source4/ldap_server/ldap_server.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    LDAP server
   4    Copyright (C) Volker Lendecke 2004
   5    Copyright (C) Stefan Metzmacher 2004
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 /*
  25   close the socket and shutdown a server_context
  26 */
  27 static void ldapsrv_terminate_connection(struct ldapsrv_connection *ldap_conn, const char *reason)
  28 {
  29         server_terminate_connection(ldap_conn->connection, reason);
  30 }
  31
  32 /*
  33   add a socket address to the list of events, one event per port
  34 */
  35 static void add_socket(struct server_service *service,
  36                        const struct model_ops *model_ops,
  37                        struct in_addr *ifip)
  38 {
  39         struct server_socket *srv_sock;
  40         uint16_t port = 389;
  41         char *ip_str = talloc_strdup(service, inet_ntoa(*ifip));
  42
  43         srv_sock = service_setup_socket(service, model_ops, ip_str, &port);
  44
  45         port = 3268;
  46         srv_sock = service_setup_socket(service, model_ops, ip_str, &port);
  47
  48         talloc_free(ip_str);
  49 }
  50
  51 /****************************************************************************
  52  Open the socket communication.
  53 ****************************************************************************/
  54 static void ldapsrv_init(struct server_service *service,
  55                          const struct model_ops *model_ops)
  56 {
  57         struct ldapsrv_service *ldap_service;
  58         struct ldapsrv_partition *part;
  59
  60         DEBUG(10,("ldapsrv_init\n"));
  61
  62         ldap_service = talloc_p(service, struct ldapsrv_service);
  63         if (!ldap_service) {
  64                 DEBUG(0,("talloc_p(service, struct ldapsrv_service) failed\n"));
  65                 return;
  66         }
  67         ZERO_STRUCTP(ldap_service);
  68
  69         part = talloc_p(ldap_service, struct ldapsrv_partition);
  70         if (!ldap_service) {
  71                 DEBUG(0,("talloc_p(ldap_service, struct ldapsrv_partition) failed\n"));
  72                 return;
  73         }
  74         part->base_dn = ""; /* RootDSE */
  75         part->ops = ldapsrv_get_rootdse_partition_ops();
  76
  77         ldap_service->rootDSE = part;
  78         DLIST_ADD_END(ldap_service->partitions, part, struct ldapsrv_partition *);
  79
  80         part = talloc_p(ldap_service, struct ldapsrv_partition);
  81         if (!ldap_service) {
  82                 DEBUG(0,("talloc_p(ldap_service, struct ldapsrv_partition) failed\n"));
  83                 return;
  84         }
  85         part->base_dn = "*"; /* default partition */
  86         part->ops = ldapsrv_get_sldb_partition_ops();
  87
  88         ldap_service->default_partition = part;
  89         DLIST_ADD_END(ldap_service->partitions, part, struct ldapsrv_partition *);
  90
  91         service->private_data = ldap_service;
  92
  93         if (lp_interfaces() && lp_bind_interfaces_only()) {
  94                 int num_interfaces = iface_count();
  95                 int i;
  96
  97                 /* We have been given an interfaces line, and been
  98                    told to only bind to those interfaces. Create a
  99                    socket per interface and bind to only these.
