#include "includes.h"
#include "lib/events/events.h"
#include "auth/auth.h"
-#include "dlinklist.h"
-#include "asn_1.h"
+#include "auth/credentials/credentials.h"
+#include "librpc/gen_ndr/ndr_samr.h"
+#include "lib/util/dlinklist.h"
+#include "libcli/util/asn_1.h"
#include "ldap_server/ldap_server.h"
#include "smbd/service_task.h"
#include "smbd/service_stream.h"
-#include "lib/socket/socket.h"
+#include "smbd/service.h"
+#include "smbd/process_model.h"
#include "lib/tls/tls.h"
+#include "lib/messaging/irpc.h"
+#include "lib/ldb/include/ldb.h"
+#include "lib/ldb/include/ldb_errors.h"
+#include "system/network.h"
+#include "lib/socket/netif.h"
/*
close the socket and shutdown a server_context
*/
-static void ldapsrv_terminate_connection(struct ldapsrv_connection *conn,
+void ldapsrv_terminate_connection(struct ldapsrv_connection *conn,
const char *reason)
{
- talloc_free(conn->tls);
- conn->tls = NULL;
stream_terminate_connection(conn->connection, reason);
}
+/*
+ handle packet errors
+*/
+static void ldapsrv_error_handler(void *private, NTSTATUS status)
+{
+ struct ldapsrv_connection *conn = talloc_get_type(private,
+ struct ldapsrv_connection);
+ ldapsrv_terminate_connection(conn, nt_errstr(status));
+}
+
/*
process a decoded ldap message
*/
struct ldapsrv_call *call;
NTSTATUS status;
DATA_BLOB blob;
- struct ldapsrv_send *q;
- BOOL enable_wrap = conn->enable_wrap;
call = talloc(conn, struct ldapsrv_call);
if (!call) {
call->request = talloc_steal(call, msg);
call->conn = conn;
call->replies = NULL;
-
+ call->send_callback = NULL;
+ call->send_private = NULL;
+
/* make the call */
status = ldapsrv_do_call(call);
if (!NT_STATUS_IS_OK(status)) {
- goto failed;
+ talloc_free(call);
+ return;
}
blob = data_blob(NULL, 0);
DATA_BLOB b;
msg = call->replies->msg;
- if (!ldap_encode(msg, &b)) {
+ if (!ldap_encode(msg, &b, call)) {
DEBUG(0,("Failed to encode ldap reply of type %d\n", msg->type));
- goto failed;
+ talloc_free(call);
+ return;
}
status = data_blob_append(call, &blob, b.data, b.length);
- if (!NT_STATUS_IS_OK(status)) goto failed;
-
- DLIST_REMOVE(call->replies, call->replies);
- }
+ data_blob_free(&b);
- /* possibly encrypt/sign the reply */
- if (enable_wrap) {
- DATA_BLOB wrapped;
+ talloc_set_name_const(blob.data, "Outgoing, encoded LDAP packet");
- status = gensec_wrap(conn->gensec, call, &blob, &wrapped);
if (!NT_STATUS_IS_OK(status)) {
- goto failed;
- }
- data_blob_free(&blob);
- blob = data_blob_talloc(call, NULL, wrapped.length + 4);
- if (q->data.data == NULL) {
- goto failed;
+ talloc_free(call);
+ return;
}
- RSIVAL(blob.data, 0, wrapped.length);
- memcpy(blob.data+4, wrapped.data, wrapped.length);
- data_blob_free(&wrapped);
- }
- q = talloc(conn, struct ldapsrv_send);
- if (q == NULL) goto failed;
-
- q->data = blob;
- talloc_steal(q, blob.data);
-
- if (conn->send_queue == NULL) {
- EVENT_FD_WRITEABLE(conn->connection->event.fde);
+ DLIST_REMOVE(call->replies, call->replies);
}
- DLIST_ADD_END(conn->send_queue, q, struct ldapsrv_send *);
- talloc_free(call);
- return;
-failed:
+ packet_send_callback(conn->packet, blob,
