source3/lib/ldb/samba/ldif_handlers.c

   1 /*
   2    ldb database library - ldif handlers for Samba
   3
   4    Copyright (C) Andrew Tridgell 2005
   5    Copyright (C) Andrew Bartlett 2006
   6      ** NOTE! The following LGPL license applies to the ldb
   7      ** library. This does NOT imply that all of Samba is released
   8      ** under the LGPL
   9
  10    This library is free software; you can redistribute it and/or
  11    modify it under the terms of the GNU Lesser General Public
  12    License as published by the Free Software Foundation; either
  13    version 2 of the License, or (at your option) any later version.
  14
  15    This library is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18    Lesser General Public License for more details.
  19
  20    You should have received a copy of the GNU Lesser General Public
  21    License along with this library; if not, write to the Free Software
  22    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  23 */
  24
  25 #include "includes.h"
  26 #include "ldb/include/includes.h"
  27
  28 #include "librpc/gen_ndr/ndr_security.h"
  29 #include "librpc/gen_ndr/ndr_misc.h"
  30 #include "dsdb/samdb/samdb.h"
  31 #include "libcli/security/security.h"
  32
  33 /*
  34   convert a ldif formatted objectSid to a NDR formatted blob
  35 */
  36 static int ldif_read_objectSid(struct ldb_context *ldb, void *mem_ctx,
  37                                const struct ldb_val *in, struct ldb_val *out)
  38 {
  39         struct dom_sid *sid;
  40         NTSTATUS status;
  41         sid = dom_sid_parse_talloc(mem_ctx, (const char *)in->data);
  42         if (sid == NULL) {
  43                 return -1;
  44         }
  45         status = ndr_push_struct_blob(out, mem_ctx, sid,
  46                                       (ndr_push_flags_fn_t)ndr_push_dom_sid);
  47         talloc_free(sid);
  48         if (!NT_STATUS_IS_OK(status)) {
  49                 return -1;
  50         }
  51         return 0;
  52 }
  53
  54 /*
  55   convert a NDR formatted blob to a ldif formatted objectSid
  56 */
  57 static int ldif_write_objectSid(struct ldb_context *ldb, void *mem_ctx,
  58                                 const struct ldb_val *in, struct ldb_val *out)
  59 {
  60         struct dom_sid *sid;
  61         NTSTATUS status;
  62         sid = talloc(mem_ctx, struct dom_sid);
  63         if (sid == NULL) {
  64                 return -1;
  65         }
  66         status = ndr_pull_struct_blob(in, sid, sid,
  67                                       (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
  68         if (!NT_STATUS_IS_OK(status)) {
  69                 talloc_free(sid);
  70                 return -1;
  71         }
  72         out->data = (uint8_t *)dom_sid_string(mem_ctx, sid);
  73         talloc_free(sid);
  74         if (out->data == NULL) {
  75                 return -1;
  76         }
  77         out->length = strlen((const char *)out->data);
  78         return 0;
  79 }
  80
  81 static BOOL ldb_comparision_objectSid_isString(const struct ldb_val *v)
  82 {
  83         /* see if the input if null-terninated */
  84         if (v->data[v->length] != '\0') return False;
  85
  86         if (strncmp("S-", (const char *)v->data, 2) != 0) return False;
  87         return True;
  88 }
  89
  90 /*
  91   compare two objectSids
  92 */
  93 static int ldb_comparison_objectSid(struct ldb_context *ldb, void *mem_ctx,
  94                                     const struct ldb_val *v1, const struct ldb_val *v2)
  95 {
  96         if (ldb_comparision_objectSid_isString(v1) && ldb_comparision_objectSid_isString(v2)) {
  97                 return strcmp((const char *)v1->data, (const char *)v2->data);
  98         } else if (ldb_comparision_objectSid_isString(v1)
  99                    && !ldb_comparision_objectSid_isString(v2)) {
 100                 struct ldb_val v;
 101                 int ret;
