source4/dsdb/samdb/ldb_modules/extended_dn.c

   1 /*
   2    ldb database library
   3
   4    Copyright (C) Simo Sorce  2005
   5
   6      ** NOTE! The following LGPL license applies to the ldb
   7      ** library. This does NOT imply that all of Samba is released
   8      ** under the LGPL
   9
  10    This library is free software; you can redistribute it and/or
  11    modify it under the terms of the GNU Lesser General Public
  12    License as published by the Free Software Foundation; either
  13    version 3 of the License, or (at your option) any later version.
  14
  15    This library is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18    Lesser General Public License for more details.
  19
  20    You should have received a copy of the GNU Lesser General Public
  21    License along with this library; if not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 /*
  25  *  Name: ldb
  26  *
  27  *  Component: ldb extended dn control module
  28  *
  29  *  Description: this module builds a special dn
  30  *
  31  *  Author: Simo Sorce
  32  */
  33
  34 #include "includes.h"
  35 #include "ldb/include/ldb.h"
  36 #include "ldb/include/ldb_errors.h"
  37 #include "ldb/include/ldb_private.h"
  38 #include "librpc/gen_ndr/ndr_misc.h"
  39 #include "dsdb/samdb/samdb.h"
  40 #include "libcli/security/security.h"
  41
  42 #include <time.h>
  43
  44 static bool is_attr_in_list(const char * const * attrs, const char *attr)
  45 {
  46         int i;
  47
  48         for (i = 0; attrs[i]; i++) {
  49                 if (strcasecmp(attrs[i], attr) == 0)
  50                         return true;
  51         }
  52
  53         return false;
  54 }
  55
  56 static char **copy_attrs(void *mem_ctx, const char * const * attrs)
  57 {
  58         char **new;
  59         int i, num;
  60
  61         for (num = 0; attrs[num]; num++);
  62
  63         new = talloc_array(mem_ctx, char *, num + 1);
  64         if (!new) return NULL;
  65
  66         for(i = 0; i < num; i++) {
  67                 new[i] = talloc_strdup(new, attrs[i]);
  68                 if (!new[i]) {
  69                         talloc_free(new);
  70                         return NULL;
  71                 }
  72         }
  73         new[i] = NULL;
  74
  75         return new;
  76 }
  77
  78 static bool add_attrs(void *mem_ctx, char ***attrs, const char *attr)
  79 {
  80         char **new;
  81         int num;
  82
  83         for (num = 0; (*attrs)[num]; num++);
  84
  85         new = talloc_realloc(mem_ctx, *attrs, char *, num + 2);
  86         if (!new) return false;
  87
  88         *attrs = new;
  89
  90         new[num] = talloc_strdup(new, attr);
  91         if (!new[num]) return false;
  92
  93         new[num + 1] = NULL;
  94
  95         return true;
  96 }
  97
  98 static bool inject_extended_dn(struct ldb_message *msg,
  99                                 struct ldb_context *ldb,
 100                                 int type,
 101                                 bool remove_guid,
 102                                 bool remove_sid)
 103 {
 104         const struct ldb_val *val;
 105         struct GUID guid;
 106         struct dom_sid *sid;
 107         const DATA_BLOB *guid_blob;
 108         const DATA_BLOB *sid_blob;
 109         char *object_guid;
 110         char *object_sid;
 111         char *new_dn;
 112
 113         guid_blob = ldb_msg_find_ldb_val(msg, "objectGUID");
 114         sid_blob = ldb_msg_find_ldb_val(msg, "objectSID");
 115
 116         if (!guid_blob)
 117                 return false;
 118
 119         switch (type) {
 120                 case 0:
 121                         /* return things in hexadecimal format */
 122                         if (sid_blob) {
 123                                 const char *lower_guid_hex = strlower_talloc(msg, data_blob_hex_string(msg, guid_blob));
 124                                 const char *lower_sid_hex = strlower_talloc(msg, data_blob_hex_string(msg, sid_blob));
 125                                 if (!lower_guid_hex || !lower_sid_hex) {
 126                                         return false;
 127                                 }
 128                                 new_dn = talloc_asprintf(msg, "<GUID=%s>;<SID=%s>;%s",
 129                                                          lower_guid_hex,
 130                                                          lower_sid_hex,
 131                                                          ldb_dn_get_linearized(msg->dn));
 132                         } else {
 133                                 const char *lower_guid_hex = strlower_talloc(msg, data_blob_hex_string(msg, guid_blob));