+ call->send_callback, call->send_private);
talloc_free(call);
+ return;
}
-
/*
- try and decode the partial input buffer
+ decode/process data
*/
-static void ldapsrv_try_decode_plain(struct ldapsrv_connection *conn)
+static NTSTATUS ldapsrv_decode(void *private, DATA_BLOB blob)
{
+ struct ldapsrv_connection *conn = talloc_get_type(private,
+ struct ldapsrv_connection);
struct asn1_data asn1;
+ struct ldap_message *msg = talloc(conn, struct ldap_message);
- if (!asn1_load(&asn1, conn->partial)) {
- ldapsrv_terminate_connection(conn, "out of memory");
- return;
+ if (msg == NULL) {
+ return NT_STATUS_NO_MEMORY;
}
- /* try and decode - this will fail if we don't have a full packet yet */
- while (asn1.ofs < asn1.length) {
- struct ldap_message *msg = talloc(conn, struct ldap_message);
- off_t saved_ofs = asn1.ofs;
-
- if (msg == NULL) {
- ldapsrv_terminate_connection(conn, "out of memory");
- return;
- }
-
- if (ldap_decode(&asn1, msg)) {
- ldapsrv_process_message(conn, msg);
- } else {
- if (asn1.ofs < asn1.length) {
- ldapsrv_terminate_connection(conn, "ldap_decode failed");
- return;
- }
- asn1.ofs = saved_ofs;
- talloc_free(msg);
- break;
- }
+ if (!asn1_load(&asn1, blob)) {
+ return NT_STATUS_NO_MEMORY;
}
- /* keep any remaining data in conn->partial */
- data_blob_free(&conn->partial);
- if (asn1.ofs != asn1.length) {
- conn->partial = data_blob_talloc(conn,
- asn1.data + asn1.ofs,
- asn1.length - asn1.ofs);
+ if (!ldap_decode(&asn1, msg)) {
+ asn1_free(&asn1);
+ return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
}
+
+ data_blob_free(&blob);
+ ldapsrv_process_message(conn, msg);
asn1_free(&asn1);
+ return NT_STATUS_OK;
}
-
/*
- try and decode/process wrapped data
+ Idle timeout handler
*/
-static void ldapsrv_try_decode_wrapped(struct ldapsrv_connection *conn)
+static void ldapsrv_conn_idle_timeout(struct event_context *ev,
+ struct timed_event *te,
+ struct timeval t,
+ void *private)
{
- uint32_t len;
-
- /* keep decoding while we have a full wrapped packet */
- while (conn->partial.length >= 4 &&
- (len=RIVAL(conn->partial.data, 0)) <= conn->partial.length-4) {
- DATA_BLOB wrapped, unwrapped;
- struct asn1_data asn1;
- struct ldap_message *msg = talloc(conn, struct ldap_message);
- NTSTATUS status;
-
- if (msg == NULL) {
- ldapsrv_terminate_connection(conn, "out of memory");
- return;
- }
+ struct ldapsrv_connection *conn = talloc_get_type(private, struct ldapsrv_connection);
- wrapped.data = conn->partial.data+4;
- wrapped.length = len;
+ ldapsrv_terminate_connection(conn, "Timeout. No requests after bind");
+}
- status = gensec_unwrap(conn->gensec, msg, &wrapped, &unwrapped);
- if (!NT_STATUS_IS_OK(status)) {
- ldapsrv_terminate_connection(conn, "gensec unwrap failed");
- return;
- }
+/*
+ called when a LDAP socket becomes readable
+*/
+void ldapsrv_recv(struct stream_connection *c, uint16_t flags)
+{
+ struct ldapsrv_connection *conn =
+ talloc_get_type(c->private, struct ldapsrv_connection);
- if (!asn1_load(&asn1, unwrapped)) {
- ldapsrv_terminate_connection(conn, "out of memory");
- return;
- }
