Rework service init functions to pass down service name. This is
[ira/wip.git] / source / ldap_server / ldap_server.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    LDAP server
5
6    Copyright (C) Andrew Tridgell 2005
7    Copyright (C) Volker Lendecke 2004
8    Copyright (C) Stefan Metzmacher 2004
9    
10    This program is free software; you can redistribute it and/or modify
11    it under the terms of the GNU General Public License as published by
12    the Free Software Foundation; either version 3 of the License, or
13    (at your option) any later version.
14    
15    This program is distributed in the hope that it will be useful,
16    but WITHOUT ANY WARRANTY; without even the implied warranty of
17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18    GNU General Public License for more details.
19    
20    You should have received a copy of the GNU General Public License
21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "lib/events/events.h"
26 #include "auth/auth.h"
27 #include "auth/credentials/credentials.h"
28 #include "librpc/gen_ndr/ndr_samr.h"
29 #include "lib/util/dlinklist.h"
30 #include "lib/util/asn1.h"
31 #include "ldap_server/ldap_server.h"
32 #include "smbd/service_task.h"
33 #include "smbd/service_stream.h"
34 #include "smbd/service.h"
35 #include "smbd/process_model.h"
36 #include "lib/tls/tls.h"
37 #include "lib/messaging/irpc.h"
38 #include "lib/ldb/include/ldb.h"
39 #include "lib/ldb/include/ldb_errors.h"
40 #include "system/network.h"
41 #include "lib/socket/netif.h"
42 #include "dsdb/samdb/samdb.h"
43 #include "param/param.h"
44 /*
45   close the socket and shutdown a server_context
46 */
47 void ldapsrv_terminate_connection(struct ldapsrv_connection *conn, 
48                                          const char *reason)
49 {
50         stream_terminate_connection(conn->connection, reason);
51 }
52
53 /*
54   handle packet errors
55 */
56 static void ldapsrv_error_handler(void *private, NTSTATUS status)
57 {
58         struct ldapsrv_connection *conn = talloc_get_type(private, 
59                                                           struct ldapsrv_connection);
60         ldapsrv_terminate_connection(conn, nt_errstr(status));
61 }
62
63 /*
64   process a decoded ldap message
65 */
66 static void ldapsrv_process_message(struct ldapsrv_connection *conn,
67                                     struct ldap_message *msg)
68 {
69         struct ldapsrv_call *call;
70         NTSTATUS status;
71         DATA_BLOB blob;
72
73         call = talloc(conn, struct ldapsrv_call);
74         if (!call) {
75                 ldapsrv_terminate_connection(conn, "no memory");
76                 return;         
77         }
78         
79         call->request = talloc_steal(call, msg);
80         call->conn = conn;
81         call->replies = NULL;
82         call->send_callback = NULL;
83         call->send_private = NULL;
84         
85         /* make the call */
86         status = ldapsrv_do_call(call);
87         if (!NT_STATUS_IS_OK(status)) {
88                 talloc_free(call);
89                 return;
90         }
91         
92         blob = data_blob(NULL, 0);
93
94         if (call->replies == NULL) {
95                 talloc_free(call);
96                 return;
97         }
98
99         /* build all the replies into a single blob */
100         while (call->replies) {
101                 DATA_BLOB b;
102                 bool ret;
103
104                 msg = call->replies->msg;
105                 if (!ldap_encode(msg, &b, call)) {
106                         DEBUG(0,("Failed to encode ldap reply of type %d\n", msg->type));
107                         talloc_free(call);
108                         return;
109                 }
110
111                 ret = data_blob_append(call, &blob, b.data, b.length);
112                 data_blob_free(&b);
113
114                 talloc_set_name_const(blob.data, "Outgoing, encoded LDAP packet");
115
116                 if (!ret) {
117                         talloc_free(call);
118                         return;
119                 }
120
121                 DLIST_REMOVE(call->replies, call->replies);
122         }
123
124         packet_send_callback(conn->packet, blob, 
125                              call->send_callback, call->send_private);
126         talloc_free(call);
127         return;
128 }
129
130 /*
131   decode/process data
132 */
133 static NTSTATUS ldapsrv_decode(void *private, DATA_BLOB blob)
134 {
135         NTSTATUS status;
136         struct ldapsrv_connection *conn = talloc_get_type(private, 
