s4:provision - Removed dependency on full Samba 3 schema from FDS
[ira/wip.git] / source4 / lib / ldb-samba / ldif_handlers.c
1 /* 
2    ldb database library - ldif handlers for Samba
3
4    Copyright (C) Andrew Tridgell 2005
5    Copyright (C) Andrew Bartlett 2006-2009
6    Copyright (C) Matthias Dieter Wallnöfer 2009
7      ** NOTE! The following LGPL license applies to the ldb
8      ** library. This does NOT imply that all of Samba is released
9      ** under the LGPL
10    
11    This library is free software; you can redistribute it and/or
12    modify it under the terms of the GNU Lesser General Public
13    License as published by the Free Software Foundation; either
14    version 3 of the License, or (at your option) any later version.
15
16    This library is distributed in the hope that it will be useful,
17    but WITHOUT ANY WARRANTY; without even the implied warranty of
18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
19    Lesser General Public License for more details.
20
21    You should have received a copy of the GNU Lesser General Public
22    License along with this library; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "lib/ldb/include/ldb.h"
27 #include "lib/ldb/include/ldb_module.h"
28 #include "ldb_handlers.h"
29 #include "dsdb/samdb/samdb.h"
30 #include "librpc/gen_ndr/ndr_security.h"
31 #include "librpc/gen_ndr/ndr_misc.h"
32 #include "librpc/gen_ndr/ndr_drsblobs.h"
33 #include "librpc/ndr/libndr.h"
34 #include "libcli/security/security.h"
35 #include "param/param.h"
36 #include "../lib/util/asn1.h"
37
38 /*
39   use ndr_print_* to convert a NDR formatted blob to a ldif formatted blob
40 */
41 static int ldif_write_NDR(struct ldb_context *ldb, void *mem_ctx,
42                           const struct ldb_val *in, struct ldb_val *out,
43                           size_t struct_size,
44                           ndr_pull_flags_fn_t pull_fn,
45                           ndr_print_fn_t print_fn)
46 {
47         uint8_t *p;
48         enum ndr_err_code err;
49         if (!(ldb_get_flags(ldb) & LDB_FLG_SHOW_BINARY)) {
50                 return ldb_handler_copy(ldb, mem_ctx, in, out);
51         }
52         p = talloc_size(mem_ctx, struct_size);
53         err = ndr_pull_struct_blob(in, mem_ctx, 
54                                    lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")), 
55                                    p, pull_fn);
56         if (err != NDR_ERR_SUCCESS) {
57                 talloc_free(p);
58                 out->data = (uint8_t *)talloc_strdup(mem_ctx, "<Unable to decode binary data>");
59                 out->length = strlen((const char *)out->data);
60                 return 0;
61         }
62         out->data = (uint8_t *)ndr_print_struct_string(mem_ctx, print_fn, "NDR", p);
63         talloc_free(p);
64         if (out->data == NULL) {
65                 return ldb_handler_copy(ldb, mem_ctx, in, out);         
66         }
67         out->length = strlen((char *)out->data);
68         return 0;
69 }
70
71 /*
72   convert a ldif formatted objectSid to a NDR formatted blob
73 */
74 static int ldif_read_objectSid(struct ldb_context *ldb, void *mem_ctx,
75                                const struct ldb_val *in, struct ldb_val *out)
76 {
77         enum ndr_err_code ndr_err;
78         struct dom_sid *sid;
79         sid = dom_sid_parse_length(mem_ctx, in);
80         if (sid == NULL) {
81                 return -1;
82         }
83         ndr_err = ndr_push_struct_blob(out, mem_ctx, NULL, sid,
84                                        (ndr_push_flags_fn_t)ndr_push_dom_sid);
85         talloc_free(sid);
86         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
87                 return -1;
88         }
89         return 0;
90 }
91
92 /*
93   convert a NDR formatted blob to a ldif formatted objectSid
94 */
95 int ldif_write_objectSid(struct ldb_context *ldb, void *mem_ctx,
96                                 const struct ldb_val *in, struct ldb_val *out)
97 {
98         struct dom_sid *sid;
99         enum ndr_err_code ndr_err;
100
101         sid = talloc(mem_ctx, struct dom_sid);
102         if (sid == NULL) {
103                 return -1;
104         }
105         ndr_err = ndr_pull_struct_blob_all(in, sid, NULL, sid,
106                                            (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
107         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
108                 talloc_free(sid);
109                 return -1;
110         }
111         *out = data_blob_string_const(dom_sid_string(mem_ctx, sid));
112         talloc_free(sid);
113         if (out->data == NULL) {
114                 return -1;
115         }
116         return 0;
117 }
118
119 bool ldif_comparision_objectSid_isString(const struct ldb_val *v)
120 {
121         if (v->length < 3) {
122                 return false;
123         }
124
125         if (strncmp("S-", (const char *)v->data, 2) != 0) return false;
