source4/ldap_server/ldap_bind.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    LDAP server
   4    Copyright (C) Stefan Metzmacher 2004
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "ldap_server/ldap_server.h"
  22 #include "auth/auth.h"
  23 #include "smbd/service.h"
  24 #include <ldb.h>
  25 #include <ldb_errors.h>
  26 #include "../lib/util/dlinklist.h"
  27 #include "dsdb/samdb/samdb.h"
  28 #include "auth/gensec/gensec.h"
  29 #include "auth/gensec/gensec_tstream.h"
  30 #include "param/param.h"
  31 #include "../lib/util/tevent_ntstatus.h"
  32
  33 static char *ldapsrv_bind_error_msg(TALLOC_CTX *mem_ctx,
  34                                     HRESULT hresult,
  35                                     uint32_t DSID,
  36                                     NTSTATUS status)
  37 {
  38         WERROR werr;
  39         char *msg = NULL;
  40
  41         status = nt_status_squash(status);
  42         werr = ntstatus_to_werror(status);
  43
  44         /*
  45          * There are 4 lower case hex digits following 'v' at the end,
  46          * but different Windows Versions return different values:
  47          *
  48          * Windows 2008R2 uses 'v1db1'
  49          * Windows 2012R2 uses 'v2580'
  50          *
  51          * We just match Windows 2008R2 as that's what was referenced
  52          * in https://bugzilla.samba.org/show_bug.cgi?id=9048
  53          */
  54         msg = talloc_asprintf(mem_ctx, "%08X: LdapErr: DSID-%08X, comment: "
  55                               "AcceptSecurityContext error, data %x, v1db1",
  56                               (unsigned)HRES_ERROR_V(hresult),
  57                               (unsigned)DSID,
  58                               (unsigned)W_ERROR_V(werr));
  59
  60         return msg;
  61 }
  62
  63 struct ldapsrv_bind_wait_context {
  64         struct ldapsrv_reply *reply;
  65         struct tevent_req *req;
  66         NTSTATUS status;
  67         bool done;
  68 };
  69
  70 struct ldapsrv_bind_wait_state {
  71         uint8_t dummy;
  72 };
  73
  74 static struct tevent_req *ldapsrv_bind_wait_send(TALLOC_CTX *mem_ctx,
  75                                                  struct tevent_context *ev,
  76                                                  void *private_data)
  77 {
  78         struct ldapsrv_bind_wait_context *bind_wait =
  79                 talloc_get_type_abort(private_data,
  80                 struct ldapsrv_bind_wait_context);
  81         struct tevent_req *req;
  82         struct ldapsrv_bind_wait_state *state;
  83
  84         req = tevent_req_create(mem_ctx, &state,
  85                                 struct ldapsrv_bind_wait_state);
  86         if (req == NULL) {
  87                 return NULL;
  88         }
  89         bind_wait->req = req;
  90
  91         tevent_req_defer_callback(req, ev);
  92
  93         if (!bind_wait->done) {
  94                 return req;
  95         }
  96
  97         if (tevent_req_nterror(req, bind_wait->status)) {
  98                 return tevent_req_post(req, ev);
  99         }
 100
 101         tevent_req_done(req);
 102         return tevent_req_post(req, ev);
 103 }
 104
 105 static NTSTATUS ldapsrv_bind_wait_recv(struct tevent_req *req)
 106 {
 107         return tevent_req_simple_recv_ntstatus(req);
 108 }
 109
 110 static NTSTATUS ldapsrv_bind_wait_setup(struct ldapsrv_call *call,
 111                                         struct ldapsrv_reply *reply)
 112 {
 113         struct ldapsrv_bind_wait_context *bind_wait = NULL;
 114
 115         if (call->wait_private != NULL) {
 116                 return NT_STATUS_INTERNAL_ERROR;
 117         }
 118
 119         bind_wait = talloc_zero(call, struct ldapsrv_bind_wait_context);
 120         if (bind_wait == NULL) {
 121                 return NT_STATUS_NO_MEMORY;
 122         }
 123         bind_wait->reply = reply;
 124
 125         call->wait_private = bind_wait;
 126         call->wait_send = ldapsrv_bind_wait_send;
 127         call->wait_recv = ldapsrv_bind_wait_recv;
 128         return NT_STATUS_OK;
 129 }
 130
 131 static void ldapsrv_bind_wait_finished(struct ldapsrv_call *call,
 132                                        NTSTATUS status)
 133 {
 134         struct ldapsrv_bind_wait_context *bind_wait =
 135                 talloc_get_type_abort(call->wait_private,
 136                 struct ldapsrv_bind_wait_context);
 137
 138         bind_wait->done = true;
 139         bind_wait->status = status;
 140
 141         if (bind_wait->req == NULL) {
 142                 return;
 143         }
 144
 145         if (tevent_req_nterror(bind_wait->req, status)) {
 146                 return;
 147         }
 148
 149         tevent_req_done(bind_wait->req);
 150 }
 151
 152 static void ldapsrv_BindSimple_done(struct tevent_req *subreq);
 153
 154 static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
 155 {