 100                 */
 101                 for(i = 0; i < num_interfaces; i++) {
 102                         struct in_addr *ifip = iface_n_ip(i);
 103
 104                         if (ifip == NULL) {
 105                                 DEBUG(0,("ldapsrv_init: interface %d has NULL "
 106                                          "IP address !\n", i));
 107                                 continue;
 108                         }
 109
 110                         add_socket(service, model_ops, ifip);
 111                 }
 112         } else {
 113                 struct in_addr *ifip;
 114
 115                 /* Just bind to lp_socket_address() (usually 0.0.0.0) */
 116                 ifip = interpret_addr2(service, lp_socket_address());
 117                 add_socket(service, model_ops, ifip);
 118
 119                 talloc_destroy(ifip);
 120         }
 121 }
 122
 123 /* This rw-buf api is made to avoid memcpy. For now do that like mad...  The
 124    idea is to write into a circular list of buffers where the ideal case is
 125    that a read(2) holds a complete request that is then thrown away
 126    completely. */
 127
 128 void ldapsrv_consumed_from_buf(struct rw_buffer *buf,
 129                                    size_t length)
 130 {
 131         memcpy(buf->data, buf->data+length, buf->length-length);
 132         buf->length -= length;
 133 }
 134
 135 static void peek_into_read_buf(struct rw_buffer *buf, uint8_t **out,
 136                                size_t *out_length)
 137 {
 138         *out = buf->data;
 139         *out_length = buf->length;
 140 }
 141
 142 BOOL ldapsrv_append_to_buf(struct rw_buffer *buf, uint8_t *data, size_t length)
 143 {
 144         buf->data = realloc(buf->data, buf->length+length);
 145
 146         if (buf->data == NULL)
 147                 return False;
 148
 149         memcpy(buf->data+buf->length, data, length);
 150
 151         buf->length += length;
 152         return True;
 153 }
 154
 155 static BOOL read_into_buf(struct socket_context *sock, struct rw_buffer *buf)
 156 {
 157         NTSTATUS status;
 158         DATA_BLOB tmp_blob;
 159         BOOL ret;
 160
 161         status = socket_recv(sock, sock, &tmp_blob, 1024, 0);
 162         if (!NT_STATUS_IS_OK(status)) {
 163                 DEBUG(10,("socket_recv: %s\n",nt_errstr(status)));
 164                 return False;
 165         }
 166
 167         ret = ldapsrv_append_to_buf(buf, tmp_blob.data, tmp_blob.length);
 168
 169         talloc_free(tmp_blob.data);
 170
 171         return ret;
 172 }
 173
 174 static BOOL ldapsrv_read_buf(struct ldapsrv_connection *conn)
 175 {
 176         NTSTATUS status;
 177         DATA_BLOB tmp_blob;
 178         DATA_BLOB creds;
 179         BOOL ret;
 180         uint8_t *buf;
 181         int buf_length, sasl_length;
 182         struct socket_context *sock = conn->connection->socket;
 183         TALLOC_CTX *mem_ctx;
 184
 185         if (!conn->gensec || !conn->session_info ||
 186            !(gensec_have_feature(conn->gensec, GENSEC_WANT_SIGN) &&
 187              gensec_have_feature(conn->gensec, GENSEC_WANT_SEAL))) {
 188                 return read_into_buf(sock, &conn->in_buffer);
 189         }
 190
 191         mem_ctx = talloc(conn, 0);
 192         if (!mem_ctx) {
 193                 DEBUG(0,("no memory\n"));
 194                 return False;
 195         }
 196
 197         status = socket_recv(sock, mem_ctx, &tmp_blob, 1024, 0);
 198         if (!NT_STATUS_IS_OK(status)) {
 199                 DEBUG(10,("socket_recv: %s\n",nt_errstr(status)));
 200                 talloc_free(mem_ctx);
 201                 return False;
 202         }
 203
 204         ret = ldapsrv_append_to_buf(&conn->sasl_in_buffer, tmp_blob.data, tmp_blob.length);
 205         if (!ret) {
 206                 talloc_free(mem_ctx);
 207                 return False;
 208         }
 209
 210         peek_into_read_buf(&conn->sasl_in_buffer, &buf, &buf_length);
 211
 212         if (buf_length < 4) {
 213                 /* not enough yet */
 214                 talloc_free(mem_ctx);
 215                 return True;
 216         }
 217
 218         sasl_length = RIVAL(buf, 0);
 219
 220         if (buf_length < (4 + sasl_length)) {
 221                 /* not enough yet */
 222                 talloc_free(mem_ctx);
 223                 return True;
 224         }
 225
 226         creds.data = buf + 4;
 227         creds.length = gensec_sig_size(conn->gensec);
 228
 229         if (creds.length > sasl_length) {
 230                 /* invalid packet? */
 231                 talloc_free(mem_ctx);
 232                 return False;
