 0);
}
static BOOL samldb_find_or_add_attribute(struct ldb_module *module, struct ldb_message *msg, const char *name, const char *value, const char *set_value)
static int samldb_copy_template(struct ldb_module *module, struct ldb_message *msg, const char *filter)
{
- struct ldb_message **res, *t;
+ struct ldb_result *res;
+ struct ldb_message *t;
int ret, i, j;
/* pull the template record */
ret = ldb_search(module->ldb, NULL, LDB_SCOPE_SUBTREE, filter, NULL, &res);
- if (ret != 1) {
- ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb: ERROR: template '%s' matched %d records\n", filter, ret);
+ if (ret != LDB_SUCCESS || res->count != 1) {
+ ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb: ERROR: template '%s' matched too many records\n", filter);
return -1;
}
- t = res[0];
+ t = res->msgs[0];
for (i = 0; i < t->num_elements; i++) {
struct ldb_message_element *el = &t->elements[i];
(strcasecmp((char *)el->values[j].data, "Template") == 0 ||
strcasecmp((char *)el->values[j].data, "userTemplate") == 0 ||
strcasecmp((char *)el->values[j].data, "groupTemplate") == 0 ||
- strcasecmp((char *)el->values[j].data, "foreignSecurityTemplate") == 0 ||
+ strcasecmp((char *)el->values[j].data, "foreignSecurityPrincipalTemplate") == 0 ||
strcasecmp((char *)el->values[j].data, "aliasTemplate") == 0 ||
strcasecmp((char *)el->values[j].data, "trustedDomainTemplate") == 0 ||
strcasecmp((char *)el->values[j].data, "secretTemplate") == 0)) {
struct ldb_message *msg2;
struct ldb_message_element *attribute;
struct ldb_dn_component *rdn;
- char *basedn;
if (samldb_find_attribute(msg, "objectclass", "group") == NULL) {
return NULL;
return NULL;
}
- if ( ! samldb_get_rdn_and_basedn(msg2, msg2->dn, &rdn, &basedn)) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad DN (%s)!\n", msg2->dn);
+ if ((rdn = ldb_dn_get_rdn(msg2, msg2->dn)) == NULL) {
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad DN (%s)!\n", ldb_dn_linearize(msg2, msg2->dn));
return NULL;
}
if (strcasecmp(rdn->name, "cn") != 0) {
return NULL;
}
- if ((attribute = samldb_find_attribute(msg2, "cn", NULL)) != NULL) {
- if (strcasecmp(rdn->value.data, attribute->values[0].data) != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad Attribute Syntax for CN\n");
- return NULL;
- }
- } else { /* FIXME: remove this if ldb supports natively aliasing between the rdn and the "cn" attribute */
- if ( ldb_msg_add_value(module->ldb, msg2, "cn", &rdn->value)) {
- return NULL;
- }
- }
-
if ((attribute = samldb_find_attribute(msg2, "objectSid", NULL)) == NULL ) {
struct dom_sid *sid = samldb_get_new_sid(module, msg2, msg2->dn);
if (sid == NULL) {
struct ldb_message *msg2;
struct ldb_message_element *attribute;
struct ldb_dn_component *rdn;
- char *basedn;
if ((samldb_find_attribute(msg, "objectclass", "user") == NULL) &&
(samldb_find_attribute(msg, "objectclass", "computer") == NULL)) {
}
if (samldb_find_attribute(msg, "objectclass", "computer") != NULL) {
- if (samldb_copy_template(module, msg2, "(&(CN=TemplateMemberServer)(objectclass=userTemplate))") != 0) {
+ if (samldb_copy_template(module, msg2, "(&(CN=TemplateServer)(objectclass=userTemplate))") != 0) {
ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_user_or_computer_object: Error copying computer template!\n");
return NULL;
}
}
}
- if ( ! samldb_get_rdn_and_basedn(msg2, msg2->dn, &rdn, &basedn)) {
+ if ((rdn = ldb_dn_get_rdn(msg2, msg2->dn)) == NULL) {
return NULL;
}
if (strcasecmp(rdn->name, "cn") != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: Bad RDN (%s) for group!\n", rdn->name);
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: Bad RDN (%s) for user/computer!\n", rdn->name);
return NULL;
}
return NULL;
}
- if ((attribute = samldb_find_attribute(msg2, "cn", NULL)) != NULL) {
- if (strcasecmp(rdn->value.data, attribute->values[0].data) != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad Attribute Syntax for CN\n");
- return NULL;
- }
- } else { /* FIXME: remove this if ldb supports natively aliasing between the rdn and the "cn" attribute */
- if ( ldb_msg_add_value(module->ldb, msg2, "cn", &rdn->value)) {
- return NULL;
- }
- }
-
if ((attribute = samldb_find_attribute(msg2, "objectSid", NULL)) == NULL ) {
struct dom_sid *sid;
sid = samldb_get_new_sid(module, msg2, msg2->dn);
return NULL;
}
+ /*
+ useraccountcontrol: setting value 0 gives 0x200 for users
+ */
+
/* TODO: objectCategory, userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
return msg2;
}
+static struct ldb_message *samldb_fill_foreignSecurityPrincipal_object(struct ldb_module *module, const struct ldb_message *msg)
+{
+ struct ldb_message *msg2;
+ struct ldb_message_element *attribute;
+ struct ldb_dn_component *rdn;
+
+ if (samldb_find_attribute(msg, "objectclass", "foreignSecurityPrincipal") == NULL) {
+ return NULL;
+ }
+
+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_fill_foreignSecurityPrincipal_object\n");
+
+ /* build the new msg */
+ msg2 = ldb_msg_copy(module->ldb, msg);
+ if (!msg2) {
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincpal_object: ldb_msg_copy failed!\n");
