return ac;
}
-static int get_search_callback(struct ldb_request *req, struct ldb_reply *ares)
-{
- struct ldb_context *ldb;
- struct descriptor_context *ac;
- int ret;
-
- ac = talloc_get_type(req->context, struct descriptor_context);
- ldb = ldb_module_get_ctx(ac->module);
-
- if (!ares) {
- return ldb_module_done(ac->req, NULL, NULL,
- LDB_ERR_OPERATIONS_ERROR);
- }
- if (ares->error != LDB_SUCCESS &&
- ares->error != LDB_ERR_NO_SUCH_OBJECT) {
- return ldb_module_done(ac->req, ares->controls,
- ares->response, ares->error);
- }
-
- ldb_reset_err_string(ldb);
-
- switch (ares->type) {
- case LDB_REPLY_ENTRY:
- if (ac->search_res != NULL) {
- ldb_set_errstring(ldb, "Too many results");
- talloc_free(ares);
- return ldb_module_done(ac->req, NULL, NULL,
- LDB_ERR_OPERATIONS_ERROR);
- }
-
- ac->search_res = talloc_steal(ac, ares);
- break;
-
- case LDB_REPLY_REFERRAL:
- /* ignore */
- talloc_free(ares);
- break;
-
- case LDB_REPLY_DONE:
- talloc_free(ares);
- ret = ac->step_fn(ac);
- if (ret != LDB_SUCCESS) {
- return ldb_module_done(ac->req, NULL, NULL, ret);
- }
- break;
- }
-
- return LDB_SUCCESS;
-}
-
-static int get_search_oc_callback(struct ldb_request *req, struct ldb_reply *ares)
-{
- struct ldb_context *ldb;
- struct descriptor_context *ac;
- int ret;
-
- ac = talloc_get_type(req->context, struct descriptor_context);
- ldb = ldb_module_get_ctx(ac->module);
-
- if (!ares) {
- return ldb_module_done(ac->req, NULL, NULL,
- LDB_ERR_OPERATIONS_ERROR);
- }
- if (ares->error != LDB_SUCCESS &&
- ares->error != LDB_ERR_NO_SUCH_OBJECT) {
- return ldb_module_done(ac->req, ares->controls,
- ares->response, ares->error);
- }
-
- ldb_reset_err_string(ldb);
-
- switch (ares->type) {
- case LDB_REPLY_ENTRY:
- if (ac->search_oc_res != NULL) {
- ldb_set_errstring(ldb, "Too many results");
- talloc_free(ares);
- return ldb_module_done(ac->req, NULL, NULL,
- LDB_ERR_OPERATIONS_ERROR);
- }
-
- ac->search_oc_res = talloc_steal(ac, ares);
- break;
-
- case LDB_REPLY_REFERRAL:
- /* ignore */
- talloc_free(ares);
- break;
-
- case LDB_REPLY_DONE:
- talloc_free(ares);
- ret = ac->step_fn(ac);
- if (ret != LDB_SUCCESS) {
- return ldb_module_done(ac->req, NULL, NULL, ret);
- }
- break;
- }
-
- return LDB_SUCCESS;
-}
-
static int descriptor_search_callback(struct ldb_request *req, struct ldb_reply *ares)
{
struct descriptor_context *ac;
return ldb_module_done(ac->req, NULL, NULL, ret);
}
-static int descriptor_do_mod(struct descriptor_context *ac)
-{
- struct ldb_context *ldb;
- const struct dsdb_schema *schema;
- struct ldb_request *mod_req;
- struct ldb_message_element *objectclass_element, *oldsd_el;
- struct ldb_val *oldsd_val = NULL;
- int ret;
- DATA_BLOB *sd;
- const struct dsdb_class *objectclass;
- struct ldb_control *sd_control;
- struct ldb_control *sd_control2;
- uint32_t sd_flags = 0;
-
- ldb = ldb_module_get_ctx(ac->module);
- schema = dsdb_get_schema(ldb, ac);
-
- objectclass_element = ldb_msg_find_element(ac->search_oc_res->message,
- "objectClass");
- if (objectclass_element == NULL) {
- return ldb_operr(ldb);
- }
-
- objectclass = get_last_structural_class(schema, objectclass_element, ac->req);
- if (objectclass == NULL) {
- return ldb_operr(ldb);