+ if (conn->limits.ite) { /* clean initial timeout if any */
+ talloc_free(conn->limits.ite);
+ conn->limits.ite = NULL;
+ }
- while (ldap_decode(&asn1, msg)) {
- ldapsrv_process_message(conn, msg);
- msg = talloc(conn, struct ldap_message);
- }
+ if (conn->limits.te) { /* clean idle timeout if any */
+ talloc_free(conn->limits.te);
+ conn->limits.te = NULL;
+ }
- if (asn1.ofs < asn1.length) {
- ldapsrv_terminate_connection(conn, "ldap_decode failed");
- return;
- }
-
- talloc_free(msg);
- asn1_free(&asn1);
+ packet_recv(conn->packet);
- if (conn->partial.length == len + 4) {
- data_blob_free(&conn->partial);
- } else {
- memmove(conn->partial.data, conn->partial.data+len+4,
- conn->partial.length - (len+4));
- conn->partial.length -= len + 4;
- }
- }
+ /* set idle timeout */
+ conn->limits.te = event_add_timed(c->event.ctx, conn,
+ timeval_current_ofs(conn->limits.conn_idle_time, 0),
+ ldapsrv_conn_idle_timeout, conn);
}
-
/*
- called when a LDAP socket becomes readable
+ called when a LDAP socket becomes writable
*/
-static void ldapsrv_recv(struct stream_connection *c, uint16_t flags)
+static void ldapsrv_send(struct stream_connection *c, uint16_t flags)
{
struct ldapsrv_connection *conn =
talloc_get_type(c->private, struct ldapsrv_connection);
- NTSTATUS status;
- size_t npending, nread;
+
+ packet_queue_run(conn->packet);
+}
- if (conn->processing) {
- EVENT_FD_NOT_READABLE(c->event.fde);
- return;
- }
+static void ldapsrv_conn_init_timeout(struct event_context *ev,
+ struct timed_event *te,
+ struct timeval t,
+ void *private)
+{
+ struct ldapsrv_connection *conn = talloc_get_type(private, struct ldapsrv_connection);
- /* work out how much data is pending */
- status = tls_socket_pending(conn->tls, &npending);
- if (!NT_STATUS_IS_OK(status)) {
- ldapsrv_terminate_connection(conn, "socket_pening() failed");
- return;
+ ldapsrv_terminate_connection(conn, "Timeout. No requests after initial connection");
+}
+
+static int ldapsrv_load_limits(struct ldapsrv_connection *conn)
+{
+ TALLOC_CTX *tmp_ctx;
+ const char *attrs[] = { "configurationNamingContext", NULL };
+ const char *attrs2[] = { "lDAPAdminLimits", NULL };
+ struct ldb_message_element *el;
+ struct ldb_result *res = NULL;
+ struct ldb_dn *basedn;
+ struct ldb_dn *conf_dn;
+ struct ldb_dn *policy_dn;
+ int i,ret;
+
+ /* set defaults limits in case of failure */
+ conn->limits.initial_timeout = 120;
+ conn->limits.conn_idle_time = 900;
+ conn->limits.max_page_size = 1000;
+ conn->limits.search_timeout = 120;
+
+
+ tmp_ctx = talloc_new(conn);
+ if (tmp_ctx == NULL) {
+ return -1;
}
- if (npending == 0) {
- ldapsrv_terminate_connection(conn, "EOF from client");
- return;
+
+ basedn = ldb_dn_new(tmp_ctx, conn->ldb, NULL);
+ if ( ! ldb_dn_validate(basedn)) {
+ goto failed;
}
- conn->partial.data = talloc_realloc_size(conn, conn->partial.data,
- conn->partial.length + npending);
- if (conn->partial.data == NULL) {
- ldapsrv_terminate_connection(conn, "out of memory");
- return;
+ ret = ldb_search(conn->ldb, basedn, LDB_SCOPE_BASE, NULL, attrs, &res);
+ talloc_steal(tmp_ctx, res);
