This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "cldap_server/cldap_server.h"
#include "system/network.h"
#include "lib/socket/netif.h"
+#include "lib/ldb/include/ldb.h"
+#include "lib/ldb/include/ldb_errors.h"
+#include "dsdb/samdb/samdb.h"
+#include "ldb_wrap.h"
+#include "auth/auth.h"
+#include "param/param.h"
/*
handle incoming cldap requests
if (ldap_msg->type != LDAP_TAG_SearchRequest) {
DEBUG(0,("Invalid CLDAP request type %d from %s:%d\n",
ldap_msg->type, src->addr, src->port));
+ cldap_error_reply(cldap, ldap_msg->messageid, src,
+ LDAP_OPERATIONS_ERROR, "Invalid CLDAP request");
return;
}
search = &ldap_msg->r.SearchRequest;
+ if (strcmp("", search->basedn) != 0) {
+ DEBUG(0,("Invalid CLDAP basedn '%s' from %s:%d\n",
+ search->basedn, src->addr, src->port));
+ cldap_error_reply(cldap, ldap_msg->messageid, src,
+ LDAP_OPERATIONS_ERROR, "Invalid CLDAP basedn");
+ return;
+ }
+
+ if (search->scope != LDAP_SEARCH_SCOPE_BASE) {
+ DEBUG(0,("Invalid CLDAP scope %d from %s:%d\n",
+ search->scope, src->addr, src->port));
+ cldap_error_reply(cldap, ldap_msg->messageid, src,
+ LDAP_OPERATIONS_ERROR, "Invalid CLDAP scope");
+ return;
+ }
+
if (search->num_attributes == 1 &&
strcasecmp(search->attributes[0], "netlogon") == 0) {
cldapd_netlogon_request(cldap, ldap_msg->messageid,
search->tree, src);
- } else {
- DEBUG(0,("Unknown CLDAP search for '%s'\n",
- ldb_filter_from_tree(ldap_msg,
- ldap_msg->r.SearchRequest.tree)));
- cldap_empty_reply(cldap, ldap_msg->messageid, src);
+ return;
}
+
+ cldapd_rootdse_request(cldap, ldap_msg->messageid,
+ search, src);
}
/*
start listening on the given address
*/
-static NTSTATUS cldapd_add_socket(struct cldapd_server *cldapd, const char *address)
+static NTSTATUS cldapd_add_socket(struct cldapd_server *cldapd, struct loadparm_context *lp_ctx,
+ const char *address)
{
struct cldap_socket *cldapsock;
struct socket_address *socket_address;
NT_STATUS_HAVE_NO_MEMORY(cldapsock);
socket_address = socket_address_from_strings(cldapsock, cldapsock->sock->backend_name,
- address, lp_cldap_port());
+ address, lp_cldap_port(lp_ctx));
if (!socket_address) {
talloc_free(cldapsock);
return NT_STATUS_NO_MEMORY;
status = socket_listen(cldapsock->sock, socket_address, 0, 0);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(0,("Failed to bind to %s:%d - %s\n",
- address, lp_cldap_port(), nt_errstr(status)));
+ address, lp_cldap_port(lp_ctx), nt_errstr(status)));
talloc_free(cldapsock);
return status;
}
/*
setup our listening sockets on the configured network interfaces
*/
-static NTSTATUS cldapd_startup_interfaces(struct cldapd_server *cldapd)
+static NTSTATUS cldapd_startup_interfaces(struct cldapd_server *cldapd, struct loadparm_context *lp_ctx,
+ struct interface *ifaces)
{
- int num_interfaces = iface_count();
+ int num_interfaces;
TALLOC_CTX *tmp_ctx = talloc_new(cldapd);
NTSTATUS status;
+ num_interfaces = iface_count(ifaces);
+
/* if we are allowing incoming packets from any address, then
we need to bind to the wildcard address */
- if (!lp_bind_interfaces_only()) {
- status = cldapd_add_socket(cldapd, "0.0.0.0");
+ if (!lp_bind_interfaces_only(lp_ctx)) {
+ status = cldapd_add_socket(cldapd, lp_ctx, "0.0.0.0");
NT_STATUS_NOT_OK_RETURN(status);
} else {
int i;
for (i=0; i<num_interfaces; i++) {
- const char *address = talloc_strdup(tmp_ctx, iface_n_ip(i));
- status = cldapd_add_socket(cldapd, address);
+ const char *address = talloc_strdup(tmp_ctx, iface_n_ip(ifaces, i));
+ status = cldapd_add_socket(cldapd, lp_ctx, address);
NT_STATUS_NOT_OK_RETURN(status);
}
}
{
struct cldapd_server *cldapd;
NTSTATUS status;
+ struct interface *ifaces;
+
+ load_interfaces(task, lp_interfaces(task->lp_ctx), &ifaces);
- if (iface_count() == 0) {
+ if (iface_count(ifaces) == 0) {
task_server_terminate(task, "cldapd: no network interfaces configured");
return;
}
+ switch (lp_server_role(task->lp_ctx)) {
+ case ROLE_STANDALONE:
+ task_server_terminate(task, "cldap_server: no CLDAP server required in standalone configuration");
+ return;
+ case ROLE_DOMAIN_MEMBER:
+ task_server_terminate(task, "cldap_server: no CLDAP server required in member server configuration");
+ return;
+ case ROLE_DOMAIN_CONTROLLER:
+ /* Yes, we want an CLDAP server */
+ break;
+ }
+
task_server_set_title(task, "task[cldapd]");
cldapd = talloc(task, struct cldapd_server);
}
cldapd->task = task;
- cldapd->samctx = NULL;
+ cldapd->samctx = samdb_connect(cldapd, task->lp_ctx, anonymous_session(cldapd, task->lp_ctx));
+ if (cldapd->samctx == NULL) {
+ task_server_terminate(task, "cldapd failed to open samdb");
+ return;
+ }
/* start listening on the configured network interfaces */
- status = cldapd_startup_interfaces(cldapd);
+ status = cldapd_startup_interfaces(cldapd, task->lp_ctx, ifaces);
if (!NT_STATUS_IS_OK(status)) {
task_server_terminate(task, "cldapd failed to setup interfaces");
return;
/*
initialise the cldapd server
*/
-static NTSTATUS cldapd_init(struct event_context *event_ctx, const struct model_ops *model_ops)
+static NTSTATUS cldapd_init(struct event_context *event_ctx, struct loadparm_context *lp_ctx, const struct model_ops *model_ops)
{
- return task_server_startup(event_ctx, model_ops, cldapd_task_init);
+ return task_server_startup(event_ctx, lp_ctx, "cldap", model_ops, cldapd_task_init);
}
git.samba.org / ira / wip.git / blobdiff