126         
127         return true;
128 }
129
130 /*
131   compare two objectSids
132 */
133 static int ldif_comparison_objectSid(struct ldb_context *ldb, void *mem_ctx,
134                                     const struct ldb_val *v1, const struct ldb_val *v2)
135 {
136         if (ldif_comparision_objectSid_isString(v1) && ldif_comparision_objectSid_isString(v2)) {
137                 return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
138         } else if (ldif_comparision_objectSid_isString(v1)
139                    && !ldif_comparision_objectSid_isString(v2)) {
140                 struct ldb_val v;
141                 int ret;
142                 if (ldif_read_objectSid(ldb, mem_ctx, v1, &v) != 0) {
143                         /* Perhaps not a string after all */
144                         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
145                 }
146                 ret = ldb_comparison_binary(ldb, mem_ctx, &v, v2);
147                 talloc_free(v.data);
148                 return ret;
149         } else if (!ldif_comparision_objectSid_isString(v1)
150                    && ldif_comparision_objectSid_isString(v2)) {
151                 struct ldb_val v;
152                 int ret;
153                 if (ldif_read_objectSid(ldb, mem_ctx, v2, &v) != 0) {
154                         /* Perhaps not a string after all */
155                         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
156                 }
157                 ret = ldb_comparison_binary(ldb, mem_ctx, v1, &v);
158                 talloc_free(v.data);
159                 return ret;
160         }
161         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
162 }
163
164 /*
165   canonicalise a objectSid
166 */
167 static int ldif_canonicalise_objectSid(struct ldb_context *ldb, void *mem_ctx,
168                                       const struct ldb_val *in, struct ldb_val *out)
169 {
170         if (ldif_comparision_objectSid_isString(in)) {
171                 if (ldif_read_objectSid(ldb, mem_ctx, in, out) != 0) {
172                         /* Perhaps not a string after all */
173                         return ldb_handler_copy(ldb, mem_ctx, in, out);
174                 }
175                 return 0;
176         }
177         return ldb_handler_copy(ldb, mem_ctx, in, out);
178 }
179
180 static int extended_dn_read_SID(struct ldb_context *ldb, void *mem_ctx,
181                               const struct ldb_val *in, struct ldb_val *out)
182 {
183         struct dom_sid sid;
184         enum ndr_err_code ndr_err;
185         if (ldif_comparision_objectSid_isString(in)) {
186                 if (ldif_read_objectSid(ldb, mem_ctx, in, out) == 0) {
187                         return 0;
188                 }
189         }
190         
191         /* Perhaps not a string after all */
192         *out = data_blob_talloc(mem_ctx, NULL, in->length/2+1);
193
194         if (!out->data) {
195                 return -1;
196         }
197
198         (*out).length = strhex_to_str((char *)out->data, out->length,
199                                      (const char *)in->data, in->length);
200
201         /* Check it looks like a SID */
202         ndr_err = ndr_pull_struct_blob_all(out, mem_ctx, NULL, &sid,
203                                            (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
204         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
205                 return -1;
206         }
207         return 0;
208 }
209
210 /*
211   convert a ldif formatted objectGUID to a NDR formatted blob
212 */
213 static int ldif_read_objectGUID(struct ldb_context *ldb, void *mem_ctx,
214                                 const struct ldb_val *in, struct ldb_val *out)
215 {
216         struct GUID guid;
217         NTSTATUS status;
218         enum ndr_err_code ndr_err;
219
220         status = GUID_from_data_blob(in, &guid);
221         if (!NT_STATUS_IS_OK(status)) {
222                 return -1;
223         }
224
225         ndr_err = ndr_push_struct_blob(out, mem_ctx, NULL, &guid,
226                                        (ndr_push_flags_fn_t)ndr_push_GUID);
227         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
228                 return -1;
229         }
230         return 0;
231 }
232
233 /*
234   convert a NDR formatted blob to a ldif formatted objectGUID
235 */
236 static int ldif_write_objectGUID(struct ldb_context *ldb, void *mem_ctx,
237                                  const struct ldb_val *in, struct ldb_val *out)
238 {
239         struct GUID guid;
240         enum ndr_err_code ndr_err;
241         ndr_err = ndr_pull_struct_blob_all(in, mem_ctx, NULL, &guid,
242                                            (ndr_pull_flags_fn_t)ndr_pull_GUID);
243         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
244                 return -1;
245         }
246         out->data = (uint8_t *)GUID_string(mem_ctx, &guid);