 134                                 if (!lower_guid_hex) {
 135                                         return false;
 136                                 }
 137                                 new_dn = talloc_asprintf(msg, "<GUID=%s>;%s",
 138                                                          lower_guid_hex,
 139                                                          ldb_dn_get_linearized(msg->dn));
 140                         }
 141
 142                         break;
 143                 case 1:
 144                         /* retrieve object_guid */
 145                         guid = samdb_result_guid(msg, "objectGUID");
 146                         object_guid = GUID_string(msg, &guid);
 147
 148                         /* retrieve object_sid */
 149                         object_sid = NULL;
 150                         sid = samdb_result_dom_sid(msg, msg, "objectSID");
 151                         if (sid) {
 152                                 object_sid = dom_sid_string(msg, sid);
 153                                 if (!object_sid)
 154                                         return false;
 155
 156                         }
 157
 158                         /* Normal, sane format */
 159                         if (object_sid) {
 160                                 new_dn = talloc_asprintf(msg, "<GUID=%s>;<SID=%s>;%s",
 161                                                          object_guid, object_sid,
 162                                                          ldb_dn_get_linearized(msg->dn));
 163                         } else {
 164                                 new_dn = talloc_asprintf(msg, "<GUID=%s>;%s",
 165                                                          object_guid,
 166                                                          ldb_dn_get_linearized(msg->dn));
 167                         }
 168                         break;
 169                 default:
 170                         return false;
 171         }
 172
 173         if (!new_dn) {
 174                 return false;
 175         }
 176
 177         if (remove_guid) {
 178                 ldb_msg_remove_attr(msg, "objectGUID");
 179         }
 180
 181         if (sid_blob && remove_sid) {
 182                 ldb_msg_remove_attr(msg, "objectSID");
 183         }
 184
 185         msg->dn = ldb_dn_new(msg, ldb, new_dn);
 186         if (! ldb_dn_validate(msg->dn))
 187                 return false;
 188
 189         val = ldb_msg_find_ldb_val(msg, "distinguishedName");
 190         if (val) {
 191                 ldb_msg_remove_attr(msg, "distinguishedName");
 192                 if (ldb_msg_add_steal_string(msg, "distinguishedName", new_dn))
 193                         return false;
 194         }
 195
 196         return true;
 197 }
 198
 199 /* search */
 200 struct extended_context {
 201
 202         struct ldb_module *module;
 203         void *up_context;
 204         int (*up_callback)(struct ldb_context *, void *, struct ldb_reply *);
 205
 206         const char * const *attrs;
 207         bool remove_guid;
 208         bool remove_sid;
 209         int extended_type;
 210 };
 211
 212 static int extended_callback(struct ldb_context *ldb, void *context, struct ldb_reply *ares)
 213 {
 214         struct extended_context *ac;
 215
 216         ac = talloc_get_type(context, struct extended_context);
 217
 218         if (ares->type == LDB_REPLY_ENTRY) {
 219                 /* for each record returned post-process to add any derived
 220                    attributes that have been asked for */
 221                 if (!inject_extended_dn(ares->message, ldb, ac->extended_type, ac->remove_guid, ac->remove_sid)) {
 222                         goto error;
 223                 }
 224         }
 225
 226         return ac->up_callback(ldb, ac->up_context, ares);
 227
 228 error:
 229         talloc_free(ares);
 230         return LDB_ERR_OPERATIONS_ERROR;
 231 }
 232
 233 static int extended_search(struct ldb_module *module, struct ldb_request *req)
 234 {
 235         struct ldb_control *control;
 236         struct ldb_extended_dn_control *extended_ctrl = NULL;
 237         struct ldb_control **saved_controls;
 238         struct extended_context *ac;
 239         struct ldb_request *down_req;
 240         char **new_attrs;
 241         int ret;
 242
 243         /* check if there's an extended dn control */
 244         control = ldb_request_get_control(req, LDB_CONTROL_EXTENDED_DN_OID);
 245         if (control == NULL) {
 246                 /* not found go on */
 247                 return ldb_next_request(module, req);
 248         }
 249
 250         if (control->data) {