 156         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 157         struct ldapsrv_reply *reply = NULL;
 158         struct ldap_BindResponse *resp = NULL;
 159         int result;
 160         const char *errstr = NULL;
 161         NTSTATUS status;
 162         bool using_tls = call->conn->sockets.active == call->conn->sockets.tls;
 163         struct tevent_req *subreq = NULL;
 164
 165         DEBUG(10, ("BindSimple dn: %s\n",req->dn));
 166
 167         reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 168         if (!reply) {
 169                 return NT_STATUS_NO_MEMORY;
 170         }
 171
 172         if (req->dn != NULL &&
 173             strlen(req->dn) != 0 &&
 174             call->conn->require_strong_auth > LDAP_SERVER_REQUIRE_STRONG_AUTH_NO &&
 175             !using_tls)
 176         {
 177                 status = NT_STATUS_NETWORK_ACCESS_DENIED;
 178                 result = LDAP_STRONG_AUTH_REQUIRED;
 179                 errstr = talloc_asprintf(reply,
 180                                          "BindSimple: Transport encryption required.");
 181                 goto do_reply;
 182         }
 183
 184         subreq = authenticate_ldap_simple_bind_send(call,
 185                                         call->conn->connection->event.ctx,
 186                                         call->conn->connection->msg_ctx,
 187                                         call->conn->lp_ctx,
 188                                         call->conn->connection->remote_address,
 189                                         call->conn->connection->local_address,
 190                                         using_tls,
 191                                         req->dn,
 192                                         req->creds.password);
 193         if (subreq == NULL) {
 194                 return NT_STATUS_NO_MEMORY;
 195         }
 196         tevent_req_set_callback(subreq, ldapsrv_BindSimple_done, call);
 197
 198         status = ldapsrv_bind_wait_setup(call, reply);
 199         if (!NT_STATUS_IS_OK(status)) {
 200                 TALLOC_FREE(subreq);
 201                 return status;
 202         }
 203
 204         /*
 205          * The rest will be async.
 206          */
 207         return NT_STATUS_OK;
 208
 209 do_reply:
 210         resp = &reply->msg->r.BindResponse;
 211         resp->response.resultcode = result;
 212         resp->response.errormessage = errstr;
 213         resp->response.dn = NULL;
 214         resp->response.referral = NULL;
 215         resp->SASL.secblob = NULL;
 216
 217         ldapsrv_queue_reply(call, reply);
 218         return NT_STATUS_OK;
 219 }
 220
 221 static void ldapsrv_BindSimple_done(struct tevent_req *subreq)
 222 {
 223         struct ldapsrv_call *call =
 224                 tevent_req_callback_data(subreq,
 225                 struct ldapsrv_call);
 226         struct ldapsrv_bind_wait_context *bind_wait =
 227                 talloc_get_type_abort(call->wait_private,
 228                 struct ldapsrv_bind_wait_context);
 229         struct ldapsrv_reply *reply = bind_wait->reply;
 230         struct auth_session_info *session_info = NULL;
 231         NTSTATUS status;
 232         struct ldap_BindResponse *resp = NULL;
 233         int result;
 234         const char *errstr = NULL;
 235
 236         status = authenticate_ldap_simple_bind_recv(subreq,
 237                                                     call,
 238                                                     &session_info);
 239         if (NT_STATUS_IS_OK(status)) {
 240                 result = LDAP_SUCCESS;
 241                 errstr = NULL;
 242
 243                 talloc_unlink(call->conn, call->conn->session_info);
 244                 call->conn->session_info = talloc_steal(call->conn, session_info);
 245
 246                 call->conn->authz_logged = true;
 247
 248                 /* don't leak the old LDB */
 249                 talloc_unlink(call->conn, call->conn->ldb);
 250
 251                 status = ldapsrv_backend_Init(call->conn);
 252
 253                 if (!NT_STATUS_IS_OK(status)) {
 254                         result = LDAP_OPERATIONS_ERROR;
 255                         errstr = talloc_asprintf(reply, "Simple Bind: Failed to advise ldb new credentials: %s", nt_errstr(status));
 256                 }
 257         } else {
 258                 status = nt_status_squash(status);
 259
 260                 result = LDAP_INVALID_CREDENTIALS;
 261                 errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_INVALID_TOKEN,
 262                                                 0x0C0903A9, status);
 263         }
 264
 265         resp = &reply->msg->r.BindResponse;
 266         resp->response.resultcode = result;
 267         resp->response.errormessage = errstr;
 268         resp->response.dn = NULL;
 269         resp->response.referral = NULL;
 270         resp->SASL.secblob = NULL;
 271
 272         ldapsrv_queue_reply(call, reply);