247         if (out->data == NULL) {
248                 return -1;
249         }
250         out->length = strlen((const char *)out->data);
251         return 0;
252 }
253
254 static bool ldif_comparision_objectGUID_isString(const struct ldb_val *v)
255 {
256         if (v->length != 36 && v->length != 38) return false;
257
258         /* Might be a GUID string, can't be a binary GUID (fixed 16 bytes) */
259         return true;
260 }
261
262 static int extended_dn_read_GUID(struct ldb_context *ldb, void *mem_ctx,
263                               const struct ldb_val *in, struct ldb_val *out)
264 {
265         struct GUID guid;
266         enum ndr_err_code ndr_err;
267         if (in->length == 36 && ldif_read_objectGUID(ldb, mem_ctx, in, out) == 0) {
268                 return 0;
269         }
270
271         /* Try as 'hex' form */
272         if (in->length != 32) {
273                 return -1;
274         }
275                 
276         *out = data_blob_talloc(mem_ctx, NULL, in->length/2+1);
277         
278         if (!out->data) {
279                 return -1;
280         }
281         
282         (*out).length = strhex_to_str((char *)out->data, out->length,
283                                       (const char *)in->data, in->length);
284         
285         /* Check it looks like a GUID */
286         ndr_err = ndr_pull_struct_blob_all(out, mem_ctx, NULL, &guid,
287                                            (ndr_pull_flags_fn_t)ndr_pull_GUID);
288         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
289                 return -1;
290         }
291         return 0;
292 }
293
294 /*
295   compare two objectGUIDs
296 */
297 static int ldif_comparison_objectGUID(struct ldb_context *ldb, void *mem_ctx,
298                                      const struct ldb_val *v1, const struct ldb_val *v2)
299 {
300         if (ldif_comparision_objectGUID_isString(v1) && ldif_comparision_objectGUID_isString(v2)) {
301                 return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
302         } else if (ldif_comparision_objectGUID_isString(v1)
303                    && !ldif_comparision_objectGUID_isString(v2)) {
304                 struct ldb_val v;
305                 int ret;
306                 if (ldif_read_objectGUID(ldb, mem_ctx, v1, &v) != 0) {
307                         /* Perhaps it wasn't a valid string after all */
308                         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
309                 }
310                 ret = ldb_comparison_binary(ldb, mem_ctx, &v, v2);
311                 talloc_free(v.data);
312                 return ret;
313         } else if (!ldif_comparision_objectGUID_isString(v1)
314                    && ldif_comparision_objectGUID_isString(v2)) {
315                 struct ldb_val v;
316                 int ret;
317                 if (ldif_read_objectGUID(ldb, mem_ctx, v2, &v) != 0) {
318                         /* Perhaps it wasn't a valid string after all */
319                         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
320                 }
321                 ret = ldb_comparison_binary(ldb, mem_ctx, v1, &v);
322                 talloc_free(v.data);
323                 return ret;
324         }
325         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
326 }
327
328 /*
329   canonicalise a objectGUID
330 */
331 static int ldif_canonicalise_objectGUID(struct ldb_context *ldb, void *mem_ctx,
332                                        const struct ldb_val *in, struct ldb_val *out)
333 {
334         if (ldif_comparision_objectGUID_isString(in)) {
335                 if (ldif_read_objectGUID(ldb, mem_ctx, in, out) != 0) {
336                         /* Perhaps it wasn't a valid string after all */
337                         return ldb_handler_copy(ldb, mem_ctx, in, out);
338                 }
339                 return 0;
340         }
341         return ldb_handler_copy(ldb, mem_ctx, in, out);
342 }
343
344
345 /*
346   convert a ldif (SDDL) formatted ntSecurityDescriptor to a NDR formatted blob
347 */
348 static int ldif_read_ntSecurityDescriptor(struct ldb_context *ldb, void *mem_ctx,
349                                           const struct ldb_val *in, struct ldb_val *out)
350 {
351         struct security_descriptor *sd;
352         enum ndr_err_code ndr_err;
353
354         sd = talloc(mem_ctx, struct security_descriptor);
355         if (sd == NULL) {
356                 return -1;
357         }
358
359         ndr_err = ndr_pull_struct_blob(in, sd, NULL, sd,
360                                        (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
361         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
362                 /* If this does not parse, then it is probably SDDL, and we should try it that way */
363                 
364                 const struct dom_sid *sid = samdb_domain_sid(ldb);
365                 talloc_free(sd);