+ if (ret != LDB_SUCCESS || res->count != 1) {
+ goto failed;
}
- /* receive the data */
- status = tls_socket_recv(conn->tls, conn->partial.data + conn->partial.length,
- npending, &nread);
- if (NT_STATUS_IS_ERR(status)) {
- ldapsrv_terminate_connection(conn, "socket_recv() failed");
- return;
+ conf_dn = ldb_msg_find_attr_as_dn(conn->ldb, tmp_ctx, res->msgs[0], "configurationNamingContext");
+ if (conf_dn == NULL) {
+ goto failed;
}
- if (!NT_STATUS_IS_OK(status)) {
- return;
+
+ policy_dn = ldb_dn_copy(tmp_ctx, conf_dn);
+ ldb_dn_add_child_fmt(policy_dn, "CN=Default Query Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services");
+ if (policy_dn == NULL) {
+ goto failed;
}
- if (nread == 0) {
- ldapsrv_terminate_connection(conn, "EOF from client");
- return;
+
+ ret = ldb_search(conn->ldb, policy_dn, LDB_SCOPE_BASE, NULL, attrs2, &res);
+ talloc_steal(tmp_ctx, res);
+ if (ret != LDB_SUCCESS || res->count != 1) {
+ goto failed;
}
- conn->partial.length += nread;
- conn->processing = True;
- /* see if we can decode what we have */
- if (conn->enable_wrap) {
- ldapsrv_try_decode_wrapped(conn);
- } else {
- ldapsrv_try_decode_plain(conn);
+ el = ldb_msg_find_element(res->msgs[0], "lDAPAdminLimits");
+ if (el == NULL) {
+ goto failed;
}
- conn->processing = False;
- EVENT_FD_READABLE(c->event.fde);
-}
-
-/*
- called when a LDAP socket becomes writable
-*/
-static void ldapsrv_send(struct stream_connection *c, uint16_t flags)
-{
- struct ldapsrv_connection *conn =
- talloc_get_type(c->private, struct ldapsrv_connection);
- while (conn->send_queue) {
- struct ldapsrv_send *q = conn->send_queue;
- size_t nsent;
- NTSTATUS status;
-
- status = tls_socket_send(conn->tls, &q->data, &nsent);
- if (NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
- break;
+ for (i = 0; i < el->num_values; i++) {
+ char policy_name[256];
+ int policy_value, s;
+
+ s = sscanf((const char *)el->values[i].data, "%255[^=]=%d", policy_name, &policy_value);
+ if (ret != 2 || policy_value == 0)
+ continue;
+
+ if (strcasecmp("InitRecvTimeout", policy_name) == 0) {
+ conn->limits.initial_timeout = policy_value;
+ continue;
}
- if (!NT_STATUS_IS_OK(status)) {
- ldapsrv_terminate_connection(conn, "socket_send error");
- return;
+ if (strcasecmp("MaxConnIdleTime", policy_name) == 0) {
+ conn->limits.conn_idle_time = policy_value;
+ continue;
}
-
- q->data.data += nsent;
- q->data.length -= nsent;
- if (q->data.length == 0) {
- DLIST_REMOVE(conn->send_queue, q);
+ if (strcasecmp("MaxPageSize", policy_name) == 0) {
+ conn->limits.max_page_size = policy_value;
+ continue;
+ }
+ if (strcasecmp("MaxQueryDuration", policy_name) == 0) {
+ conn->limits.search_timeout = policy_value;
+ continue;
}
}
- if (conn->send_queue == NULL) {
- EVENT_FD_NOT_WRITEABLE(c->event.fde);
- }
+
+ return 0;
+
+failed:
+ DEBUG(0, ("Failed to load ldap server query policies\n"));
+ talloc_free(tmp_ctx);
+ return -1;
}
/*
struct ldapsrv_service *ldapsrv_service =
talloc_get_type(c->private, struct ldapsrv_service);
struct ldapsrv_connection *conn;
+ struct cli_credentials *server_credentials;