- }
-
- sd_control = ldb_request_get_control(ac->req, LDB_CONTROL_SD_FLAGS_OID);
- sd_control2 = ldb_request_get_control(ac->req,
- LDB_CONTROL_RECALCULATE_SD_OID);
- if (sd_control) {
- struct ldb_sd_flags_control *sdctr = (struct ldb_sd_flags_control *)sd_control->data;
- sd_flags = sdctr->secinfo_flags;
- /* we only care for the last 4 bits */
- sd_flags = sd_flags & 0x0000000F;
- }
- if (sd_flags != 0) {
- oldsd_el = ldb_msg_find_element(ac->search_oc_res->message,
- "nTSecurityDescriptor");
- if (oldsd_el) {
- oldsd_val = oldsd_el->values;
- }
- }
-
- sd = get_new_descriptor(ac->module, ac->msg->dn, ac,
- objectclass, ac->parentsd_val,
- ac->sd_val, oldsd_val, sd_flags);
- if (sd != NULL) {
- if (ac->sd_val != NULL) {
- ac->sd_element->values[0] = *sd;
- } else if (sd_control2 != NULL) {
- /* In this branch we really do force the recalculation
- * of the SD */
- ldb_msg_remove_attr(ac->msg, "nTSecurityDescriptor");
-
- ret = ldb_msg_add_steal_value(ac->msg,
- "nTSecurityDescriptor",
- sd);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- ac->sd_element = ldb_msg_find_element(ac->msg,
- "nTSecurityDescriptor");
- ac->sd_element->flags = LDB_FLAG_MOD_REPLACE;
- }
- }
-
- /* mark the controls as non-critical since we've handled them */
- if (sd_control != NULL) {
- sd_control->critical = 0;
- }
- if (sd_control2 != NULL) {
- sd_control2->critical = 0;
- }
-
- ret = ldb_build_mod_req(&mod_req, ldb, ac,
- ac->msg,
- ac->req->controls,
- ac->req, dsdb_next_callback,
- ac->req);
- LDB_REQ_SET_LOCATION(mod_req);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
-
- return ldb_next_request(ac->module, mod_req);
-}
-
-static int descriptor_do_add(struct descriptor_context *ac)
-{
- struct ldb_context *ldb;
- const struct dsdb_schema *schema;
- struct ldb_request *add_req;
- struct ldb_message_element *objectclass_element;
- int ret;
- DATA_BLOB *sd;
- const struct dsdb_class *objectclass;
- static const char *const attrs[] = { "objectClass", "nTSecurityDescriptor", NULL };
- struct ldb_request *search_req;
-
- ldb = ldb_module_get_ctx(ac->module);
- schema = dsdb_get_schema(ldb, ac);
-
- switch (ac->req->operation) {
- case LDB_ADD:
- ac->msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
- if (ac->msg == NULL) {
- return ldb_module_oom(ac->module);
- }
-
- objectclass_element = ldb_msg_find_element(ac->msg,
- "objectClass");
- if (objectclass_element == NULL) {
- return ldb_operr(ldb);
- }
-
- objectclass = get_last_structural_class(schema,
- objectclass_element, ac->req);
- if (objectclass == NULL) {
- return ldb_operr(ldb);
- }
- break;
- case LDB_MODIFY:
- ac->msg = ldb_msg_copy_shallow(ac, ac->req->op.mod.message);
- if (ac->msg == NULL) {
- return ldb_module_oom(ac->module);
- }
- break;
- default:
- return ldb_operr(ldb);
- }
-
- /* Check if there is a valid security descriptor provided */
- ac->sd_element = dsdb_get_single_valued_attr(ac->msg,
- "nTSecurityDescriptor",
- ac->req->operation);
- if ((ac->sd_element != NULL) && (ac->sd_element->num_values == 1)) {
- ac->sd_val = talloc_memdup(ac,
- &ac->sd_element->values[0],
- sizeof(struct ldb_val));
- }
-
- /* If we do have a parent, then please fetch it's security descriptor.