366                 sd = sddl_decode(mem_ctx, (const char *)in->data, sid);
367                 if (sd == NULL) {
368                         return -1;
369                 }
370         }
371
372         ndr_err = ndr_push_struct_blob(out, mem_ctx, NULL, sd,
373                                        (ndr_push_flags_fn_t)ndr_push_security_descriptor);
374         talloc_free(sd);
375         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
376                 return -1;
377         }
378
379         return 0;
380 }
381
382 /*
383   convert a NDR formatted blob to a ldif formatted ntSecurityDescriptor (SDDL format)
384 */
385 static int ldif_write_ntSecurityDescriptor(struct ldb_context *ldb, void *mem_ctx,
386                                            const struct ldb_val *in, struct ldb_val *out)
387 {
388         struct security_descriptor *sd;
389         enum ndr_err_code ndr_err;
390
391         if (ldb_get_flags(ldb) & LDB_FLG_SHOW_BINARY) {
392                 return ldif_write_NDR(ldb, mem_ctx, in, out, 
393                                       sizeof(struct security_descriptor),
394                                       (ndr_pull_flags_fn_t)ndr_pull_security_descriptor,
395                                       (ndr_print_fn_t)ndr_print_security_descriptor);
396                                       
397         }
398
399         sd = talloc(mem_ctx, struct security_descriptor);
400         if (sd == NULL) {
401                 return -1;
402         }
403         /* We can't use ndr_pull_struct_blob_all because this contains relative pointers */
404         ndr_err = ndr_pull_struct_blob(in, sd, NULL, sd,
405                                            (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
406         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
407                 talloc_free(sd);
408                 return -1;
409         }
410         out->data = (uint8_t *)sddl_encode(mem_ctx, sd, NULL);
411         talloc_free(sd);
412         if (out->data == NULL) {
413                 return -1;
414         }
415         out->length = strlen((const char *)out->data);
416         return 0;
417 }
418
419 /* 
420    canonicalise an objectCategory.  We use the short form as the cannoical form:
421    cn=Person,cn=Schema,cn=Configuration,<basedn> becomes 'person'
422 */
423
424 static int ldif_canonicalise_objectCategory(struct ldb_context *ldb, void *mem_ctx,
425                                             const struct ldb_val *in, struct ldb_val *out)
426 {
427         struct ldb_dn *dn1 = NULL;
428         const struct dsdb_schema *schema = dsdb_get_schema(ldb);
429         const struct dsdb_class *sclass;
430         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
431         if (!tmp_ctx) {
432                 return LDB_ERR_OPERATIONS_ERROR;
433         }
434
435         if (!schema) {
436                 talloc_free(tmp_ctx);
437                 *out = data_blob_talloc(mem_ctx, in->data, in->length);
438                 if (in->data && !out->data) {
439                         return LDB_ERR_OPERATIONS_ERROR;
440                 }
441                 return LDB_SUCCESS;
442         }
443         dn1 = ldb_dn_from_ldb_val(tmp_ctx, ldb, in);
444         if ( ! ldb_dn_validate(dn1)) {
445                 const char *lDAPDisplayName = talloc_strndup(tmp_ctx, (char *)in->data, in->length);
446                 sclass = dsdb_class_by_lDAPDisplayName(schema, lDAPDisplayName);
447                 if (sclass) {
448                         struct ldb_dn *dn = ldb_dn_new(mem_ctx, ldb,  
449                                                        sclass->defaultObjectCategory);
450                         *out = data_blob_string_const(ldb_dn_alloc_casefold(mem_ctx, dn));
451                         talloc_free(tmp_ctx);
452
453                         if (!out->data) {
454                                 return LDB_ERR_OPERATIONS_ERROR;
455                         }
456                         return LDB_SUCCESS;
457                 } else {
458                         *out = data_blob_talloc(mem_ctx, in->data, in->length);
459                         talloc_free(tmp_ctx);
460
461                         if (in->data && !out->data) {
462                                 return LDB_ERR_OPERATIONS_ERROR;
463                         }
464                         return LDB_SUCCESS;
465                 }
466         }
467         *out = data_blob_string_const(ldb_dn_alloc_casefold(mem_ctx, dn1));
468         talloc_free(tmp_ctx);
469
470         if (!out->data) {
471                 return LDB_ERR_OPERATIONS_ERROR;
472         }
473         return LDB_SUCCESS;
474 }
475
476 static int ldif_comparison_objectCategory(struct ldb_context *ldb, void *mem_ctx,
477                                           const struct ldb_val *v1,
478                                           const struct ldb_val *v2)
479 {