137                                                           struct ldapsrv_connection);
138         struct asn1_data *asn1 = asn1_init(conn);
139         struct ldap_message *msg = talloc(conn, struct ldap_message);
140
141         if (asn1 == NULL || msg == NULL) {
142                 return NT_STATUS_NO_MEMORY;
143         }
144
145         if (!asn1_load(asn1, blob)) {
146                 talloc_free(msg);
147                 talloc_free(asn1);
148                 return NT_STATUS_NO_MEMORY;
149         }
150
151         status = ldap_decode(asn1, msg);
152         if (!NT_STATUS_IS_OK(status)) {
153                 asn1_free(asn1);
154                 return status;
155         }
156
157         data_blob_free(&blob);
158         ldapsrv_process_message(conn, msg);
159         asn1_free(asn1);
160         return NT_STATUS_OK;
161 }
162
163 /*
164  Idle timeout handler
165 */
166 static void ldapsrv_conn_idle_timeout(struct event_context *ev,
167                                       struct timed_event *te,
168                                       struct timeval t,
169                                       void *private)
170 {
171         struct ldapsrv_connection *conn = talloc_get_type(private, struct ldapsrv_connection);
172
173         ldapsrv_terminate_connection(conn, "Timeout. No requests after bind");
174 }
175
176 /*
177   called when a LDAP socket becomes readable
178 */
179 void ldapsrv_recv(struct stream_connection *c, uint16_t flags)
180 {
181         struct ldapsrv_connection *conn = 
182                 talloc_get_type(c->private, struct ldapsrv_connection);
183
184         if (conn->limits.ite) { /* clean initial timeout if any */
185                 talloc_free(conn->limits.ite);
186                 conn->limits.ite = NULL;
187         }
188
189         if (conn->limits.te) { /* clean idle timeout if any */
190                 talloc_free(conn->limits.te);
191                 conn->limits.te = NULL;
192         }
193
194         packet_recv(conn->packet);
195
196         /* set idle timeout */
197         conn->limits.te = event_add_timed(c->event.ctx, conn, 
198                                            timeval_current_ofs(conn->limits.conn_idle_time, 0),
199                                            ldapsrv_conn_idle_timeout, conn);
200 }
201
202 /*
203   called when a LDAP socket becomes writable
204 */
205 static void ldapsrv_send(struct stream_connection *c, uint16_t flags)
206 {
207         struct ldapsrv_connection *conn = 
208                 talloc_get_type(c->private, struct ldapsrv_connection);
209         
210         packet_queue_run(conn->packet);
211 }
212
213 static void ldapsrv_conn_init_timeout(struct event_context *ev,
214                                       struct timed_event *te,
215                                       struct timeval t,
216                                       void *private)
217 {
218         struct ldapsrv_connection *conn = talloc_get_type(private, struct ldapsrv_connection);
219
220         ldapsrv_terminate_connection(conn, "Timeout. No requests after initial connection");
221 }
222
223 static int ldapsrv_load_limits(struct ldapsrv_connection *conn)
224 {
225         TALLOC_CTX *tmp_ctx;
226         const char *attrs[] = { "configurationNamingContext", NULL };
227         const char *attrs2[] = { "lDAPAdminLimits", NULL };
228         struct ldb_message_element *el;
229         struct ldb_result *res = NULL;
230         struct ldb_dn *basedn;
231         struct ldb_dn *conf_dn;
232         struct ldb_dn *policy_dn;
233         int i,ret;
234
235         /* set defaults limits in case of failure */
236         conn->limits.initial_timeout = 120;
237         conn->limits.conn_idle_time = 900;
238         conn->limits.max_page_size = 1000;
239         conn->limits.search_timeout = 120;
240
241
242         tmp_ctx = talloc_new(conn);
243         if (tmp_ctx == NULL) {
244                 return -1;
245         }
246
247         basedn = ldb_dn_new(tmp_ctx, conn->ldb, NULL);
248         if ( ! ldb_dn_validate(basedn)) {
249                 goto failed;
250         }
251
252         ret = ldb_search(conn->ldb, basedn, LDB_SCOPE_BASE, NULL, attrs, &res);
253         if (ret != LDB_SUCCESS) {
254                 goto failed;
255         }
256
257         talloc_steal(tmp_ctx, res);
258
259         if (res->count != 1) {
260                 goto failed;
261         }
262
263         conf_dn = ldb_msg_find_attr_as_dn(conn->ldb, tmp_ctx, res->msgs[0], "configurationNamingContext");
264         if (conf_dn == NULL) {
265                 goto failed;
266         }
267
268         policy_dn = ldb_dn_copy(tmp_ctx, conf_dn);