+ struct socket_address *socket_address;
+ NTSTATUS status;
int port;
conn = talloc_zero(c, struct ldapsrv_connection);
- if (conn == NULL) goto failed;
+ if (!conn) {
+ stream_terminate_connection(c, "ldapsrv_accept: out of memory");
+ return;
+ }
- conn->enable_wrap = False;
- conn->partial = data_blob(NULL, 0);
- conn->send_queue = NULL;
+ conn->packet = NULL;
conn->connection = c;
- conn->service = talloc_get_type(c->private, struct ldapsrv_service);
- conn->processing = False;
+ conn->service = ldapsrv_service;
+ conn->sockets.raw = c->socket;
+
c->private = conn;
- port = socket_get_my_port(c->socket);
+ socket_address = socket_get_my_addr(c->socket, conn);
+ if (!socket_address) {
+ ldapsrv_terminate_connection(conn, "ldapsrv_accept: failed to obtain local socket address!");
+ return;
+ }
+ port = socket_address->port;
+ talloc_free(socket_address);
+
+ if (port == 636) {
+ struct socket_context *tls_socket = tls_init_server(ldapsrv_service->tls_params, c->socket,
+ c->event.fde, NULL);
+ if (!tls_socket) {
+ ldapsrv_terminate_connection(conn, "ldapsrv_accept: tls_init_server() failed");
+ return;
+ }
+ talloc_unlink(c, c->socket);
+ talloc_steal(c, tls_socket);
+ c->socket = tls_socket;
+ conn->sockets.tls = tls_socket;
- /* note that '0' is a ASN1_SEQUENCE(0), which is the first byte on
- any ldap connection */
- conn->tls = tls_init_server(ldapsrv_service->tls_params, c->socket,
- c->event.fde, NULL, port != 389);
- if (conn->tls == NULL) goto failed;
+ } else if (port == 3268) /* Global catalog */ {
+ conn->global_catalog = True;
+ }
+ conn->packet = packet_init(conn);
+ if (conn->packet == NULL) {
+ ldapsrv_terminate_connection(conn, "out of memory");
+ return;
+ }
- return;
+ packet_set_private(conn->packet, conn);
+ packet_set_socket(conn->packet, c->socket);
+ packet_set_callback(conn->packet, ldapsrv_decode);
+ packet_set_full_request(conn->packet, ldap_full_packet);
+ packet_set_error_handler(conn->packet, ldapsrv_error_handler);
+ packet_set_event_context(conn->packet, c->event.ctx);
+ packet_set_fde(conn->packet, c->event.fde);
+ packet_set_serialise(conn->packet);
+
+ /* Ensure we don't get packets until the database is ready below */
+ packet_recv_disable(conn->packet);
+
+ server_credentials
+ = cli_credentials_init(conn);
+ if (!server_credentials) {
+ stream_terminate_connection(c, "Failed to init server credentials\n");
+ return;
+ }
+
+ cli_credentials_set_conf(server_credentials);
+ status = cli_credentials_set_machine_account(server_credentials);
+ if (!NT_STATUS_IS_OK(status)) {
+ stream_terminate_connection(c, talloc_asprintf(conn, "Failed to obtain server credentials, perhaps a standalone server?: %s\n", nt_errstr(status)));
+ return;
+ }
+ conn->server_credentials = server_credentials;
+
+ /* Connections start out anonymous */
+ if (!NT_STATUS_IS_OK(auth_anonymous_session_info(conn, &conn->session_info))) {
+ ldapsrv_terminate_connection(conn, "failed to setup anonymous session info");
+ return;
+ }
+
+ if (!NT_STATUS_IS_OK(ldapsrv_backend_Init(conn))) {
+ ldapsrv_terminate_connection(conn, "backend Init failed");