 251                 extended_ctrl = talloc_get_type(control->data, struct ldb_extended_dn_control);
 252                 if (!extended_ctrl) {
 253                         return LDB_ERR_PROTOCOL_ERROR;
 254                 }
 255         }
 256
 257         ac = talloc(req, struct extended_context);
 258         if (ac == NULL) {
 259                 return LDB_ERR_OPERATIONS_ERROR;
 260         }
 261
 262         ac->module = module;
 263         ac->up_context = req->context;
 264         ac->up_callback = req->callback;
 265         ac->attrs = req->op.search.attrs;
 266         ac->remove_guid = false;
 267         ac->remove_sid = false;
 268         if (extended_ctrl) {
 269                 ac->extended_type = extended_ctrl->type;
 270         } else {
 271                 ac->extended_type = 0;
 272         }
 273
 274         down_req = talloc_zero(req, struct ldb_request);
 275         if (down_req == NULL) {
 276                 return LDB_ERR_OPERATIONS_ERROR;
 277         }
 278
 279         down_req->operation = req->operation;
 280         down_req->op.search.base = req->op.search.base;
 281         down_req->op.search.scope = req->op.search.scope;
 282         down_req->op.search.tree = req->op.search.tree;
 283
 284         /* check if attrs only is specified, in that case check wether we need to modify them */
 285         if (req->op.search.attrs) {
 286                 if (! is_attr_in_list(req->op.search.attrs, "objectGUID")) {
 287                         ac->remove_guid = true;
 288                 }
 289                 if (! is_attr_in_list(req->op.search.attrs, "objectSID")) {
 290                         ac->remove_sid = true;
 291                 }
 292                 if (ac->remove_guid || ac->remove_sid) {
 293                         new_attrs = copy_attrs(down_req, req->op.search.attrs);
 294                         if (new_attrs == NULL)
 295                                 return LDB_ERR_OPERATIONS_ERROR;
 296
 297                         if (ac->remove_guid) {
 298                                 if (!add_attrs(down_req, &new_attrs, "objectGUID"))
 299                                         return LDB_ERR_OPERATIONS_ERROR;
 300                         }
 301                         if (ac->remove_sid) {
 302                                 if (!add_attrs(down_req, &new_attrs, "objectSID"))
 303                                         return LDB_ERR_OPERATIONS_ERROR;
 304                         }
 305
 306                         down_req->op.search.attrs = (const char * const *)new_attrs;
 307                 }
 308         }
 309
 310         down_req->controls = req->controls;
 311
 312         /* save it locally and remove it from the list */
 313         /* we do not need to replace them later as we
 314          * are keeping the original req intact */
 315         if (!save_controls(control, down_req, &saved_controls)) {
 316                 return LDB_ERR_OPERATIONS_ERROR;
 317         }
 318
 319         down_req->context = ac;
 320         down_req->callback = extended_callback;
 321         ldb_set_timeout_from_prev_req(module->ldb, req, down_req);
 322
 323         /* perform the search */
 324         ret = ldb_next_request(module, down_req);
 325
 326         /* do not free down_req as the call results may be linked to it,
 327          * it will be freed when the upper level request get freed */
 328         if (ret == LDB_SUCCESS) {
 329                 req->handle = down_req->handle;
 330         }
 331
 332         return ret;
 333 }
 334
 335 static int extended_init(struct ldb_module *module)
 336 {
 337         struct ldb_request *req;
 338         int ret;
 339
 340         req = talloc(module, struct ldb_request);
 341         if (req == NULL) {
 342                 return LDB_ERR_OPERATIONS_ERROR;
 343         }
 344
 345         req->operation = LDB_REQ_REGISTER_CONTROL;
 346         req->op.reg_control.oid = LDB_CONTROL_EXTENDED_DN_OID;
 347         req->controls = NULL;
 348
 349         ret = ldb_request(module->ldb, req);
 350         if (ret != LDB_SUCCESS) {
 351                 ldb_debug(module->ldb, LDB_DEBUG_ERROR, "extended_dn: Unable to register control with rootdse!\n");
 352                 talloc_free(req);
 353                 return LDB_ERR_OPERATIONS_ERROR;
 354         }
 355
 356         talloc_free(req);
 357         return ldb_next_init(module);
 358 }
 359
 360 static const struct ldb_module_ops extended_dn_ops = {
 361         .name              = "extended_dn",
 362         .search            = extended_search,
 363         .init_context      = extended_init
 364 };
 365
 366 int ldb_extended_dn_init(void)
 367 {
 368         return ldb_register_module(&extended_dn_ops);
 369 }