 273         ldapsrv_bind_wait_finished(call, NT_STATUS_OK);
 274 }
 275
 276 struct ldapsrv_sasl_postprocess_context {
 277         struct ldapsrv_connection *conn;
 278         struct tstream_context *sasl;
 279 };
 280
 281 struct ldapsrv_sasl_postprocess_state {
 282         uint8_t dummy;
 283 };
 284
 285 static struct tevent_req *ldapsrv_sasl_postprocess_send(TALLOC_CTX *mem_ctx,
 286                                                 struct tevent_context *ev,
 287                                                 void *private_data)
 288 {
 289         struct ldapsrv_sasl_postprocess_context *context =
 290                 talloc_get_type_abort(private_data,
 291                 struct ldapsrv_sasl_postprocess_context);
 292         struct tevent_req *req;
 293         struct ldapsrv_sasl_postprocess_state *state;
 294
 295         req = tevent_req_create(mem_ctx, &state,
 296                                 struct ldapsrv_sasl_postprocess_state);
 297         if (req == NULL) {
 298                 return NULL;
 299         }
 300
 301         TALLOC_FREE(context->conn->sockets.sasl);
 302         context->conn->sockets.sasl = talloc_move(context->conn, &context->sasl);
 303         context->conn->sockets.active = context->conn->sockets.sasl;
 304
 305         tevent_req_done(req);
 306         return tevent_req_post(req, ev);
 307 }
 308
 309 static NTSTATUS ldapsrv_sasl_postprocess_recv(struct tevent_req *req)
 310 {
 311         return tevent_req_simple_recv_ntstatus(req);
 312 }
 313
 314 static NTSTATUS ldapsrv_setup_gensec(struct ldapsrv_connection *conn,
 315                                      const char *sasl_mech,
 316                                      struct gensec_security **_gensec_security)
 317 {
 318         NTSTATUS status;
 319
 320         struct gensec_security *gensec_security;
 321
 322         status = samba_server_gensec_start(conn,
 323                                            conn->connection->event.ctx,
 324                                            conn->connection->msg_ctx,
 325                                            conn->lp_ctx,
 326                                            conn->server_credentials,
 327                                            "ldap",
 328                                            &gensec_security);
 329         if (!NT_STATUS_IS_OK(status)) {
 330                 return status;
 331         }
 332
 333         status = gensec_set_target_service_description(gensec_security,
 334                                                        "LDAP");
 335         if (!NT_STATUS_IS_OK(status)) {
 336                 return status;
 337         }
 338
 339         status = gensec_set_remote_address(gensec_security,
 340                                            conn->connection->remote_address);
 341         if (!NT_STATUS_IS_OK(status)) {
 342                 return status;
 343         }
 344
 345         status = gensec_set_local_address(gensec_security,
 346                                           conn->connection->local_address);
 347         if (!NT_STATUS_IS_OK(status)) {
 348                 return status;
 349         }
 350
 351         gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES);
 352         gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAP_STYLE);
 353
 354         if (conn->sockets.active == conn->sockets.tls) {
 355                 gensec_want_feature(gensec_security, GENSEC_FEATURE_LDAPS_TRANSPORT);
 356         }
 357
 358         status = gensec_start_mech_by_sasl_name(gensec_security, sasl_mech);
 359
 360         if (!NT_STATUS_IS_OK(status)) {
 361                 return status;
 362         }
 363
 364         *_gensec_security = gensec_security;
 365         return status;
 366 }
 367
 368 static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
 369 {
 370         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 371         struct ldapsrv_reply *reply;
 372         struct ldap_BindResponse *resp;
 373         struct ldapsrv_connection *conn;
 374         int result = 0;
 375         const char *errstr=NULL;
 376         NTSTATUS status = NT_STATUS_OK;
 377         DATA_BLOB input = data_blob_null;
 378         DATA_BLOB output = data_blob_null;
 379
 380         DEBUG(10, ("BindSASL dn: %s\n",req->dn));
 381
 382         reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 383         if (!reply) {
 384                 return NT_STATUS_NO_MEMORY;
 385         }
 386         resp = &reply->msg->r.BindResponse;
 387         /* Windows 2000 mmc doesn't like secblob == NULL and reports a decoding error */
 388         resp->SASL.secblob = talloc_zero(reply, DATA_BLOB);
 389         if (resp->SASL.secblob == NULL) {
 390                 return NT_STATUS_NO_MEMORY;
 391         }
 392
 393         conn = call->conn;
 394
 395         /*
 396          * TODO: a SASL bind with a different mechanism
 397          *       should cancel an inprogress SASL bind.
