2 Unix SMB/CIFS implementation.
4 Copyright (C) Stefan Metzmacher 2004
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 #include "ldap_server/ldap_server.h"
22 #include "auth/auth.h"
23 #include "smbd/service.h"
25 #include <ldb_errors.h>
26 #include "../lib/util/dlinklist.h"
27 #include "dsdb/samdb/samdb.h"
28 #include "auth/gensec/gensec.h"
29 #include "auth/gensec/gensec_tstream.h"
30 #include "param/param.h"
31 #include "../lib/util/tevent_ntstatus.h"
33 static char *ldapsrv_bind_error_msg(TALLOC_CTX *mem_ctx,
41 status = nt_status_squash(status);
42 werr = ntstatus_to_werror(status);
45 * There are 4 lower case hex digits following 'v' at the end,
46 * but different Windows Versions return different values:
48 * Windows 2008R2 uses 'v1db1'
49 * Windows 2012R2 uses 'v2580'
51 * We just match Windows 2008R2 as that's what was referenced
52 * in https://bugzilla.samba.org/show_bug.cgi?id=9048
54 msg = talloc_asprintf(mem_ctx, "%08X: LdapErr: DSID-%08X, comment: "
55 "AcceptSecurityContext error, data %x, v1db1",
56 (unsigned)HRES_ERROR_V(hresult),
58 (unsigned)W_ERROR_V(werr));
63 struct ldapsrv_bind_wait_context {
64 struct ldapsrv_reply *reply;
65 struct tevent_req *req;
70 struct ldapsrv_bind_wait_state {
74 static struct tevent_req *ldapsrv_bind_wait_send(TALLOC_CTX *mem_ctx,
75 struct tevent_context *ev,
78 struct ldapsrv_bind_wait_context *bind_wait =
79 talloc_get_type_abort(private_data,
80 struct ldapsrv_bind_wait_context);
81 struct tevent_req *req;
82 struct ldapsrv_bind_wait_state *state;
84 req = tevent_req_create(mem_ctx, &state,
85 struct ldapsrv_bind_wait_state);
91 tevent_req_defer_callback(req, ev);
93 if (!bind_wait->done) {
97 if (tevent_req_nterror(req, bind_wait->status)) {
98 return tevent_req_post(req, ev);
101 tevent_req_done(req);
102 return tevent_req_post(req, ev);
105 static NTSTATUS ldapsrv_bind_wait_recv(struct tevent_req *req)
107 return tevent_req_simple_recv_ntstatus(req);
110 static NTSTATUS ldapsrv_bind_wait_setup(struct ldapsrv_call *call,
111 struct ldapsrv_reply *reply)
113 struct ldapsrv_bind_wait_context *bind_wait = NULL;
115 if (call->wait_private != NULL) {
116 return NT_STATUS_INTERNAL_ERROR;
119 bind_wait = talloc_zero(call, struct ldapsrv_bind_wait_context);
120 if (bind_wait == NULL) {
121 return NT_STATUS_NO_MEMORY;
123 bind_wait->reply = reply;
125 call->wait_private = bind_wait;
126 call->wait_send = ldapsrv_bind_wait_send;
127 call->wait_recv = ldapsrv_bind_wait_recv;
131 static void ldapsrv_bind_wait_finished(struct ldapsrv_call *call,
134 struct ldapsrv_bind_wait_context *bind_wait =
135 talloc_get_type_abort(call->wait_private,
136 struct ldapsrv_bind_wait_context);
138 bind_wait->done = true;
139 bind_wait->status = status;
141 if (bind_wait->req == NULL) {
145 if (tevent_req_nterror(bind_wait->req, status)) {
149 tevent_req_done(bind_wait->req);
152 static void ldapsrv_BindSimple_done(struct tevent_req *subreq);
154 static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
156 struct ldap_BindRequest *req = &call->request->r.BindRequest;
157 struct ldapsrv_reply *reply = NULL;
158 struct ldap_BindResponse *resp = NULL;
160 const char *errstr = NULL;
162 bool using_tls = call->conn->sockets.active == call->conn->sockets.tls;
163 struct tevent_req *subreq = NULL;
165 DEBUG(10, ("BindSimple dn: %s\n",req->dn));
167 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
169 return NT_STATUS_NO_MEMORY;
172 if (req->dn != NULL &&
173 strlen(req->dn) != 0 &&
174 call->conn->require_strong_auth > LDAP_SERVER_REQUIRE_STRONG_AUTH_NO &&
177 status = NT_STATUS_NETWORK_ACCESS_DENIED;
178 result = LDAP_STRONG_AUTH_REQUIRED;
179 errstr = talloc_asprintf(reply,
180 "BindSimple: Transport encryption required.");
184 subreq = authenticate_ldap_simple_bind_send(call,
185 call->conn->connection->event.ctx,
186 call->conn->connection->msg_ctx,
188 call->conn->connection->remote_address,
189 call->conn->connection->local_address,
192 req->creds.password);
193 if (subreq == NULL) {
194 return NT_STATUS_NO_MEMORY;
196 tevent_req_set_callback(subreq, ldapsrv_BindSimple_done, call);
198 status = ldapsrv_bind_wait_setup(call, reply);
199 if (!NT_STATUS_IS_OK(status)) {
205 * The rest will be async.