 233         }
 234
 235         tmp_blob.data = buf + (4 + creds.length);
 236         tmp_blob.length = (4 + sasl_length) - (4 + creds.length);
 237
 238         if (gensec_have_feature(conn->gensec, GENSEC_WANT_SEAL)) {
 239                 status = gensec_unseal_packet(conn->gensec, mem_ctx,
 240                                               tmp_blob.data, tmp_blob.length,
 241                                               tmp_blob.data, tmp_blob.length,
 242                                               &creds);
 243                 if (!NT_STATUS_IS_OK(status)) {
 244                         DEBUG(0,("gensec_unseal_packet: %s\n",nt_errstr(status)));
 245                         talloc_free(mem_ctx);
 246                         return False;
 247                 }
 248         } else {
 249                 status = gensec_check_packet(conn->gensec, mem_ctx,
 250                                               tmp_blob.data, tmp_blob.length,
 251                                               tmp_blob.data, tmp_blob.length,
 252                                               &creds);
 253                 if (!NT_STATUS_IS_OK(status)) {
 254                         DEBUG(0,("gensec_check_packet: %s\n",nt_errstr(status)));
 255                         talloc_free(mem_ctx);
 256                         return False;
 257                 }
 258         }
 259
 260         ret = ldapsrv_append_to_buf(&conn->in_buffer, tmp_blob.data, tmp_blob.length);
 261         if (!ret) {
 262                 talloc_free(mem_ctx);
 263                 return False;
 264         }
 265
 266         ldapsrv_consumed_from_buf(&conn->sasl_in_buffer, 4 + sasl_length);
 267
 268         talloc_free(mem_ctx);
 269         return ret;
 270 }
 271
 272 static BOOL write_from_buf(struct socket_context *sock, struct rw_buffer *buf)
 273 {
 274         NTSTATUS status;
 275         DATA_BLOB tmp_blob;
 276         size_t sendlen;
 277
 278         tmp_blob.data = buf->data;
 279         tmp_blob.length = buf->length;
 280
 281         status = socket_send(sock, sock, &tmp_blob, &sendlen, 0);
 282         if (!NT_STATUS_IS_OK(status)) {
 283                 DEBUG(10,("socket_send() %s\n",nt_errstr(status)));
 284                 return False;
 285         }
 286
 287         ldapsrv_consumed_from_buf(buf, sendlen);
 288
 289         return True;
 290 }
 291
 292 static BOOL ldapsrv_write_buf(struct ldapsrv_connection *conn)
 293 {
 294         NTSTATUS status;
 295         DATA_BLOB tmp_blob;
 296         DATA_BLOB creds;
 297         DATA_BLOB sasl;
 298         size_t sendlen;
 299         BOOL ret;
 300         struct socket_context *sock = conn->connection->socket;
 301         TALLOC_CTX *mem_ctx;
 302
 303         if (!conn->gensec || !conn->session_info ||
 304            !(gensec_have_feature(conn->gensec, GENSEC_WANT_SIGN) &&
 305              gensec_have_feature(conn->gensec, GENSEC_WANT_SEAL))) {
 306                 return write_from_buf(sock, &conn->out_buffer);
 307         }
 308
 309         mem_ctx = talloc(conn, 0);
 310         if (!mem_ctx) {
 311                 DEBUG(0,("no memory\n"));
 312                 return False;
 313         }
 314
 315         tmp_blob.data = conn->out_buffer.data;
 316         tmp_blob.length = conn->out_buffer.length;
 317
 318         if (tmp_blob.length == 0) {
 319                 goto nodata;
 320         }
 321
 322         if (gensec_have_feature(conn->gensec, GENSEC_WANT_SEAL)) {
 323                 status = gensec_seal_packet(conn->gensec, mem_ctx,
 324                                             tmp_blob.data, tmp_blob.length,
 325                                             tmp_blob.data, tmp_blob.length,
 326                                             &creds);
 327                 if (!NT_STATUS_IS_OK(status)) {
 328                         DEBUG(0,("gensec_seal_packet: %s\n",nt_errstr(status)));
 329                         talloc_free(mem_ctx);
 330                         return False;
 331                 }
 332         } else {
 333                 status = gensec_sign_packet(conn->gensec, mem_ctx,
 334                                             tmp_blob.data, tmp_blob.length,
 335                                             tmp_blob.data, tmp_blob.length,
 336                                             &creds);
 337                 if (!NT_STATUS_IS_OK(status)) {
 338                         DEBUG(0,("gensec_sign_packet: %s\n",nt_errstr(status)));
 339                         talloc_free(mem_ctx);
 340                         return False;
 341                 }
 342         }
 343
 344         sasl = data_blob_talloc(mem_ctx, NULL, 4 + creds.length + tmp_blob.length);