 398          *       (see RFC 4513)
 399          */
 400
 401         if (!conn->gensec) {
 402                 status = ldapsrv_setup_gensec(conn, req->creds.SASL.mechanism,
 403                                               &conn->gensec);
 404                 if (!NT_STATUS_IS_OK(status)) {
 405                         DEBUG(1, ("Failed to start GENSEC server for [%s] code: %s\n",
 406                                   ldb_binary_encode_string(call, req->creds.SASL.mechanism),
 407                                   nt_errstr(status)));
 408                         result = LDAP_OPERATIONS_ERROR;
 409                         errstr = talloc_asprintf(reply, "SASL: Failed to start authentication system: %s",
 410                                                  nt_errstr(status));
 411                         goto do_reply;
 412                 }
 413         }
 414
 415         if (req->creds.SASL.secblob) {
 416                 input = *req->creds.SASL.secblob;
 417         }
 418
 419         status = gensec_update_ev(conn->gensec, reply, conn->connection->event.ctx,
 420                                   input, &output);
 421         *resp->SASL.secblob = output;
 422
 423         if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED, status)) {
 424                 result = LDAP_SASL_BIND_IN_PROGRESS;
 425                 errstr = NULL;
 426                 goto do_reply;
 427         } else if (NT_STATUS_IS_OK(status)) {
 428                 struct ldapsrv_sasl_postprocess_context *context = NULL;
 429
 430                 result = LDAP_SUCCESS;
 431                 errstr = NULL;
 432
 433                 if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
 434                     gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
 435
 436                         context = talloc(call, struct ldapsrv_sasl_postprocess_context);
 437
 438                         if (!context) {
 439                                 status = NT_STATUS_NO_MEMORY;
 440                         }
 441                 }
 442
 443                 if (context && conn->sockets.tls) {
 444                         TALLOC_FREE(context);
 445                         status = NT_STATUS_NOT_SUPPORTED;
 446                         result = LDAP_UNWILLING_TO_PERFORM;
 447                         errstr = talloc_asprintf(reply,
 448                                                  "SASL:[%s]: Sign or Seal are not allowed if TLS is used",
 449                                                  req->creds.SASL.mechanism);
 450                         goto do_reply;
 451                 }
 452
 453                 if (context && conn->sockets.sasl) {
 454                         TALLOC_FREE(context);
 455                         status = NT_STATUS_NOT_SUPPORTED;
 456                         result = LDAP_UNWILLING_TO_PERFORM;
 457                         errstr = talloc_asprintf(reply,
 458                                                  "SASL:[%s]: Sign or Seal are not allowed if SASL encryption has already been set up",
 459                                                  req->creds.SASL.mechanism);
 460                         goto do_reply;
 461                 }
 462
 463                 if (context) {
 464                         context->conn = conn;
 465                         status = gensec_create_tstream(context,
 466                                                        context->conn->gensec,
 467                                                        context->conn->sockets.raw,
 468                                                        &context->sasl);
 469                         if (NT_STATUS_IS_OK(status)) {
 470                                 if (!talloc_reference(context->sasl, conn->gensec)) {
 471                                         status = NT_STATUS_NO_MEMORY;
 472                                 }
 473                         }
 474                 } else {
 475                         switch (call->conn->require_strong_auth) {
 476                         case LDAP_SERVER_REQUIRE_STRONG_AUTH_NO:
 477                                 break;
 478                         case LDAP_SERVER_REQUIRE_STRONG_AUTH_ALLOW_SASL_OVER_TLS:
 479                                 if (call->conn->sockets.active == call->conn->sockets.tls) {
 480                                         break;
 481                                 }
 482                                 status = NT_STATUS_NETWORK_ACCESS_DENIED;
 483                                 result = LDAP_STRONG_AUTH_REQUIRED;
 484                                 errstr = talloc_asprintf(reply,
 485                                                 "SASL:[%s]: not allowed if TLS is used.",
 486                                                  req->creds.SASL.mechanism);
 487                                 goto do_reply;
 488
 489                         case LDAP_SERVER_REQUIRE_STRONG_AUTH_YES:
 490                                 status = NT_STATUS_NETWORK_ACCESS_DENIED;
 491                                 result = LDAP_STRONG_AUTH_REQUIRED;
 492                                 errstr = talloc_asprintf(reply,