 102                 if (ldif_read_objectSid(ldb, mem_ctx, v1, &v) != 0) {
 103                         return -1;
 104                 }
 105                 ret = ldb_comparison_binary(ldb, mem_ctx, &v, v2);
 106                 talloc_free(v.data);
 107                 return ret;
 108         } else if (!ldb_comparision_objectSid_isString(v1)
 109                    && ldb_comparision_objectSid_isString(v2)) {
 110                 struct ldb_val v;
 111                 int ret;
 112                 if (ldif_read_objectSid(ldb, mem_ctx, v2, &v) != 0) {
 113                         return -1;
 114                 }
 115                 ret = ldb_comparison_binary(ldb, mem_ctx, v1, &v);
 116                 talloc_free(v.data);
 117                 return ret;
 118         }
 119         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
 120 }
 121
 122 /*
 123   canonicalise a objectSid
 124 */
 125 static int ldb_canonicalise_objectSid(struct ldb_context *ldb, void *mem_ctx,
 126                                       const struct ldb_val *in, struct ldb_val *out)
 127 {
 128         if (ldb_comparision_objectSid_isString(in)) {
 129                 return ldif_read_objectSid(ldb, mem_ctx, in, out);
 130         }
 131         return ldb_handler_copy(ldb, mem_ctx, in, out);
 132 }
 133
 134 /*
 135   convert a ldif formatted objectGUID to a NDR formatted blob
 136 */
 137 static int ldif_read_objectGUID(struct ldb_context *ldb, void *mem_ctx,
 138                                 const struct ldb_val *in, struct ldb_val *out)
 139 {
 140         struct GUID guid;
 141         NTSTATUS status;
 142
 143         status = GUID_from_string((const char *)in->data, &guid);
 144         if (!NT_STATUS_IS_OK(status)) {
 145                 return -1;
 146         }
 147
 148         status = ndr_push_struct_blob(out, mem_ctx, &guid,
 149                                       (ndr_push_flags_fn_t)ndr_push_GUID);
 150         if (!NT_STATUS_IS_OK(status)) {
 151                 return -1;
 152         }
 153         return 0;
 154 }
 155
 156 /*
 157   convert a NDR formatted blob to a ldif formatted objectGUID
 158 */
 159 static int ldif_write_objectGUID(struct ldb_context *ldb, void *mem_ctx,
 160                                  const struct ldb_val *in, struct ldb_val *out)
 161 {
 162         struct GUID guid;
 163         NTSTATUS status;
 164         status = ndr_pull_struct_blob(in, mem_ctx, &guid,
 165                                       (ndr_pull_flags_fn_t)ndr_pull_GUID);
 166         if (!NT_STATUS_IS_OK(status)) {
 167                 return -1;
 168         }
 169         out->data = (uint8_t *)GUID_string(mem_ctx, &guid);
 170         if (out->data == NULL) {
 171                 return -1;
 172         }
 173         out->length = strlen((const char *)out->data);
 174         return 0;
 175 }
 176
 177 static BOOL ldb_comparision_objectGUID_isString(const struct ldb_val *v)
 178 {
 179         struct GUID guid;
 180         NTSTATUS status;
 181
 182         /* see if the input if null-terninated */
 183         if (v->data[v->length] != '\0') return False;
 184
 185         if (v->length < 33) return False;
 186
 187         status = GUID_from_string((const char *)v->data, &guid);
 188         if (!NT_STATUS_IS_OK(status)) {
 189                 return False;
 190         }
 191
 192         return True;
 193 }
 194
 195 /*
 196   compare two objectGUIDs
 197 */
 198 static int ldb_comparison_objectGUID(struct ldb_context *ldb, void *mem_ctx,
 199                                      const struct ldb_val *v1, const struct ldb_val *v2)
 200 {
 201         if (ldb_comparision_objectGUID_isString(v1) && ldb_comparision_objectGUID_isString(v2)) {
 202                 return strcmp((const char *)v1->data, (const char *)v2->data);
 203         } else if (ldb_comparision_objectGUID_isString(v1)
 204                    && !ldb_comparision_objectGUID_isString(v2)) {
 205                 struct ldb_val v;