 345         if (!sasl.data) {
 346                 DEBUG(0,("no memory\n"));
 347                 talloc_free(mem_ctx);
 348                 return False;
 349         }
 350
 351         RSIVAL(sasl.data, 0, creds.length + tmp_blob.length);
 352         memcpy(sasl.data + 4, creds.data, creds.length);
 353         memcpy(sasl.data + 4 + creds.length, tmp_blob.data, tmp_blob.length);
 354
 355         ret = ldapsrv_append_to_buf(&conn->sasl_out_buffer, sasl.data, sasl.length);
 356         if (!ret) {
 357                 talloc_free(mem_ctx);
 358                 return False;
 359         }
 360         ldapsrv_consumed_from_buf(&conn->out_buffer, tmp_blob.length);
 361 nodata:
 362         tmp_blob.data = conn->sasl_out_buffer.data;
 363         tmp_blob.length = conn->sasl_out_buffer.length;
 364
 365         status = socket_send(sock, mem_ctx, &tmp_blob, &sendlen, 0);
 366         if (!NT_STATUS_IS_OK(status)) {
 367                 DEBUG(10,("socket_send() %s\n",nt_errstr(status)));
 368                 talloc_free(mem_ctx);
 369                 return False;
 370         }
 371
 372         ldapsrv_consumed_from_buf(&conn->sasl_out_buffer, sendlen);
 373
 374         talloc_free(mem_ctx);
 375
 376         return True;
 377 }
 378
 379 static BOOL ldap_encode_to_buf(struct ldap_message *msg, struct rw_buffer *buf)
 380 {
 381         DATA_BLOB blob;
 382         BOOL res;
 383
 384         if (!ldap_encode(msg, &blob))
 385                 return False;
 386
 387         res = ldapsrv_append_to_buf(buf, blob.data, blob.length);
 388
 389         data_blob_free(&blob);
 390         return res;
 391 }
 392
 393 NTSTATUS ldapsrv_do_responses(struct ldapsrv_connection *conn)
 394 {
 395         struct ldapsrv_call *call, *next_call = NULL;
 396         struct ldapsrv_reply *reply, *next_reply = NULL;
 397
 398         for (call=conn->calls; call; call=next_call) {
 399                 for (reply=call->replies; reply; reply=next_reply) {
 400                         if (!ldap_encode_to_buf(&reply->msg, &conn->out_buffer)) {
 401                                 return NT_STATUS_FOOBAR;
 402                         }
 403                         next_reply = reply->next;
 404                         DLIST_REMOVE(call->replies, reply);
 405                         reply->state = LDAPSRV_REPLY_STATE_SEND;
 406                         talloc_free(reply);
 407                 }
 408                 next_call = call->next;
 409                 DLIST_REMOVE(conn->calls, call);
 410                 call->state = LDAPSRV_CALL_STATE_COMPLETE;
 411                 talloc_free(call);
 412         }
 413
 414         return NT_STATUS_OK;
 415 }
 416
 417 NTSTATUS ldapsrv_flush_responses(struct ldapsrv_connection *conn)
 418 {
 419         return NT_STATUS_OK;
 420 }
 421
 422 /*
 423   called when a LDAP socket becomes readable
 424 */
 425 static void ldapsrv_recv(struct server_connection *conn, time_t t,
 426                          uint16_t flags)
 427 {
 428         struct ldapsrv_connection *ldap_conn = conn->private_data;
 429         uint8_t *buf;
 430         int buf_length, msg_length;
 431         DATA_BLOB blob;
 432         ASN1_DATA data;
 433         struct ldapsrv_call *call;
 434         NTSTATUS status;
 435
 436         DEBUG(10,("ldapsrv_recv\n"));
 437
 438         if (!ldapsrv_read_buf(ldap_conn)) {
 439                 ldapsrv_terminate_connection(ldap_conn, "ldapsrv_read_buf() failed");
 440                 return;
 441         }
 442
 443         peek_into_read_buf(&ldap_conn->in_buffer, &buf, &buf_length);
 444
 445         while (buf_length > 0) {
 446                 /* LDAP Messages are always SEQUENCES */
 447
 448                 if (!asn1_object_length(buf, buf_length, ASN1_SEQUENCE(0),
 449                                         &msg_length)) {
 450                         ldapsrv_terminate_connection(ldap_conn, "asn1_object_length() failed");
 451                         return;
 452                 }
 453
 454                 if (buf_length < msg_length) {
 455                         /* Not enough yet */
 456                         break;
 457                 }
 458
 459                 /* We've got a complete LDAP request in the in-buffer, convert
 460                  * that to a ldap_message and put it into the incoming
 461                  * queue. */
 462
 463                 blob.data = buf;
 464                 blob.length = msg_length;
 465
 466                 if (!asn1_load(&data, blob)) {
 467                         ldapsrv_terminate_connection(ldap_conn, "asn1_load() failed");