269         ldb_dn_add_child_fmt(policy_dn, "CN=Default Query Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services");
270         if (policy_dn == NULL) {
271                 goto failed;
272         }
273
274         ret = ldb_search(conn->ldb, policy_dn, LDB_SCOPE_BASE, NULL, attrs2, &res);
275         if (ret != LDB_SUCCESS) {
276                 goto failed;
277         }
278
279         talloc_steal(tmp_ctx, res);
280
281         if (res->count != 1) {
282                 goto failed;
283         }
284
285         el = ldb_msg_find_element(res->msgs[0], "lDAPAdminLimits");
286         if (el == NULL) {
287                 goto failed;
288         }
289
290         for (i = 0; i < el->num_values; i++) {
291                 char policy_name[256];
292                 int policy_value, s;
293
294                 s = sscanf((const char *)el->values[i].data, "%255[^=]=%d", policy_name, &policy_value);
295                 if (ret != 2 || policy_value == 0)
296                         continue;
297                 
298                 if (strcasecmp("InitRecvTimeout", policy_name) == 0) {
299                         conn->limits.initial_timeout = policy_value;
300                         continue;
301                 }
302                 if (strcasecmp("MaxConnIdleTime", policy_name) == 0) {
303                         conn->limits.conn_idle_time = policy_value;
304                         continue;
305                 }
306                 if (strcasecmp("MaxPageSize", policy_name) == 0) {
307                         conn->limits.max_page_size = policy_value;
308                         continue;
309                 }
310                 if (strcasecmp("MaxQueryDuration", policy_name) == 0) {
311                         conn->limits.search_timeout = policy_value;
312                         continue;
313                 }
314         }
315
316         return 0;
317
318 failed:
319         DEBUG(0, ("Failed to load ldap server query policies\n"));
320         talloc_free(tmp_ctx);
321         return -1;
322 }
323
324 /*
325   initialise a server_context from a open socket and register a event handler
326   for reading from that socket
327 */
328 static void ldapsrv_accept(struct stream_connection *c)
329 {
330         struct ldapsrv_service *ldapsrv_service = 
331                 talloc_get_type(c->private, struct ldapsrv_service);
332         struct ldapsrv_connection *conn;
333         struct cli_credentials *server_credentials;
334         struct socket_address *socket_address;
335         NTSTATUS status;
336         int port;
337
338         conn = talloc_zero(c, struct ldapsrv_connection);
339         if (!conn) {
340                 stream_terminate_connection(c, "ldapsrv_accept: out of memory");
341                 return;
342         }
343
344         conn->packet      = NULL;
345         conn->connection  = c;
346         conn->service     = ldapsrv_service;
347         conn->sockets.raw = c->socket;
348         conn->lp_ctx      = ldapsrv_service->task->lp_ctx;
349
350         c->private        = conn;
351
352         socket_address = socket_get_my_addr(c->socket, conn);
353         if (!socket_address) {
354                 ldapsrv_terminate_connection(conn, "ldapsrv_accept: failed to obtain local socket address!");
355                 return;
356         }
357         port = socket_address->port;
358         talloc_free(socket_address);
359
360         if (port == 636) {
361                 struct socket_context *tls_socket = tls_init_server(ldapsrv_service->tls_params, c->socket, 
362                                                                     c->event.fde, NULL);
363                 if (!tls_socket) {
364                         ldapsrv_terminate_connection(conn, "ldapsrv_accept: tls_init_server() failed");
365                         return;
366                 }
367                 talloc_unlink(c, c->socket);
368                 talloc_steal(c, tls_socket);
369                 c->socket = tls_socket;
370                 conn->sockets.tls = tls_socket;
371
372         } else if (port == 3268) /* Global catalog */ {
373                 conn->global_catalog = true;
374         }
375         conn->packet = packet_init(conn);
376         if (conn->packet == NULL) {
377                 ldapsrv_terminate_connection(conn, "out of memory");
378                 return;
379         }
380
381         packet_set_private(conn->packet, conn);
382         packet_set_socket(conn->packet, c->socket);
383         packet_set_callback(conn->packet, ldapsrv_decode);
384         packet_set_full_request(conn->packet, ldap_full_packet);