210 resp = &reply->msg->r.BindResponse;
211 resp->response.resultcode = result;
212 resp->response.errormessage = errstr;
213 resp->response.dn = NULL;
214 resp->response.referral = NULL;
215 resp->SASL.secblob = NULL;
217 ldapsrv_queue_reply(call, reply);
221 static void ldapsrv_BindSimple_done(struct tevent_req *subreq)
223 struct ldapsrv_call *call =
224 tevent_req_callback_data(subreq,
225 struct ldapsrv_call);
226 struct ldapsrv_bind_wait_context *bind_wait =
227 talloc_get_type_abort(call->wait_private,
228 struct ldapsrv_bind_wait_context);
229 struct ldapsrv_reply *reply = bind_wait->reply;
230 struct auth_session_info *session_info = NULL;
232 struct ldap_BindResponse *resp = NULL;
234 const char *errstr = NULL;
236 status = authenticate_ldap_simple_bind_recv(subreq,
239 if (NT_STATUS_IS_OK(status)) {
240 char *ldb_errstring = NULL;
241 result = LDAP_SUCCESS;
244 talloc_unlink(call->conn, call->conn->session_info);
245 call->conn->session_info = talloc_steal(call->conn, session_info);
247 call->conn->authz_logged = true;
249 /* don't leak the old LDB */
250 talloc_unlink(call->conn, call->conn->ldb);
252 result = ldapsrv_backend_Init(call->conn, &ldb_errstring);
254 if (result != LDB_SUCCESS) {
255 /* Only put the detailed error in DEBUG() */
256 DBG_ERR("ldapsrv_backend_Init failed: %s: %s",
257 ldb_errstring, ldb_strerror(result));
258 errstr = talloc_strdup(reply,
259 "Simple Bind: Failed to advise "
260 "ldb new credentials");
261 result = LDB_ERR_OPERATIONS_ERROR;
264 status = nt_status_squash(status);
266 result = LDAP_INVALID_CREDENTIALS;
267 errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_INVALID_TOKEN,
271 resp = &reply->msg->r.BindResponse;
272 resp->response.resultcode = result;
273 resp->response.errormessage = errstr;
274 resp->response.dn = NULL;
275 resp->response.referral = NULL;
276 resp->SASL.secblob = NULL;
278 ldapsrv_queue_reply(call, reply);
279 ldapsrv_bind_wait_finished(call, NT_STATUS_OK);
282 struct ldapsrv_sasl_postprocess_context {
283 struct ldapsrv_connection *conn;
284 struct tstream_context *sasl;
287 struct ldapsrv_sasl_postprocess_state {
291 static struct tevent_req *ldapsrv_sasl_postprocess_send(TALLOC_CTX *mem_ctx,
292 struct tevent_context *ev,
295 struct ldapsrv_sasl_postprocess_context *context =
296 talloc_get_type_abort(private_data,
297 struct ldapsrv_sasl_postprocess_context);
298 struct tevent_req *req;
299 struct ldapsrv_sasl_postprocess_state *state;
301 req = tevent_req_create(mem_ctx, &state,
302 struct ldapsrv_sasl_postprocess_state);
307 TALLOC_FREE(context->conn->sockets.sasl);
308 context->conn->sockets.sasl = talloc_move(context->conn, &context->sasl);
309 context->conn->sockets.active = context->conn->sockets.sasl;
311 tevent_req_done(req);
312 return tevent_req_post(req, ev);
315 static NTSTATUS ldapsrv_sasl_postprocess_recv(struct tevent_req *req)
317 return tevent_req_simple_recv_ntstatus(req);
320 static NTSTATUS ldapsrv_setup_gensec(struct ldapsrv_connection *conn,