+ return NULL;
+ }
+
+ talloc_steal(msg, msg2);
+
+ if (samldb_copy_template(module, msg2, "(&(CN=TemplateForeignSecurityPrincipal)(objectclass=foreignSecurityPrincipalTemplate))") != 0) {
+ ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_foreignSecurityPrincipal_object: Error copying template!\n");
+ return NULL;
+ }
+
+ if ((rdn = ldb_dn_get_rdn(msg2, msg2->dn)) == NULL) {
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: Bad DN (%s)!\n", ldb_dn_linearize(msg2, msg2->dn));
+ return NULL;
+ }
+ if (strcasecmp(rdn->name, "cn") != 0) {
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: Bad RDN (%s) for foreignSecurityPrincpal!\n", rdn->name);
+ return NULL;
+ }
+
+ if ((attribute = samldb_find_attribute(msg2, "objectSid", NULL)) == NULL ) {
+ struct dom_sid *sid = dom_sid_parse_talloc(msg2, (char *)rdn->value.data);
+ if (sid == NULL) {
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: internal error! Can't parse sid in CN\n");
+ return NULL;
+ }
+
+ if (!samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
+ talloc_free(sid);
+ return NULL;
+ }
+ talloc_free(sid);
+ }
+
+ return msg2;
+}
+
/* add_record */
-static int samldb_add_record(struct ldb_module *module, const struct ldb_message *msg)
+static int samldb_add(struct ldb_module *module, struct ldb_request *req)
{
+ const struct ldb_message *msg = req->op.add.message;
struct ldb_message *msg2 = NULL;
int ret;
ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_add_record\n");
- if (msg->dn[0] == '@') { /* do not manipulate our control entries */
- return ldb_next_add_record(module, msg);
+
+ if (ldb_dn_is_special(msg->dn)) { /* do not manipulate our control entries */
+ return ldb_next_request(module, req);
}
/* is user or computer? add all relevant missing objects */
msg2 = samldb_fill_group_object(module, msg);
}
+ /* perhaps a foreignSecurityPrincipal? */
+ if ( ! msg2 ) {
+ msg2 = samldb_fill_foreignSecurityPrincipal_object(module, msg);
+ }
+
if (msg2) {
- ret = ldb_next_add_record(module, msg2);
+ req->op.add.message = msg2;
+ ret = ldb_next_request(module, req);
+ req->op.add.message = msg;
} else {
- ret = ldb_next_add_record(module, msg);
+ ret = ldb_next_request(module, req);
}
return ret;
}
-/* modify_record: change modifyTimestamp as well */
-static int samldb_modify_record(struct ldb_module *module, const struct ldb_message *msg)
-{
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_modify_record\n");
- return ldb_next_modify_record(module, msg);
-}
-
-static int samldb_delete_record(struct ldb_module *module, const char *dn)
-{
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_delete_record\n");
- return ldb_next_delete_record(module, dn);
-}
-
-static int samldb_rename_record(struct ldb_module *module, const char *olddn, const char *newdn)
-{
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_rename_record\n");
- return ldb_next_rename_record(module, olddn, newdn);
-}
-
-static int samldb_lock(struct ldb_module *module, const char *lockname)
+static int samldb_destructor(void *module_ctx)
{
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_lock\n");
- return ldb_next_named_lock(module, lockname);
+ /* struct ldb_module *ctx = module_ctx; */
+ /* put your clean-up functions here */
+ return 0;
}
-static int samldb_unlock(struct ldb_module *module, const char *lockname)
+static int samldb_request(struct ldb_module *module, struct ldb_request *req)
{
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_unlock\n");
- return ldb_next_named_unlock(module, lockname);
-}
+ switch (req->operation) {
-/* return extended error information */
-static const char *samldb_errstring(struct ldb_module *module)
-{
- struct private_data *data = (struct private_data *)module->private_data;
+ case LDB_REQ_ADD:
+ return samldb_add(module, req);
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_errstring\n");
- if (data->error_string) {
- const char *error;
+ default:
+ return ldb_next_request(module, req);
- error = data->error_string;
- data->error_string = NULL;
- return error;
}
-
- return ldb_next_errstring(module);
-}
-
-static int samldb_destructor(void *module_ctx)
-{
- /* struct ldb_module *ctx = module_ctx; */
- /* put your clean-up functions here */
- return 0;
}
static const struct ldb_module_ops samldb_ops = {
.name = "samldb",
- .search = samldb_search,
- .search_bytree = samldb_search_bytree,
- .add_record = samldb_add_record,
- .modify_record = samldb_modify_record,
- .delete_record = samldb_delete_record,
- .rename_record = samldb_rename_record,
- .named_lock = samldb_lock,
- .named_unlock = samldb_unlock,
- .errstring = samldb_errstring
+ .request = samldb_request
};
#endif
{
struct ldb_module *ctx;
- struct private_data *data;
ctx = talloc(ldb, struct ldb_module);
if (!ctx)
return NULL;
- data = talloc(ctx, struct private_data);
- if (!data) {
- talloc_free(ctx);
- return NULL;
- }
-
- data->error_string = NULL;
- ctx->private_data = data;
+ ctx->private_data = NULL;
ctx->ldb = ldb;
ctx->prev = ctx->next = NULL;
ctx->ops = &samldb_ops;
git.samba.org / samba.git / blobdiff