 468                         return;
 469                 }
 470
 471                 call = talloc_p(ldap_conn, struct ldapsrv_call);
 472                 if (!call) {
 473                         ldapsrv_terminate_connection(ldap_conn, "no memory");
 474                         return;
 475                 }
 476
 477                 ZERO_STRUCTP(call);
 478                 call->state = LDAPSRV_CALL_STATE_NEW;
 479                 call->conn = ldap_conn;
 480                 call->request.mem_ctx = call;
 481
 482                 if (!ldap_decode(&data, &call->request)) {
 483                         dump_data(0,buf, msg_length);
 484                         asn1_free(&data);
 485                         ldapsrv_terminate_connection(ldap_conn, "ldap_decode() failed");
 486                         return;
 487                 }
 488
 489                 asn1_free(&data);
 490
 491                 DLIST_ADD_END(ldap_conn->calls, call,
 492                               struct ldapsrv_call *);
 493
 494                 ldapsrv_consumed_from_buf(&ldap_conn->in_buffer, msg_length);
 495
 496                 status = ldapsrv_do_call(call);
 497                 if (!NT_STATUS_IS_OK(status)) {
 498                         ldapsrv_terminate_connection(ldap_conn, "ldapsrv_do_call() failed");
 499                         return;
 500                 }
 501
 502                 peek_into_read_buf(&ldap_conn->in_buffer, &buf, &buf_length);
 503         }
 504
 505         status = ldapsrv_do_responses(ldap_conn);
 506         if (!NT_STATUS_IS_OK(status)) {
 507                 ldapsrv_terminate_connection(ldap_conn, "ldapsrv_do_responses() failed");
 508                 return;
 509         }
 510
 511         if ((ldap_conn->out_buffer.length > 0)||(ldap_conn->sasl_out_buffer.length > 0)) {
 512                 conn->event.fde->flags |= EVENT_FD_WRITE;
 513         }
 514
 515         return;
 516 }
 517
 518 /*
 519   called when a LDAP socket becomes writable
 520 */
 521 static void ldapsrv_send(struct server_connection *conn, time_t t,
 522                          uint16_t flags)
 523 {
 524         struct ldapsrv_connection *ldap_conn = conn->private_data;
 525
 526         DEBUG(10,("ldapsrv_send\n"));
 527
 528         if (!ldapsrv_write_buf(ldap_conn)) {
 529                 ldapsrv_terminate_connection(ldap_conn, "ldapsrv_write_buf() failed");
 530                 return;
 531         }
 532
 533         if (ldap_conn->out_buffer.length == 0 && ldap_conn->sasl_out_buffer.length == 0) {
 534                 conn->event.fde->flags &= ~EVENT_FD_WRITE;
 535         }
 536
 537         return;
 538 }
 539
 540 /*
 541   called when connection is idle
 542 */
 543 static void ldapsrv_idle(struct server_connection *conn, time_t t)
 544 {
 545         DEBUG(10,("ldapsrv_idle: not implemented!\n"));
 546         return;
 547 }
 548
 549 static void ldapsrv_close(struct server_connection *conn, const char *reason)
 550 {
 551         return;
 552 }
 553
 554 /*
 555   initialise a server_context from a open socket and register a event handler
 556   for reading from that socket
 557 */
 558 static void ldapsrv_accept(struct server_connection *conn)
 559 {
 560         struct ldapsrv_connection *ldap_conn;
 561
 562         DEBUG(10, ("ldapsrv_accept\n"));
 563
 564         ldap_conn = talloc_p(conn, struct ldapsrv_connection);
 565
 566         if (ldap_conn == NULL)
 567                 return;
 568
 569         ZERO_STRUCTP(ldap_conn);
 570         ldap_conn->connection = conn;
 571         ldap_conn->service = talloc_reference(ldap_conn, conn->service->private_data);
 572
 573         conn->private_data = ldap_conn;
 574
 575         return;
 576 }
 577
 578 /*
 579   called on a fatal error that should cause this server to terminate
 580 */
 581 static void ldapsrv_exit(struct server_service *service, const char *reason)
 582 {
 583         DEBUG(10,("ldapsrv_exit\n"));
 584         return;
 585 }
 586
 587 static const struct server_service_ops ldap_server_ops = {
 588         .name                   = "ldap",
 589         .service_init           = ldapsrv_init,
 590         .accept_connection      = ldapsrv_accept,
 591         .recv_handler           = ldapsrv_recv,
 592         .send_handler           = ldapsrv_send,
 593         .idle_handler           = ldapsrv_idle,
 594         .close_connection       = ldapsrv_close,
 595         .service_exit           = ldapsrv_exit,
 596 };
 597
 598 const struct server_service_ops *ldapsrv_get_ops(void)
 599 {
 600         return &ldap_server_ops;
 601 }
 602
 603 NTSTATUS server_service_ldap_init(void)
 604 {
 605         return NT_STATUS_OK;
 606 }