+ return;
+ }
+
+ /* load limits from the conf partition */
+ ldapsrv_load_limits(conn); /* should we fail on error ? */
+
+ /* register the server */
+ irpc_add_name(c->msg_ctx, "ldap_server");
+
+ /* set connections limits */
+ conn->limits.ite = event_add_timed(c->event.ctx, conn,
+ timeval_current_ofs(conn->limits.initial_timeout, 0),
+ ldapsrv_conn_init_timeout, conn);
+
+ packet_recv_enable(conn->packet);
-failed:
- talloc_free(c);
}
static const struct stream_server_ops ldap_stream_ops = {
}
}
+ /* if we are a PDC, then also enable the global catalog server port, 3268 */
+ if (lp_server_role() == ROLE_DOMAIN_PDC) {
+ port = 3268;
+ status = stream_setup_socket(event_context, model_ops, &ldap_stream_ops,
+ "ipv4", address, &port, ldap_service);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
+ address, port, nt_errstr(status)));
+ }
+ }
+
return status;
}
static void ldapsrv_task_init(struct task_server *task)
{
struct ldapsrv_service *ldap_service;
- struct ldapsrv_partition *rootDSE_part;
- struct ldapsrv_partition *part;
NTSTATUS status;
+ const struct model_ops *model_ops;
+
+ task_server_set_title(task, "task[ldapsrv]");
+
+ /* run the ldap server as a single process */
+ model_ops = process_model_byname("single");
+ if (!model_ops) goto failed;
ldap_service = talloc_zero(task, struct ldapsrv_service);
if (ldap_service == NULL) goto failed;
ldap_service->tls_params = tls_initialise(ldap_service);
if (ldap_service->tls_params == NULL) goto failed;
- rootDSE_part = talloc(ldap_service, struct ldapsrv_partition);
- if (rootDSE_part == NULL) goto failed;
-
- rootDSE_part->base_dn = ""; /* RootDSE */
- rootDSE_part->ops = ldapsrv_get_rootdse_partition_ops();
-
- ldap_service->rootDSE = rootDSE_part;
- DLIST_ADD_END(ldap_service->partitions, rootDSE_part, struct ldapsrv_partition *);
-
- part = talloc(ldap_service, struct ldapsrv_partition);
- if (part == NULL) goto failed;
-
- part->base_dn = "*"; /* default partition */
- if (lp_parm_bool(-1, "ldapsrv", "hacked", False)) {
- part->ops = ldapsrv_get_hldb_partition_ops();
- } else {
- part->ops = ldapsrv_get_sldb_partition_ops();
- }
-
- ldap_service->default_partition = part;
- DLIST_ADD_END(ldap_service->partitions, part, struct ldapsrv_partition *);
-
if (lp_interfaces() && lp_bind_interfaces_only()) {
int num_interfaces = iface_count();
int i;
*/
for(i = 0; i < num_interfaces; i++) {
const char *address = iface_n_ip(i);
- status = add_socket(task->event_ctx, task->model_ops, address, ldap_service);
+ status = add_socket(task->event_ctx, model_ops, address, ldap_service);
if (!NT_STATUS_IS_OK(status)) goto failed;
}
} else {
- status = add_socket(task->event_ctx, task->model_ops, lp_socket_address(), ldap_service);
+ status = add_socket(task->event_ctx, model_ops, lp_socket_address(), ldap_service);
if (!NT_STATUS_IS_OK(status)) goto failed;
}
return;
failed:
- task_terminate(task, "Failed to startup ldap server task");
+ task_server_terminate(task, "Failed to startup ldap server task");
}
/*
git.samba.org / jelmer / samba4-debian.git / blobdiff