321 const char *sasl_mech,
322 struct gensec_security **_gensec_security)
326 struct gensec_security *gensec_security;
328 status = samba_server_gensec_start(conn,
329 conn->connection->event.ctx,
330 conn->connection->msg_ctx,
332 conn->server_credentials,
335 if (!NT_STATUS_IS_OK(status)) {
339 status = gensec_set_target_service_description(gensec_security,
341 if (!NT_STATUS_IS_OK(status)) {
345 status = gensec_set_remote_address(gensec_security,
346 conn->connection->remote_address);
347 if (!NT_STATUS_IS_OK(status)) {
351 status = gensec_set_local_address(gensec_security,
352 conn->connection->local_address);
353 if (!NT_STATUS_IS_OK(status)) {
357 gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES);
358 gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAP_STYLE);
360 if (conn->sockets.active == conn->sockets.tls) {
361 gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAPS_TRANSPORT);
364 status = gensec_start_mech_by_sasl_name(gensec_security, sasl_mech);
366 if (!NT_STATUS_IS_OK(status)) {
370 *_gensec_security = gensec_security;
374 static void ldapsrv_BindSASL_done(struct tevent_req *subreq);
376 static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
378 struct ldap_BindRequest *req = &call->request->r.BindRequest;
379 struct ldapsrv_reply *reply;
380 struct ldap_BindResponse *resp;
381 struct ldapsrv_connection *conn;
383 const char *errstr=NULL;
384 NTSTATUS status = NT_STATUS_OK;
385 DATA_BLOB input = data_blob_null;
386 struct tevent_req *subreq = NULL;
388 DEBUG(10, ("BindSASL dn: %s\n",req->dn));
390 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
392 return NT_STATUS_NO_MEMORY;
394 resp = &reply->msg->r.BindResponse;
395 /* Windows 2000 mmc doesn't like secblob == NULL and reports a decoding error */
396 resp->SASL.secblob = talloc_zero(reply, DATA_BLOB);
397 if (resp->SASL.secblob == NULL) {
398 return NT_STATUS_NO_MEMORY;
404 * TODO: a SASL bind with a different mechanism
405 * should cancel an inprogress SASL bind.
410 status = ldapsrv_setup_gensec(conn, req->creds.SASL.mechanism,
412 if (!NT_STATUS_IS_OK(status)) {
413 DEBUG(1, ("Failed to start GENSEC server for [%s] code: %s\n",
414 ldb_binary_encode_string(call, req->creds.SASL.mechanism),
416 result = LDAP_OPERATIONS_ERROR;
417 errstr = talloc_asprintf(reply, "SASL: Failed to start authentication system: %s",
423 if (req->creds.SASL.secblob) {
424 input = *req->creds.SASL.secblob;
427 subreq = gensec_update_send(call, conn->connection->event.ctx,
428 conn->gensec, input);
429 if (subreq == NULL) {
430 return NT_STATUS_NO_MEMORY;
432 tevent_req_set_callback(subreq, ldapsrv_BindSASL_done, call);
434 status = ldapsrv_bind_wait_setup(call, reply);
435 if (!NT_STATUS_IS_OK(status)) {
441 * The rest will be async.
446 if (result != LDAP_SASL_BIND_IN_PROGRESS) {
448 * We should destroy the gensec context
449 * when we hit a fatal error.
451 * Note: conn->gensec is already cleared
452 * for the LDAP_SUCCESS case.