 206                 int ret;
 207                 if (ldif_read_objectGUID(ldb, mem_ctx, v1, &v) != 0) {
 208                         return -1;
 209                 }
 210                 ret = ldb_comparison_binary(ldb, mem_ctx, &v, v2);
 211                 talloc_free(v.data);
 212                 return ret;
 213         } else if (!ldb_comparision_objectGUID_isString(v1)
 214                    && ldb_comparision_objectGUID_isString(v2)) {
 215                 struct ldb_val v;
 216                 int ret;
 217                 if (ldif_read_objectGUID(ldb, mem_ctx, v2, &v) != 0) {
 218                         return -1;
 219                 }
 220                 ret = ldb_comparison_binary(ldb, mem_ctx, v1, &v);
 221                 talloc_free(v.data);
 222                 return ret;
 223         }
 224         return ldb_comparison_binary(ldb, mem_ctx, v1, v2);
 225 }
 226
 227 /*
 228   canonicalise a objectGUID
 229 */
 230 static int ldb_canonicalise_objectGUID(struct ldb_context *ldb, void *mem_ctx,
 231                                        const struct ldb_val *in, struct ldb_val *out)
 232 {
 233         if (ldb_comparision_objectGUID_isString(in)) {
 234                 return ldif_read_objectGUID(ldb, mem_ctx, in, out);
 235         }
 236         return ldb_handler_copy(ldb, mem_ctx, in, out);
 237 }
 238
 239
 240 /*
 241   convert a ldif (SDDL) formatted ntSecurityDescriptor to a NDR formatted blob
 242 */
 243 static int ldif_read_ntSecurityDescriptor(struct ldb_context *ldb, void *mem_ctx,
 244                                           const struct ldb_val *in, struct ldb_val *out)
 245 {
 246         struct security_descriptor *sd;
 247         NTSTATUS status;
 248
 249         sd = sddl_decode(mem_ctx, (const char *)in->data, NULL);
 250         if (sd == NULL) {
 251                 return -1;
 252         }
 253         status = ndr_push_struct_blob(out, mem_ctx, sd,
 254                                       (ndr_push_flags_fn_t)ndr_push_security_descriptor);
 255         talloc_free(sd);
 256         if (!NT_STATUS_IS_OK(status)) {
 257                 return -1;
 258         }
 259         return 0;
 260 }
 261
 262 /*
 263   convert a NDR formatted blob to a ldif formatted ntSecurityDescriptor (SDDL format)
 264 */
 265 static int ldif_write_ntSecurityDescriptor(struct ldb_context *ldb, void *mem_ctx,
 266                                            const struct ldb_val *in, struct ldb_val *out)
 267 {
 268         struct security_descriptor *sd;
 269         NTSTATUS status;
 270
 271         sd = talloc(mem_ctx, struct security_descriptor);
 272         if (sd == NULL) {
 273                 return -1;
 274         }
 275         status = ndr_pull_struct_blob(in, sd, sd,
 276                                       (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
 277         if (!NT_STATUS_IS_OK(status)) {
 278                 talloc_free(sd);
 279                 return -1;
 280         }
 281         out->data = (uint8_t *)sddl_encode(mem_ctx, sd, NULL);
 282         talloc_free(sd);
 283         if (out->data == NULL) {
 284                 return -1;
 285         }
 286         out->length = strlen((const char *)out->data);
 287         return 0;
 288 }
 289
 290 /*
 291    canonicolise an objectCategory.  We use the short form as the cannoical form:
 292    cn=Person,cn=Schema,cn=Configuration,<basedn> becomes 'person'
 293 */
 294
 295 static int ldif_canonicalise_objectCategory(struct ldb_context *ldb, void *mem_ctx,
 296                                             const struct ldb_val *in, struct ldb_val *out)
 297 {
 298         struct ldb_dn *dn1 = NULL;
 299         char *oc1;
 300
 301         dn1 = ldb_dn_explode(mem_ctx, (char *)in->data);
 302         if (dn1 == NULL) {
 303                 oc1 = talloc_strndup(mem_ctx, (char *)in->data, in->length);
 304         } else if (dn1->comp_num >= 1 && strcasecmp(dn1->components[0].name, "cn") == 0) {