480         return ldb_any_comparison(ldb, mem_ctx, ldif_canonicalise_objectCategory,
481                                   v1, v2);
482 }
483
484 /*
485   convert a ldif formatted prefixMap to a NDR formatted blob
486 */
487 static int ldif_read_prefixMap(struct ldb_context *ldb, void *mem_ctx,
488                                const struct ldb_val *in, struct ldb_val *out)
489 {
490         struct prefixMapBlob *blob;
491         enum ndr_err_code ndr_err;
492         char *string, *line, *p, *oid;
493         DATA_BLOB oid_blob;
494
495         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
496
497         if (tmp_ctx == NULL) {
498                 return -1;
499         }
500
501         blob = talloc_zero(tmp_ctx, struct prefixMapBlob);
502         if (blob == NULL) {
503                 talloc_free(blob);
504                 return -1;
505         }
506
507         blob->version = PREFIX_MAP_VERSION_DSDB;
508         
509         string = talloc_strndup(mem_ctx, (const char *)in->data, in->length);
510         if (string == NULL) {
511                 talloc_free(blob);
512                 return -1;
513         }
514
515         line = string;
516         while (line && line[0]) {
517                 p=strchr(line, ';');
518                 if (p) {
519                         p[0] = '\0';
520                 } else {
521                         p=strchr(line, '\n');
522                         if (p) {
523                                 p[0] = '\0';
524                         }
525                 }
526                 /* allow a traling seperator */
527                 if (line == p) {
528                         break;
529                 }
530                 
531                 blob->ctr.dsdb.mappings = talloc_realloc(blob, 
532                                                          blob->ctr.dsdb.mappings, 
533                                                          struct drsuapi_DsReplicaOIDMapping,
534                                                          blob->ctr.dsdb.num_mappings+1);
535                 if (!blob->ctr.dsdb.mappings) {
536                         talloc_free(tmp_ctx);
537                         return -1;
538                 }
539
540                 blob->ctr.dsdb.mappings[blob->ctr.dsdb.num_mappings].id_prefix = strtoul(line, &oid, 10);
541
542                 if (oid[0] != ':') {
543                         talloc_free(tmp_ctx);
544                         return -1;
545                 }
546
547                 /* we know there must be at least ":" */
548                 oid++;
549
550                 if (!ber_write_partial_OID_String(blob->ctr.dsdb.mappings, &oid_blob, oid)) {
551                         talloc_free(tmp_ctx);
552                         return -1;
553                 }
554                 blob->ctr.dsdb.mappings[blob->ctr.dsdb.num_mappings].oid.length = oid_blob.length;
555                 blob->ctr.dsdb.mappings[blob->ctr.dsdb.num_mappings].oid.binary_oid = oid_blob.data;
556
557                 blob->ctr.dsdb.num_mappings++;
558
559                 /* Now look past the terminator we added above */
560                 if (p) {
561                         line = p + 1;
562                 } else {
563                         line = NULL;
564                 }
565         }
566
567         ndr_err = ndr_push_struct_blob(out, mem_ctx, 
568                                        lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")), 
569                                        blob,
570                                        (ndr_push_flags_fn_t)ndr_push_prefixMapBlob);
571         talloc_free(tmp_ctx);
572         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
573                 return -1;
574         }
575         return 0;
576 }
577
578 /*
579   convert a NDR formatted blob to a ldif formatted prefixMap
580 */
581 static int ldif_write_prefixMap(struct ldb_context *ldb, void *mem_ctx,
582                                 const struct ldb_val *in, struct ldb_val *out)
583 {
584         struct prefixMapBlob *blob;
585         enum ndr_err_code ndr_err;
586         char *string;
587         uint32_t i;
588
589         if (ldb_get_flags(ldb) & LDB_FLG_SHOW_BINARY) {
590                 return ldif_write_NDR(ldb, mem_ctx, in, out, 
591                                       sizeof(struct prefixMapBlob),
592                                       (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob,
593                                       (ndr_print_fn_t)ndr_print_prefixMapBlob);
594                                       
595         }
596
597         blob = talloc(mem_ctx, struct prefixMapBlob);
598         if (blob == NULL) {
599                 return -1;
600         }
601         ndr_err = ndr_pull_struct_blob_all(in, blob, 
602                                            lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")), 
603                                            blob,