454 talloc_unlink(conn, conn->gensec);
458 resp->response.resultcode = result;
459 resp->response.dn = NULL;
460 resp->response.errormessage = errstr;
461 resp->response.referral = NULL;
463 ldapsrv_queue_reply(call, reply);
467 static void ldapsrv_BindSASL_done(struct tevent_req *subreq)
469 struct ldapsrv_call *call =
470 tevent_req_callback_data(subreq,
471 struct ldapsrv_call);
472 struct ldapsrv_bind_wait_context *bind_wait =
473 talloc_get_type_abort(call->wait_private,
474 struct ldapsrv_bind_wait_context);
475 struct ldap_BindRequest *req = &call->request->r.BindRequest;
476 struct ldapsrv_reply *reply = bind_wait->reply;
477 struct ldap_BindResponse *resp = &reply->msg->r.BindResponse;
478 struct ldapsrv_connection *conn = call->conn;
479 struct auth_session_info *session_info = NULL;
480 struct ldapsrv_sasl_postprocess_context *context = NULL;
483 const char *errstr = NULL;
484 char *ldb_errstring = NULL;
485 DATA_BLOB output = data_blob_null;
487 status = gensec_update_recv(subreq, call, &output);
490 if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED, status)) {
491 *resp->SASL.secblob = output;
492 result = LDAP_SASL_BIND_IN_PROGRESS;
497 if (!NT_STATUS_IS_OK(status)) {
498 status = nt_status_squash(status);
499 result = LDAP_INVALID_CREDENTIALS;
500 errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_LOGON_DENIED,
505 if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
506 gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
508 context = talloc_zero(call, struct ldapsrv_sasl_postprocess_context);
509 if (context == NULL) {
510 ldapsrv_bind_wait_finished(call, NT_STATUS_NO_MEMORY);
515 if (context && conn->sockets.tls) {
516 TALLOC_FREE(context);
517 status = NT_STATUS_NOT_SUPPORTED;
518 result = LDAP_UNWILLING_TO_PERFORM;
519 errstr = talloc_asprintf(reply,
520 "SASL:[%s]: Sign or Seal are not allowed if TLS is used",
521 req->creds.SASL.mechanism);
525 if (context && conn->sockets.sasl) {
526 TALLOC_FREE(context);
527 status = NT_STATUS_NOT_SUPPORTED;
528 result = LDAP_UNWILLING_TO_PERFORM;
529 errstr = talloc_asprintf(reply,
530 "SASL:[%s]: Sign or Seal are not allowed if SASL encryption has already been set up",
531 req->creds.SASL.mechanism);
535 if (context == NULL) {
536 switch (call->conn->require_strong_auth) {
537 case LDAP_SERVER_REQUIRE_STRONG_AUTH_NO:
539 case LDAP_SERVER_REQUIRE_STRONG_AUTH_ALLOW_SASL_OVER_TLS:
540 if (call->conn->sockets.active == call->conn->sockets.tls) {
543 status = NT_STATUS_NETWORK_ACCESS_DENIED;
544 result = LDAP_STRONG_AUTH_REQUIRED;
545 errstr = talloc_asprintf(reply,
546 "SASL:[%s]: not allowed if TLS is used.",
547 req->creds.SASL.mechanism);
550 case LDAP_SERVER_REQUIRE_STRONG_AUTH_YES:
551 status = NT_STATUS_NETWORK_ACCESS_DENIED;
552 result = LDAP_STRONG_AUTH_REQUIRED;
553 errstr = talloc_asprintf(reply,
554 "SASL:[%s]: Sign or Seal are required.",
555 req->creds.SASL.mechanism);
560 if (context != NULL) {
561 context->conn = conn;
562 status = gensec_create_tstream(context,
563 context->conn->gensec,
564 context->conn->sockets.raw,
566 if (!NT_STATUS_IS_OK(status)) {
567 result = LDAP_OPERATIONS_ERROR;
568 errstr = talloc_asprintf(reply,
569 "SASL:[%s]: Failed to setup SASL socket: %s",
570 req->creds.SASL.mechanism, nt_errstr(status));
575 status = gensec_session_info(conn->gensec, call, &session_info);
576 if (!NT_STATUS_IS_OK(status)) {
577 result = LDAP_OPERATIONS_ERROR;
578 errstr = talloc_asprintf(reply,
579 "SASL:[%s]: Failed to get session info: %s",
580 req->creds.SASL.mechanism, nt_errstr(status));
584 talloc_unlink(conn, conn->session_info);
585 conn->session_info = talloc_steal(conn, session_info);
587 /* don't leak the old LDB */
588 talloc_unlink(conn, conn->ldb);
590 call->conn->authz_logged = true;
592 result = ldapsrv_backend_Init(call->conn, &ldb_errstring);
594 if (result != LDB_SUCCESS) {
595 /* Only put the detailed error in DEBUG() */
596 DBG_ERR("ldapsrv_backend_Init failed: %s: %s",
597 ldb_errstring, ldb_strerror(result));
598 errstr = talloc_strdup(reply,
599 "SASL Bind: Failed to advise "
600 "ldb new credentials");
601 result = LDB_ERR_OPERATIONS_ERROR;
604 if (context != NULL) {
605 const void *ptr = NULL;
607 ptr = talloc_reparent(conn, context->sasl, conn->gensec);
609 ldapsrv_bind_wait_finished(call, NT_STATUS_NO_MEMORY);
613 call->postprocess_send = ldapsrv_sasl_postprocess_send;
614 call->postprocess_recv = ldapsrv_sasl_postprocess_recv;
615 call->postprocess_private = context;
617 talloc_unlink(conn, conn->gensec);
621 *resp->SASL.secblob = output;
622 result = LDAP_SUCCESS;
626 if (result != LDAP_SASL_BIND_IN_PROGRESS) {
628 * We should destroy the gensec context
629 * when we hit a fatal error.