- * But have in mind: NCs don't have any parents! That means
- * "CN=Configuration,DC=example,DC=com" has no parent
- * "DC=example,DC=com" since this is located under another NC! */
- if (ac->search_res != NULL) {
- struct ldb_message_element *parent_element = NULL;
- struct ldb_dn *nc_root;
-
- ret = dsdb_find_nc_root(ldb, ac, ac->msg->dn, &nc_root);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
-
- if (ldb_dn_compare(ac->msg->dn, nc_root) != 0) {
- /* we aren't any NC */
- parent_element = ldb_msg_find_element(ac->search_res->message,
- "nTSecurityDescriptor");
- if (parent_element != NULL) {
- ac->parentsd_val = talloc_memdup(ac,
- &parent_element->values[0],
- sizeof(struct ldb_val));
- }
- }
- }
-
- if (ac->req->operation == LDB_ADD) {
- /* Get the parent descriptor and the one provided. If not
- * provided, get the default. Convert it to a security
- * descriptor and calculate the permissions. */
- sd = get_new_descriptor(ac->module, ac->msg->dn, ac,
- objectclass, ac->parentsd_val,
- ac->sd_val, NULL, 0);
- if (sd != NULL) {
- if (ac->sd_val != NULL) {
- ac->sd_element->values[0] = *sd;
- } else if (ac->sd_element == NULL) {
- ret = ldb_msg_add_steal_value(ac->msg,
- "nTSecurityDescriptor",
- sd);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- }
- }
-
- ret = ldb_build_add_req(&add_req, ldb, ac,
- ac->msg,
- ac->req->controls,
- ac->req, dsdb_next_callback,
- ac->req);
- LDB_REQ_SET_LOCATION(add_req);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- return ldb_next_request(ac->module, add_req);
- } else {
- ret = ldb_build_search_req(&search_req, ldb, ac,
- ac->msg->dn, LDB_SCOPE_BASE,
- "(objectClass=*)", attrs,
- NULL,
- ac, get_search_oc_callback,
- ac->req);
- LDB_REQ_SET_LOCATION(search_req);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- ac->step_fn = descriptor_do_mod;
- return ldb_next_request(ac->module, search_req);
- }
-}
-
static int descriptor_add(struct ldb_module *module, struct ldb_request *req)
{
struct ldb_context *ldb;
return ldb_next_request(module, mod_req);
}
-
-static int descriptor_change(struct ldb_module *module, struct ldb_request *req)
-{
- struct ldb_context *ldb;
- struct ldb_control *sd_control;
- struct ldb_request *search_req;
- struct descriptor_context *ac;
- struct ldb_dn *parent_dn, *dn;
- struct ldb_message_element *sd_element;
- int ret;
- static const char * const descr_attrs[] = { "nTSecurityDescriptor", NULL };
-
- ldb = ldb_module_get_ctx(module);
-
- switch (req->operation) {
- case LDB_ADD:
- dn = req->op.add.message->dn;
- break;
- case LDB_MODIFY:
- dn = req->op.mod.message->dn;
- sd_element = ldb_msg_find_element(req->op.mod.message,
- "nTSecurityDescriptor");
- /* This control forces the recalculation of the SD also when
- * no modification is performed. */
- sd_control = ldb_request_get_control(req,
- LDB_CONTROL_RECALCULATE_SD_OID);
- if (!sd_element && !sd_control) {
- return ldb_next_request(module, req);
- }
- break;
- default:
- return ldb_operr(ldb);
- }
- ldb_debug(ldb, LDB_DEBUG_TRACE,"descriptor_change: %s\n", ldb_dn_get_linearized(dn));
-
- /* do not manipulate our control entries */
- if (ldb_dn_is_special(dn)) {
- return ldb_next_request(module, req);
- }
-
- ac = descriptor_init_context(module, req);
- if (ac == NULL) {
- return ldb_operr(ldb);
- }
-
- /* If there isn't a parent, just go on to the add processing */
- if (ldb_dn_get_comp_num(dn) == 1) {
- return descriptor_do_add(ac);
- }
-
- /* get copy of parent DN */
- parent_dn = ldb_dn_get_parent(ac, dn);
- if (parent_dn == NULL) {
- return ldb_oom(ldb);
- }
-
- ret = ldb_build_search_req(&search_req, ldb,
- ac, parent_dn, LDB_SCOPE_BASE,
- "(objectClass=*)", descr_attrs,
- NULL,
- ac, get_search_callback,
- req);
- LDB_REQ_SET_LOCATION(search_req);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- talloc_steal(search_req, parent_dn);
-
- ac->step_fn = descriptor_do_add;
-
- return ldb_next_request(ac->module, search_req);
-}
-
static int descriptor_search(struct ldb_module *module, struct ldb_request *req)
{
int ret;
git.samba.org / samba.git / blobdiff