604                                            (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob);
605         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
606                 goto failed;
607         }
608         if (blob->version != PREFIX_MAP_VERSION_DSDB) {
609                 goto failed;
610         }
611         string = talloc_strdup(mem_ctx, "");
612         if (string == NULL) {
613                 goto failed;
614         }
615
616         for (i=0; i < blob->ctr.dsdb.num_mappings; i++) {
617                 DATA_BLOB oid_blob;
618                 const char *partial_oid = NULL;
619
620                 if (i > 0) {
621                         string = talloc_asprintf_append(string, ";"); 
622                 }
623
624                 oid_blob = data_blob_const(blob->ctr.dsdb.mappings[i].oid.binary_oid,
625                                            blob->ctr.dsdb.mappings[i].oid.length);
626                 if (!ber_read_partial_OID_String(blob, oid_blob, &partial_oid)) {
627                         DEBUG(0, ("ber_read_partial_OID failed on prefixMap item with id: 0x%X",
628                                   blob->ctr.dsdb.mappings[i].id_prefix));
629                         goto failed;
630                 }
631                 string = talloc_asprintf_append(string, "%u:%s", 
632                                                    blob->ctr.dsdb.mappings[i].id_prefix,
633                                                    partial_oid);
634                 talloc_free(discard_const(partial_oid));
635                 if (string == NULL) {
636                         goto failed;
637                 }
638         }
639
640         talloc_free(blob);
641         *out = data_blob_string_const(string);
642         return 0;
643
644 failed:
645         talloc_free(blob);
646         return -1;
647 }
648
649 static bool ldif_comparision_prefixMap_isString(const struct ldb_val *v)
650 {
651         if (v->length < 4) {
652                 return true;
653         }
654
655         if (IVAL(v->data, 0) == PREFIX_MAP_VERSION_DSDB) {
656                 return false;
657         }
658         
659         return true;
660 }
661
662 /*
663   canonicalise a prefixMap
664 */
665 static int ldif_canonicalise_prefixMap(struct ldb_context *ldb, void *mem_ctx,
666                                        const struct ldb_val *in, struct ldb_val *out)
667 {
668         if (ldif_comparision_prefixMap_isString(in)) {
669                 return ldif_read_prefixMap(ldb, mem_ctx, in, out);
670         }
671         return ldb_handler_copy(ldb, mem_ctx, in, out);
672 }
673
674 static int ldif_comparison_prefixMap(struct ldb_context *ldb, void *mem_ctx,
675                                      const struct ldb_val *v1,
676                                      const struct ldb_val *v2)
677 {
678         return ldb_any_comparison(ldb, mem_ctx, ldif_canonicalise_prefixMap,
679                                   v1, v2);
680 }
681
682 /* Canonicalisation of two 32-bit integers */
683 static int ldif_canonicalise_int32(struct ldb_context *ldb, void *mem_ctx,
684                         const struct ldb_val *in, struct ldb_val *out)
685 {
686         char *end;
687         /* We've to use "strtoll" here to have the intended overflows.
688          * Otherwise we may get "LONG_MAX" and the conversion is wrong. */
689         int32_t i = (int32_t) strtoll((char *)in->data, &end, 0);
690         if (*end != 0) {
691                 return -1;
692         }
693         out->data = (uint8_t *) talloc_asprintf(mem_ctx, "%d", i);
694         if (out->data == NULL) {
695                 return -1;
696         }
697         out->length = strlen((char *)out->data);
698         return 0;
699 }
700
701 /* Comparison of two 32-bit integers */
702 static int ldif_comparison_int32(struct ldb_context *ldb, void *mem_ctx,
703                         const struct ldb_val *v1, const struct ldb_val *v2)
704 {
705         /* We've to use "strtoll" here to have the intended overflows.
706          * Otherwise we may get "LONG_MAX" and the conversion is wrong. */
707         return (int32_t) strtoll((char *)v1->data, NULL, 0)
708          - (int32_t) strtoll((char *)v2->data, NULL, 0);
709 }
710
711 /*
712   convert a NDR formatted blob to a ldif formatted repsFromTo
713 */
714 static int ldif_write_repsFromTo(struct ldb_context *ldb, void *mem_ctx,
715                                  const struct ldb_val *in, struct ldb_val *out)
716 {
717         return ldif_write_NDR(ldb, mem_ctx, in, out, 
718                               sizeof(struct repsFromToBlob),
719                               (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob,
720                               (ndr_print_fn_t)ndr_print_repsFromToBlob);
721 }
722
723 /*
724   convert a NDR formatted blob to a ldif formatted replPropertyMetaData
725 */
726 static int ldif_write_replPropertyMetaData(struct ldb_context *ldb, void *mem_ctx,