 305                 oc1 = talloc_strndup(mem_ctx, (char *)dn1->components[0].value.data,
 306                                      dn1->components[0].value.length);
 307         } else {
 308                 return -1;
 309         }
 310
 311         oc1 = ldb_casefold(ldb, mem_ctx, oc1);
 312         out->data = (void *)oc1;
 313         out->length = strlen(oc1);
 314         return 0;
 315 }
 316
 317 static int ldif_comparison_objectCategory(struct ldb_context *ldb, void *mem_ctx,
 318                                           const struct ldb_val *v1,
 319                                           const struct ldb_val *v2)
 320 {
 321         struct ldb_dn *dn1 = NULL, *dn2 = NULL;
 322         const char *oc1, *oc2;
 323
 324         dn1 = ldb_dn_explode(mem_ctx, (char *)v1->data);
 325         if (dn1 == NULL) {
 326                 oc1 = talloc_strndup(mem_ctx, (char *)v1->data, v1->length);
 327         } else if (dn1->comp_num >= 1 && strcasecmp(dn1->components[0].name, "cn") == 0) {
 328                 oc1 = talloc_strndup(mem_ctx, (char *)dn1->components[0].value.data,
 329                                      dn1->components[0].value.length);
 330         } else {
 331                 oc1 = NULL;
 332         }
 333
 334         dn2 = ldb_dn_explode(mem_ctx, (char *)v2->data);
 335         if (dn2 == NULL) {
 336                 oc2 = talloc_strndup(mem_ctx, (char *)v2->data, v2->length);
 337         } else if (dn2->comp_num >= 2 && strcasecmp(dn2->components[0].name, "cn") == 0) {
 338                 oc2 = talloc_strndup(mem_ctx, (char *)dn2->components[0].value.data,
 339                                      dn2->components[0].value.length);
 340         } else {
 341                 oc2 = NULL;
 342         }
 343
 344         oc1 = ldb_casefold(ldb, mem_ctx, oc1);
 345         oc2 = ldb_casefold(ldb, mem_ctx, oc2);
 346         if (!oc1 && oc2) {
 347                 return -1;
 348         }
 349         if (oc1 && !oc2) {
 350                 return 1;
 351         }
 352         if (!oc1 && !oc2) {
 353                 return -1;
 354         }
 355
 356         return strcmp(oc1, oc2);
 357 }
 358
 359 static const struct ldb_attrib_handler samba_handlers[] = {
 360         {
 361                 .attr            = "objectSid",
 362                 .flags           = 0,
 363                 .ldif_read_fn    = ldif_read_objectSid,
 364                 .ldif_write_fn   = ldif_write_objectSid,
 365                 .canonicalise_fn = ldb_canonicalise_objectSid,
 366                 .comparison_fn   = ldb_comparison_objectSid
 367         },
 368         {
 369                 .attr            = "securityIdentifier",
 370                 .flags           = 0,
 371                 .ldif_read_fn    = ldif_read_objectSid,
 372                 .ldif_write_fn   = ldif_write_objectSid,
 373                 .canonicalise_fn = ldb_canonicalise_objectSid,
 374                 .comparison_fn   = ldb_comparison_objectSid
 375         },
 376         {
 377                 .attr            = "ntSecurityDescriptor",
 378                 .flags           = 0,
 379                 .ldif_read_fn    = ldif_read_ntSecurityDescriptor,
 380                 .ldif_write_fn   = ldif_write_ntSecurityDescriptor,
 381                 .canonicalise_fn = ldb_handler_copy,
 382                 .comparison_fn   = ldb_comparison_binary
 383         },
 384         {
 385                 .attr            = "objectGUID",
 386                 .flags           = 0,
 387                 .ldif_read_fn    = ldif_read_objectGUID,
 388                 .ldif_write_fn   = ldif_write_objectGUID,
 389                 .canonicalise_fn = ldb_canonicalise_objectGUID,
 390                 .comparison_fn   = ldb_comparison_objectGUID
 391         },
 392         {
 393                 .attr            = "invocationId",
 394                 .flags           = 0,
 395                 .ldif_read_fn    = ldif_read_objectGUID,