 493                                                  "SASL:[%s]: Sign or Seal are required.",
 494                                                  req->creds.SASL.mechanism);
 495                                 goto do_reply;
 496                         }
 497                 }
 498
 499                 if (result != LDAP_SUCCESS) {
 500                 } else if (!NT_STATUS_IS_OK(status)) {
 501                         result = LDAP_OPERATIONS_ERROR;
 502                         errstr = talloc_asprintf(reply,
 503                                                  "SASL:[%s]: Failed to setup SASL socket: %s",
 504                                                  req->creds.SASL.mechanism, nt_errstr(status));
 505                         goto do_reply;
 506                 } else {
 507                         struct auth_session_info *old_session_info=NULL;
 508
 509                         old_session_info = conn->session_info;
 510                         conn->session_info = NULL;
 511                         status = gensec_session_info(conn->gensec, conn, &conn->session_info);
 512                         if (!NT_STATUS_IS_OK(status)) {
 513                                 conn->session_info = old_session_info;
 514                                 result = LDAP_OPERATIONS_ERROR;
 515                                 errstr = talloc_asprintf(reply,
 516                                                          "SASL:[%s]: Failed to get session info: %s",
 517                                                          req->creds.SASL.mechanism, nt_errstr(status));
 518                                 goto do_reply;
 519                         } else {
 520                                 talloc_unlink(conn, old_session_info);
 521
 522                                 /* don't leak the old LDB */
 523                                 talloc_unlink(conn, conn->ldb);
 524
 525                                 call->conn->authz_logged = true;
 526
 527                                 status = ldapsrv_backend_Init(conn);
 528
 529                                 if (!NT_STATUS_IS_OK(status)) {
 530                                         result = LDAP_OPERATIONS_ERROR;
 531                                         errstr = talloc_asprintf(reply,
 532                                                                  "SASL:[%s]: Failed to advise samdb of new credentials: %s",
 533                                                                  req->creds.SASL.mechanism,
 534                                                                  nt_errstr(status));
 535                                         goto do_reply;
 536                                 }
 537                         }
 538                 }
 539
 540                 if (NT_STATUS_IS_OK(status) && context) {
 541                         call->postprocess_send = ldapsrv_sasl_postprocess_send;
 542                         call->postprocess_recv = ldapsrv_sasl_postprocess_recv;
 543                         call->postprocess_private = context;
 544                 }
 545                 talloc_unlink(conn, conn->gensec);
 546                 conn->gensec = NULL;
 547         } else {
 548                 status = nt_status_squash(status);
 549                 if (result == 0) {
 550                         result = LDAP_INVALID_CREDENTIALS;
 551                         errstr = ldapsrv_bind_error_msg(reply, HRES_SEC_E_LOGON_DENIED,
 552                                                         0x0C0904DC, status);
 553                 }
 554                 talloc_unlink(conn, conn->gensec);
 555                 conn->gensec = NULL;
 556                 goto do_reply;
 557         }
 558
 559 do_reply:
 560         resp->response.resultcode = result;
 561         resp->response.dn = NULL;
 562         resp->response.errormessage = errstr;
 563         resp->response.referral = NULL;
 564
 565         ldapsrv_queue_reply(call, reply);
 566         return NT_STATUS_OK;
 567 }
 568
 569 NTSTATUS ldapsrv_BindRequest(struct ldapsrv_call *call)
 570 {
 571         struct ldap_BindRequest *req = &call->request->r.BindRequest;
 572         struct ldapsrv_reply *reply;
 573         struct ldap_BindResponse *resp;
 574
 575         if (call->conn->pending_calls != NULL) {
 576                 reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 577                 if (!reply) {
 578                         return NT_STATUS_NO_MEMORY;
 579                 }
 580
 581                 resp = &reply->msg->r.BindResponse;
 582                 resp->response.resultcode = LDAP_BUSY;
 583                 resp->response.dn = NULL;
 584                 resp->response.errormessage = talloc_asprintf(reply, "Pending requests on this LDAP session");
 585                 resp->response.referral = NULL;
 586                 resp->SASL.secblob = NULL;
 587
 588                 ldapsrv_queue_reply(call, reply);
 589                 return NT_STATUS_OK;
 590         }
 591
 592         /*
 593          * TODO: a simple bind should cancel an
 594          *       inprogress SASL bind.