385         packet_set_error_handler(conn->packet, ldapsrv_error_handler);
386         packet_set_event_context(conn->packet, c->event.ctx);
387         packet_set_fde(conn->packet, c->event.fde);
388         packet_set_serialise(conn->packet);
389         
390         /* Ensure we don't get packets until the database is ready below */
391         packet_recv_disable(conn->packet);
392
393         server_credentials = cli_credentials_init(conn);
394         if (!server_credentials) {
395                 stream_terminate_connection(c, "Failed to init server credentials\n");
396                 return;
397         }
398         
399         cli_credentials_set_conf(server_credentials, conn->lp_ctx);
400         status = cli_credentials_set_machine_account(server_credentials, conn->lp_ctx);
401         if (!NT_STATUS_IS_OK(status)) {
402                 stream_terminate_connection(c, talloc_asprintf(conn, "Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(status)));
403                 return;
404         }
405         conn->server_credentials = server_credentials;
406
407         /* Connections start out anonymous */
408         if (!NT_STATUS_IS_OK(auth_anonymous_session_info(conn, conn->lp_ctx, &conn->session_info))) {
409                 ldapsrv_terminate_connection(conn, "failed to setup anonymous session info");
410                 return;
411         }
412
413         if (!NT_STATUS_IS_OK(ldapsrv_backend_Init(conn))) {
414                 ldapsrv_terminate_connection(conn, "backend Init failed");
415                 return;
416         }
417
418         /* load limits from the conf partition */
419         ldapsrv_load_limits(conn); /* should we fail on error ? */
420
421         /* register the server */       
422         irpc_add_name(c->msg_ctx, "ldap_server");
423
424         /* set connections limits */
425         conn->limits.ite = event_add_timed(c->event.ctx, conn, 
426                                            timeval_current_ofs(conn->limits.initial_timeout, 0),
427                                            ldapsrv_conn_init_timeout, conn);
428
429         packet_recv_enable(conn->packet);
430
431 }
432
433 static const struct stream_server_ops ldap_stream_ops = {
434         .name                   = "ldap",
435         .accept_connection      = ldapsrv_accept,
436         .recv_handler           = ldapsrv_recv,
437         .send_handler           = ldapsrv_send,
438 };
439
440 /*
441   add a socket address to the list of events, one event per port
442 */
443 static NTSTATUS add_socket(struct event_context *event_context,
444                            struct loadparm_context *lp_ctx, 
445                            const struct model_ops *model_ops,
446                            const char *address, struct ldapsrv_service *ldap_service)
447 {
448         uint16_t port = 389;
449         NTSTATUS status;
450         struct ldb_context *ldb;
451
452         status = stream_setup_socket(event_context, lp_ctx,
453                                      model_ops, &ldap_stream_ops, 
454                                      "ipv4", address, &port, 
455                                      lp_socket_options(lp_ctx), 
456                                      ldap_service);
457         if (!NT_STATUS_IS_OK(status)) {
458                 DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
459                          address, port, nt_errstr(status)));
460         }
461
462         if (tls_support(ldap_service->tls_params)) {
463                 /* add ldaps server */
464                 port = 636;
465                 status = stream_setup_socket(event_context, lp_ctx, 
466                                              model_ops, &ldap_stream_ops, 
467                                              "ipv4", address, &port, 
468                                              lp_socket_options(lp_ctx), 
469                                              ldap_service);
470                 if (!NT_STATUS_IS_OK(status)) {
471                         DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
472                                  address, port, nt_errstr(status)));
473                 }
474         }
475
476         /* Load LDAP database */
477         ldb = samdb_connect(ldap_service, lp_ctx, system_session(ldap_service, lp_ctx));
478         if (!ldb) {
479                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
480         }
481         
482         if (samdb_is_gc(ldb)) {
483                 port = 3268;
484                 status = stream_setup_socket(event_context, lp_ctx,