727                                            const struct ldb_val *in, struct ldb_val *out)
728 {
729         return ldif_write_NDR(ldb, mem_ctx, in, out, 
730                               sizeof(struct replPropertyMetaDataBlob),
731                               (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob,
732                               (ndr_print_fn_t)ndr_print_replPropertyMetaDataBlob);
733 }
734
735 /*
736   convert a NDR formatted blob to a ldif formatted replUpToDateVector
737 */
738 static int ldif_write_replUpToDateVector(struct ldb_context *ldb, void *mem_ctx,
739                                          const struct ldb_val *in, struct ldb_val *out)
740 {
741         return ldif_write_NDR(ldb, mem_ctx, in, out, 
742                               sizeof(struct replUpToDateVectorBlob),
743                               (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob,
744                               (ndr_print_fn_t)ndr_print_replUpToDateVectorBlob);
745 }
746
747
748 static int extended_dn_write_hex(struct ldb_context *ldb, void *mem_ctx,
749                                  const struct ldb_val *in, struct ldb_val *out)
750 {
751         *out = data_blob_string_const(data_blob_hex_string_lower(mem_ctx, in));
752         if (!out->data) {
753                 return -1;
754         }
755         return 0;
756 }
757
758 static const struct ldb_schema_syntax samba_syntaxes[] = {
759         {
760                 .name             = LDB_SYNTAX_SAMBA_SID,
761                 .ldif_read_fn     = ldif_read_objectSid,
762                 .ldif_write_fn    = ldif_write_objectSid,
763                 .canonicalise_fn  = ldif_canonicalise_objectSid,
764                 .comparison_fn    = ldif_comparison_objectSid
765         },{
766                 .name             = LDB_SYNTAX_SAMBA_SECURITY_DESCRIPTOR,
767                 .ldif_read_fn     = ldif_read_ntSecurityDescriptor,
768                 .ldif_write_fn    = ldif_write_ntSecurityDescriptor,
769                 .canonicalise_fn  = ldb_handler_copy,
770                 .comparison_fn    = ldb_comparison_binary
771         },{
772                 .name             = LDB_SYNTAX_SAMBA_GUID,
773                 .ldif_read_fn     = ldif_read_objectGUID,
774                 .ldif_write_fn    = ldif_write_objectGUID,
775                 .canonicalise_fn  = ldif_canonicalise_objectGUID,
776                 .comparison_fn    = ldif_comparison_objectGUID
777         },{
778                 .name             = LDB_SYNTAX_SAMBA_OBJECT_CATEGORY,
779                 .ldif_read_fn     = ldb_handler_copy,
780                 .ldif_write_fn    = ldb_handler_copy,
781                 .canonicalise_fn  = ldif_canonicalise_objectCategory,
782                 .comparison_fn    = ldif_comparison_objectCategory
783         },{
784                 .name             = LDB_SYNTAX_SAMBA_PREFIX_MAP,
785                 .ldif_read_fn     = ldif_read_prefixMap,
786                 .ldif_write_fn    = ldif_write_prefixMap,
787                 .canonicalise_fn  = ldif_canonicalise_prefixMap,
788                 .comparison_fn    = ldif_comparison_prefixMap
789         },{
790                 .name             = LDB_SYNTAX_SAMBA_INT32,
791                 .ldif_read_fn     = ldb_handler_copy,
792                 .ldif_write_fn    = ldb_handler_copy,
793                 .canonicalise_fn  = ldif_canonicalise_int32,
794                 .comparison_fn    = ldif_comparison_int32
795         },{
796                 .name             = LDB_SYNTAX_SAMBA_REPSFROMTO,
797                 .ldif_read_fn     = ldb_handler_copy,
798                 .ldif_write_fn    = ldif_write_repsFromTo,
799                 .canonicalise_fn  = ldb_handler_copy,
800                 .comparison_fn    = ldb_comparison_binary
801         },{
802                 .name             = LDB_SYNTAX_SAMBA_REPLPROPERTYMETADATA,
803                 .ldif_read_fn     = ldb_handler_copy,
804                 .ldif_write_fn    = ldif_write_replPropertyMetaData,
805                 .canonicalise_fn  = ldb_handler_copy,
806                 .comparison_fn    = ldb_comparison_binary
807         },{
808                 .name             = LDB_SYNTAX_SAMBA_REPLUPTODATEVECTOR,
809                 .ldif_read_fn     = ldb_handler_copy,
810                 .ldif_write_fn    = ldif_write_replUpToDateVector,
811                 .canonicalise_fn  = ldb_handler_copy,
812                 .comparison_fn    = ldb_comparison_binary
813         },{
814                 .name             = DSDB_SYNTAX_BINARY_DN,
815                 .ldif_read_fn     = ldb_handler_copy,
816                 .ldif_write_fn    = ldb_handler_copy,
817                 .canonicalise_fn  = dsdb_dn_binary_canonicalise,
818                 .comparison_fn    = dsdb_dn_binary_comparison
819         },{
820                 .name             = DSDB_SYNTAX_STRING_DN,
821                 .ldif_read_fn     = ldb_handler_copy,