 595          *       (see RFC 4513)
 596          */
 597         switch (req->mechanism) {
 598                 case LDAP_AUTH_MECH_SIMPLE:
 599                         return ldapsrv_BindSimple(call);
 600                 case LDAP_AUTH_MECH_SASL:
 601                         return ldapsrv_BindSASL(call);
 602         }
 603
 604         reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
 605         if (!reply) {
 606                 return NT_STATUS_NO_MEMORY;
 607         }
 608
 609         resp = &reply->msg->r.BindResponse;
 610         resp->response.resultcode = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 611         resp->response.dn = NULL;
 612         resp->response.errormessage = talloc_asprintf(reply, "Bad AuthenticationChoice [%d]", req->mechanism);
 613         resp->response.referral = NULL;
 614         resp->SASL.secblob = NULL;
 615
 616         ldapsrv_queue_reply(call, reply);
 617         return NT_STATUS_OK;
 618 }
 619
 620 struct ldapsrv_unbind_wait_context {
 621         uint8_t dummy;
 622 };
 623
 624 struct ldapsrv_unbind_wait_state {
 625         uint8_t dummy;
 626 };
 627
 628 static struct tevent_req *ldapsrv_unbind_wait_send(TALLOC_CTX *mem_ctx,
 629                                                  struct tevent_context *ev,
 630                                                  void *private_data)
 631 {
 632         struct ldapsrv_unbind_wait_context *unbind_wait =
 633                 talloc_get_type_abort(private_data,
 634                 struct ldapsrv_unbind_wait_context);
 635         struct tevent_req *req;
 636         struct ldapsrv_unbind_wait_state *state;
 637
 638         req = tevent_req_create(mem_ctx, &state,
 639                                 struct ldapsrv_unbind_wait_state);
 640         if (req == NULL) {
 641                 return NULL;
 642         }
 643
 644         (void)unbind_wait;
 645
 646         tevent_req_nterror(req, NT_STATUS_LOCAL_DISCONNECT);
 647         return tevent_req_post(req, ev);
 648 }
 649
 650 static NTSTATUS ldapsrv_unbind_wait_recv(struct tevent_req *req)
 651 {
 652         return tevent_req_simple_recv_ntstatus(req);
 653 }
 654
 655 static NTSTATUS ldapsrv_unbind_wait_setup(struct ldapsrv_call *call)
 656 {
 657         struct ldapsrv_unbind_wait_context *unbind_wait = NULL;
 658
 659         if (call->wait_private != NULL) {
 660                 return NT_STATUS_INTERNAL_ERROR;
 661         }
 662
 663         unbind_wait = talloc_zero(call, struct ldapsrv_unbind_wait_context);
 664         if (unbind_wait == NULL) {
 665                 return NT_STATUS_NO_MEMORY;
 666         }
 667
 668         call->wait_private = unbind_wait;
 669         call->wait_send = ldapsrv_unbind_wait_send;
 670         call->wait_recv = ldapsrv_unbind_wait_recv;
 671         return NT_STATUS_OK;
 672 }
 673
 674 NTSTATUS ldapsrv_UnbindRequest(struct ldapsrv_call *call)
 675 {
 676         struct ldapsrv_call *c = NULL;
 677         struct ldapsrv_call *n = NULL;
 678
 679         DEBUG(10, ("UnbindRequest\n"));
 680
 681         for (c = call->conn->pending_calls; c != NULL; c = n) {
 682                 n = c->next;
 683
 684                 DLIST_REMOVE(call->conn->pending_calls, c);
 685                 TALLOC_FREE(c);
 686         }
 687
 688         return ldapsrv_unbind_wait_setup(call);
 689 }