631 * Note: conn->gensec is already cleared
632 * for the LDAP_SUCCESS case.
634 talloc_unlink(conn, conn->gensec);
638 resp->response.resultcode = result;
639 resp->response.dn = NULL;
640 resp->response.errormessage = errstr;
641 resp->response.referral = NULL;
643 ldapsrv_queue_reply(call, reply);
644 ldapsrv_bind_wait_finished(call, NT_STATUS_OK);
647 NTSTATUS ldapsrv_BindRequest(struct ldapsrv_call *call)
649 struct ldap_BindRequest *req = &call->request->r.BindRequest;
650 struct ldapsrv_reply *reply;
651 struct ldap_BindResponse *resp;
653 if (call->conn->pending_calls != NULL) {
654 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
656 return NT_STATUS_NO_MEMORY;
659 resp = &reply->msg->r.BindResponse;
660 resp->response.resultcode = LDAP_BUSY;
661 resp->response.dn = NULL;
662 resp->response.errormessage = talloc_asprintf(reply, "Pending requests on this LDAP session");
663 resp->response.referral = NULL;
664 resp->SASL.secblob = NULL;
666 ldapsrv_queue_reply(call, reply);
671 * TODO: a simple bind should cancel an
672 * inprogress SASL bind.
675 switch (req->mechanism) {
676 case LDAP_AUTH_MECH_SIMPLE:
677 return ldapsrv_BindSimple(call);
678 case LDAP_AUTH_MECH_SASL:
679 return ldapsrv_BindSASL(call);
682 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
684 return NT_STATUS_NO_MEMORY;
687 resp = &reply->msg->r.BindResponse;
688 resp->response.resultcode = LDAP_AUTH_METHOD_NOT_SUPPORTED;
689 resp->response.dn = NULL;
690 resp->response.errormessage = talloc_asprintf(reply, "Bad AuthenticationChoice [%d]", req->mechanism);
691 resp->response.referral = NULL;
692 resp->SASL.secblob = NULL;
694 ldapsrv_queue_reply(call, reply);
698 struct ldapsrv_unbind_wait_context {
702 struct ldapsrv_unbind_wait_state {
706 static struct tevent_req *ldapsrv_unbind_wait_send(TALLOC_CTX *mem_ctx,
707 struct tevent_context *ev,
710 struct ldapsrv_unbind_wait_context *unbind_wait =
711 talloc_get_type_abort(private_data,
712 struct ldapsrv_unbind_wait_context);
713 struct tevent_req *req;
714 struct ldapsrv_unbind_wait_state *state;
716 req = tevent_req_create(mem_ctx, &state,
717 struct ldapsrv_unbind_wait_state);
724 tevent_req_nterror(req, NT_STATUS_LOCAL_DISCONNECT);
725 return tevent_req_post(req, ev);
728 static NTSTATUS ldapsrv_unbind_wait_recv(struct tevent_req *req)
730 return tevent_req_simple_recv_ntstatus(req);
733 static NTSTATUS ldapsrv_unbind_wait_setup(struct ldapsrv_call *call)
735 struct ldapsrv_unbind_wait_context *unbind_wait = NULL;
737 if (call->wait_private != NULL) {
738 return NT_STATUS_INTERNAL_ERROR;
741 unbind_wait = talloc_zero(call, struct ldapsrv_unbind_wait_context);
742 if (unbind_wait == NULL) {
743 return NT_STATUS_NO_MEMORY;
746 call->wait_private = unbind_wait;
747 call->wait_send = ldapsrv_unbind_wait_send;
748 call->wait_recv = ldapsrv_unbind_wait_recv;
752 NTSTATUS ldapsrv_UnbindRequest(struct ldapsrv_call *call)
754 struct ldapsrv_call *c = NULL;
755 struct ldapsrv_call *n = NULL;
757 DEBUG(10, ("UnbindRequest\n"));
759 for (c = call->conn->pending_calls; c != NULL; c = n) {
762 DLIST_REMOVE(call->conn->pending_calls, c);
766 return ldapsrv_unbind_wait_setup(call);