822                 .ldif_write_fn    = ldb_handler_copy,
823                 .canonicalise_fn  = dsdb_dn_string_canonicalise,
824                 .comparison_fn    = dsdb_dn_string_comparison
825         },
826 };
827
828 static const struct ldb_dn_extended_syntax samba_dn_syntax[] = {
829         {
830                 .name             = "SID",
831                 .read_fn          = extended_dn_read_SID,
832                 .write_clear_fn   = ldif_write_objectSid,
833                 .write_hex_fn     = extended_dn_write_hex
834         },{
835                 .name             = "GUID",
836                 .read_fn          = extended_dn_read_GUID,
837                 .write_clear_fn   = ldif_write_objectGUID,
838                 .write_hex_fn     = extended_dn_write_hex
839         },{
840                 .name             = "WKGUID",
841                 .read_fn          = ldb_handler_copy,
842                 .write_clear_fn   = ldb_handler_copy,
843                 .write_hex_fn     = ldb_handler_copy
844         }
845 };
846
847 /* TODO: Should be dynamic at some point */
848 static const struct {
849         const char *name;
850         const char *syntax;
851 } samba_attributes[] = {
852         { "objectSid",                  LDB_SYNTAX_SAMBA_SID },
853         { "securityIdentifier",         LDB_SYNTAX_SAMBA_SID },
854         { "ntSecurityDescriptor",       LDB_SYNTAX_SAMBA_SECURITY_DESCRIPTOR },
855         { "objectGUID",                 LDB_SYNTAX_SAMBA_GUID },
856         { "invocationId",               LDB_SYNTAX_SAMBA_GUID },
857         { "schemaIDGUID",               LDB_SYNTAX_SAMBA_GUID },
858         { "oMSyntax",                   LDB_SYNTAX_SAMBA_INT32 },
859         { "attributeSecurityGUID",      LDB_SYNTAX_SAMBA_GUID },
860         { "parentGUID",                 LDB_SYNTAX_SAMBA_GUID },
861         { "siteGUID",                   LDB_SYNTAX_SAMBA_GUID },
862         { "pKTGUID",                    LDB_SYNTAX_SAMBA_GUID },
863         { "fRSVersionGUID",             LDB_SYNTAX_SAMBA_GUID },
864         { "fRSReplicaSetGUID",          LDB_SYNTAX_SAMBA_GUID },
865         { "netbootGUID",                LDB_SYNTAX_SAMBA_GUID },
866         { "objectCategory",             LDB_SYNTAX_SAMBA_OBJECT_CATEGORY },
867         { "prefixMap",                  LDB_SYNTAX_SAMBA_PREFIX_MAP },
868         { "repsFrom",                   LDB_SYNTAX_SAMBA_REPSFROMTO },
869         { "repsTo",                     LDB_SYNTAX_SAMBA_REPSFROMTO },
870         { "replPropertyMetaData",       LDB_SYNTAX_SAMBA_REPLPROPERTYMETADATA },
871         { "replUpToDateVector",         LDB_SYNTAX_SAMBA_REPLUPTODATEVECTOR },
872 };
873
874 const struct ldb_schema_syntax *ldb_samba_syntax_by_name(struct ldb_context *ldb, const char *name)
875 {
876         uint32_t j;
877         const struct ldb_schema_syntax *s = NULL;
878         
879         for (j=0; j < ARRAY_SIZE(samba_syntaxes); j++) {
880                 if (strcmp(name, samba_syntaxes[j].name) == 0) {
881                         s = &samba_syntaxes[j];
882                         break;
883                 }
884         }
885         return s;
886 }
887
888 const struct ldb_schema_syntax *ldb_samba_syntax_by_lDAPDisplayName(struct ldb_context *ldb, const char *name)
889 {
890         uint32_t j;
891         const struct ldb_schema_syntax *s = NULL;
892
893         for (j=0; j < ARRAY_SIZE(samba_attributes); j++) {
894                 if (strcmp(samba_attributes[j].name, name) == 0) {
895                         s = ldb_samba_syntax_by_name(ldb, samba_attributes[j].syntax);
896                         break;
897                 }
898         }
899         
900         return s;
901 }
902
903 /*
904   register the samba ldif handlers
905 */
906 int ldb_register_samba_handlers(struct ldb_context *ldb)
907 {
908         uint32_t i;
909
910         for (i=0; i < ARRAY_SIZE(samba_attributes); i++) {
911                 int ret;
912                 const struct ldb_schema_syntax *s = NULL;
913
914                 s = ldb_samba_syntax_by_name(ldb, samba_attributes[i].syntax);
915
916                 if (!s) {
917                         s = ldb_standard_syntax_by_name(ldb, samba_attributes[i].syntax);
918                 }
919
920                 if (!s) {
921                         return -1;
922                 }
923
924                 ret = ldb_schema_attribute_add_with_syntax(ldb, samba_attributes[i].name, LDB_ATTR_FLAG_FIXED, s);
925                 if (ret != LDB_SUCCESS) {
926                         return ret;
927                 }
928         }
929
930         for (i=0; i < ARRAY_SIZE(samba_dn_syntax); i++) {
931                 int ret;
932                 ret = ldb_dn_extended_add_syntax(ldb, LDB_ATTR_FLAG_FIXED, &samba_dn_syntax[i]);
933                 if (ret != LDB_SUCCESS) {
934                         return ret;
935                 }
936
937                 
938         }
939
940         return LDB_SUCCESS;
941 }