485                                              model_ops, &ldap_stream_ops, 
486                                              "ipv4", address, &port, 
487                                              lp_socket_options(lp_ctx), 
488                                              ldap_service);
489                 if (!NT_STATUS_IS_OK(status)) {
490                         DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
491                                  address, port, nt_errstr(status)));
492                 }
493         }
494
495         return status;
496 }
497
498 /*
499   open the ldap server sockets
500 */
501 static void ldapsrv_task_init(struct task_server *task)
502 {       
503         char *ldapi_path;
504         struct ldapsrv_service *ldap_service;
505         NTSTATUS status;
506         const struct model_ops *model_ops;
507
508         switch (lp_server_role(task->lp_ctx)) {
509         case ROLE_STANDALONE:
510                 task_server_terminate(task, "ldap_server: no LDAP server required in standalone configuration");
511                 return;
512         case ROLE_DOMAIN_MEMBER:
513                 task_server_terminate(task, "ldap_server: no LDAP server required in member server configuration");
514                 return;
515         case ROLE_DOMAIN_CONTROLLER:
516                 /* Yes, we want an LDAP server */
517                 break;
518         }
519
520         task_server_set_title(task, "task[ldapsrv]");
521
522         /* run the ldap server as a single process */
523         model_ops = process_model_byname("single");
524         if (!model_ops) goto failed;
525
526         ldap_service = talloc_zero(task, struct ldapsrv_service);
527         if (ldap_service == NULL) goto failed;
528
529         ldap_service->task = task;
530
531         ldap_service->tls_params = tls_initialise(ldap_service, task->lp_ctx);
532         if (ldap_service->tls_params == NULL) goto failed;
533
534         if (lp_interfaces(task->lp_ctx) && lp_bind_interfaces_only(task->lp_ctx)) {
535                 struct interface *ifaces;
536                 int num_interfaces;
537                 int i;
538
539                 load_interfaces(task, lp_interfaces(task->lp_ctx), &ifaces);
540                 num_interfaces = iface_count(ifaces);
541
542                 /* We have been given an interfaces line, and been 
543                    told to only bind to those interfaces. Create a
544                    socket per interface and bind to only these.
545                 */
546                 for(i = 0; i < num_interfaces; i++) {
547                         const char *address = iface_n_ip(ifaces, i);
548                         status = add_socket(task->event_ctx, task->lp_ctx, model_ops, address, ldap_service);
549                         if (!NT_STATUS_IS_OK(status)) goto failed;
550                 }
551         } else {
552                 status = add_socket(task->event_ctx, task->lp_ctx, model_ops, 
553                                     lp_socket_address(task->lp_ctx), ldap_service);
554                 if (!NT_STATUS_IS_OK(status)) goto failed;
555         }
556
557         ldapi_path = private_path(ldap_service, task->lp_ctx, "ldapi");
558         if (!ldapi_path) {
559                 goto failed;
560         }
561
562         status = stream_setup_socket(task->event_ctx, task->lp_ctx,
563                                      model_ops, &ldap_stream_ops, 
564                                      "unix", ldapi_path, NULL, 
565                                      lp_socket_options(task->lp_ctx), 
566                                      ldap_service);
567         talloc_free(ldapi_path);
568         if (!NT_STATUS_IS_OK(status)) {
569                 DEBUG(0,("ldapsrv failed to bind to %s - %s\n",
570                          ldapi_path, nt_errstr(status)));
571         }
572
573         return;
574
575 failed:
576         task_server_terminate(task, "Failed to startup ldap server task");      
577 }
578
579 /*
580   called on startup of the web server service It's job is to start
581   listening on all configured sockets
582 */
583 static NTSTATUS ldapsrv_init(struct event_context *event_context, 
584                              struct loadparm_context *lp_ctx,
585                              const struct model_ops *model_ops)
586 {       
587         return task_server_startup(event_context, lp_ctx, "ldap", model_ops, 
588                                    ldapsrv_task_init);
589 }
590
591
592 NTSTATUS server_service_ldap_init(void)
593 {
594         return register_server_service("ldap", ldapsrv_init);
595 }