 396                 .ldif_write_fn   = ldif_write_objectGUID,
 397                 .canonicalise_fn = ldb_canonicalise_objectGUID,
 398                 .comparison_fn   = ldb_comparison_objectGUID
 399         },
 400         {
 401                 .attr            = "schemaIDGUID",
 402                 .flags           = 0,
 403                 .ldif_read_fn    = ldif_read_objectGUID,
 404                 .ldif_write_fn   = ldif_write_objectGUID,
 405                 .canonicalise_fn = ldb_canonicalise_objectGUID,
 406                 .comparison_fn   = ldb_comparison_objectGUID
 407         },
 408         {
 409                 .attr            = "attributeSecurityGUID",
 410                 .flags           = 0,
 411                 .ldif_read_fn    = ldif_read_objectGUID,
 412                 .ldif_write_fn   = ldif_write_objectGUID,
 413                 .canonicalise_fn = ldb_canonicalise_objectGUID,
 414                 .comparison_fn   = ldb_comparison_objectGUID
 415         },
 416         {
 417                 .attr            = "parentGUID",
 418                 .flags           = 0,
 419                 .ldif_read_fn    = ldif_read_objectGUID,
 420                 .ldif_write_fn   = ldif_write_objectGUID,
 421                 .canonicalise_fn = ldb_canonicalise_objectGUID,
 422                 .comparison_fn   = ldb_comparison_objectGUID
 423         },
 424         {
 425                 .attr            = "siteGUID",
 426                 .flags           = 0,
 427                 .ldif_read_fn    = ldif_read_objectGUID,
 428                 .ldif_write_fn   = ldif_write_objectGUID,
 429                 .canonicalise_fn = ldb_canonicalise_objectGUID,
 430                 .comparison_fn   = ldb_comparison_objectGUID
 431         },
 432         {
 433                 .attr            = "pKTGUID",
 434                 .flags           = 0,
 435                 .ldif_read_fn    = ldif_read_objectGUID,
 436                 .ldif_write_fn   = ldif_write_objectGUID,
 437                 .canonicalise_fn = ldb_canonicalise_objectGUID,
 438                 .comparison_fn   = ldb_comparison_objectGUID
 439         },
 440         {
 441                 .attr            = "fRSVersionGUID",
 442                 .flags           = 0,
 443                 .ldif_read_fn    = ldif_read_objectGUID,
 444                 .ldif_write_fn   = ldif_write_objectGUID,
 445                 .canonicalise_fn = ldb_canonicalise_objectGUID,
 446                 .comparison_fn   = ldb_comparison_objectGUID
 447         },
 448         {
 449                 .attr            = "fRSReplicaSetGUID",
 450                 .flags           = 0,
 451                 .ldif_read_fn    = ldif_read_objectGUID,
 452                 .ldif_write_fn   = ldif_write_objectGUID,
 453                 .canonicalise_fn = ldb_canonicalise_objectGUID,
 454                 .comparison_fn   = ldb_comparison_objectGUID
 455         },
 456         {
 457                 .attr            = "netbootGUID",
 458                 .flags           = 0,
 459                 .ldif_read_fn    = ldif_read_objectGUID,
 460                 .ldif_write_fn   = ldif_write_objectGUID,
 461                 .canonicalise_fn = ldb_canonicalise_objectGUID,
 462                 .comparison_fn   = ldb_comparison_objectGUID
 463         },
 464         {
 465                 .attr            = "objectCategory",
 466                 .flags           = 0,
 467                 .ldif_read_fn    = ldb_handler_copy,
 468                 .ldif_write_fn   = ldb_handler_copy,
 469                 .canonicalise_fn = ldif_canonicalise_objectCategory,
 470                 .comparison_fn   = ldif_comparison_objectCategory,
 471         }
 472 };
 473
 474 /*
 475   register the samba ldif handlers
 476 */
 477 int ldb_register_samba_handlers(struct ldb_context *ldb)
 478 {
 479         return ldb_set_attrib_handlers(ldb, samba_handlers, ARRAY_SIZE(samba_handlers));
 480 }