This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
-#include "libcli/ldap/ldap.h"
-#include "lib/events/events.h"
-#include "lib/socket/socket.h"
+#include <talloc.h>
+#include "lib/messaging/irpc.h"
#include "smbd/service_task.h"
+#include "smbd/service.h"
#include "cldap_server/cldap_server.h"
+#include "system/network.h"
+#include "lib/socket/netif.h"
+#include <ldb.h>
+#include <ldb_errors.h>
+#include "dsdb/samdb/samdb.h"
+#include "ldb_wrap.h"
+#include "auth/auth.h"
+#include "param/param.h"
+#include "../lib/tsocket/tsocket.h"
+
+NTSTATUS server_service_cldapd_init(void);
/*
handle incoming cldap requests
*/
-static void cldapd_request_handler(struct cldap_socket *cldap,
- struct ldap_message *ldap_msg,
- const char *src_address, int src_port)
+static void cldapd_request_handler(struct cldap_socket *cldap,
+ void *private_data,
+ struct cldap_incoming *in)
{
+ struct cldapd_server *cldapd = talloc_get_type(private_data,
+ struct cldapd_server);
struct ldap_SearchRequest *search;
- if (ldap_msg->type != LDAP_TAG_SearchRequest) {
- DEBUG(0,("Invalid CLDAP request type %d from %s:%d\n",
- ldap_msg->type, src_address, src_port));
+
+ if (in->ldap_msg->type != LDAP_TAG_SearchRequest) {
+ DEBUG(0,("Invalid CLDAP request type %d from %s\n",
+ in->ldap_msg->type,
+ tsocket_address_string(in->src, in)));
+ cldap_error_reply(cldap, in->ldap_msg->messageid, in->src,
+ LDAP_OPERATIONS_ERROR, "Invalid CLDAP request");
+ talloc_free(in);
return;
}
- search = &ldap_msg->r.SearchRequest;
+ search = &in->ldap_msg->r.SearchRequest;
+
+ if (strcmp("", search->basedn) != 0) {
+ DEBUG(0,("Invalid CLDAP basedn '%s' from %s\n",
+ search->basedn,
+ tsocket_address_string(in->src, in)));
+ cldap_error_reply(cldap, in->ldap_msg->messageid, in->src,
+ LDAP_OPERATIONS_ERROR, "Invalid CLDAP basedn");
+ talloc_free(in);
+ return;
+ }
+
+ if (search->scope != LDAP_SEARCH_SCOPE_BASE) {
+ DEBUG(0,("Invalid CLDAP scope %d from %s\n",
+ search->scope,
+ tsocket_address_string(in->src, in)));
+ cldap_error_reply(cldap, in->ldap_msg->messageid, in->src,
+ LDAP_OPERATIONS_ERROR, "Invalid CLDAP scope");
+ talloc_free(in);
+ return;
+ }
if (search->num_attributes == 1 &&
strcasecmp(search->attributes[0], "netlogon") == 0) {
- cldapd_netlogon_request(cldap, ldap_msg->messageid,
- search->tree, src_address, src_port);
- } else {
- DEBUG(0,("Unknown CLDAP search for '%s'\n",
- ldb_filter_from_tree(ldap_msg,
- ldap_msg->r.SearchRequest.tree)));
- cldap_empty_reply(cldap, ldap_msg->messageid, src_address, src_port);
+ cldapd_netlogon_request(cldap,
+ cldapd,
+ in,
+ in->ldap_msg->messageid,
+ search->tree,
+ in->src);
+ talloc_free(in);
+ return;
}
+
+ cldapd_rootdse_request(cldap, cldapd, in,
+ in->ldap_msg->messageid,
+ search, in->src);
+ talloc_free(in);
}
/*
start listening on the given address
*/
-static NTSTATUS cldapd_add_socket(struct cldapd_server *cldapd, const char *address)
+static NTSTATUS cldapd_add_socket(struct cldapd_server *cldapd, struct loadparm_context *lp_ctx,
+ const char *address)
{
struct cldap_socket *cldapsock;
+ struct tsocket_address *socket_address;
NTSTATUS status;
+ int ret;
+
+ ret = tsocket_address_inet_from_strings(cldapd,
+ "ip",
+ address,
+ lpcfg_cldap_port(lp_ctx),
+ &socket_address);
+ if (ret != 0) {
+ status = map_nt_error_from_unix(errno);
+ DEBUG(0,("invalid address %s:%d - %s:%s\n",
+ address, lpcfg_cldap_port(lp_ctx),
+ gai_strerror(ret), nt_errstr(status)));
+ return status;
+ }
/* listen for unicasts on the CLDAP port (389) */
- cldapsock = cldap_socket_init(cldapd, cldapd->task->event_ctx);
- NT_STATUS_HAVE_NO_MEMORY(cldapsock);
-
- status = socket_listen(cldapsock->sock, address, lp_cldap_port(), 0, 0);
+ status = cldap_socket_init(cldapd,
+ cldapd->task->event_ctx,
+ socket_address,
+ NULL,
+ &cldapsock);
if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to bind to %s:%d - %s\n",
- address, lp_cldap_port(), nt_errstr(status)));
- talloc_free(cldapsock);
+ DEBUG(0,("Failed to bind to %s - %s\n",
+ tsocket_address_string(socket_address, socket_address),
+ nt_errstr(status)));
+ talloc_free(socket_address);
return status;
}
+ talloc_free(socket_address);
cldap_set_incoming_handler(cldapsock, cldapd_request_handler, cldapd);
return NT_STATUS_OK;
}
-
/*
setup our listening sockets on the configured network interfaces
*/
-NTSTATUS cldapd_startup_interfaces(struct cldapd_server *cldapd)
+static NTSTATUS cldapd_startup_interfaces(struct cldapd_server *cldapd, struct loadparm_context *lp_ctx,
+ struct interface *ifaces)
{
- int num_interfaces = iface_count();
+ int i, num_interfaces;
TALLOC_CTX *tmp_ctx = talloc_new(cldapd);
NTSTATUS status;
+ num_interfaces = iface_count(ifaces);
+
/* if we are allowing incoming packets from any address, then
we need to bind to the wildcard address */
- if (!lp_bind_interfaces_only()) {
- status = cldapd_add_socket(cldapd, "0.0.0.0");
+ if (!lpcfg_bind_interfaces_only(lp_ctx)) {
+ status = cldapd_add_socket(cldapd, lp_ctx, "0.0.0.0");
+ NT_STATUS_NOT_OK_RETURN(status);
+ }
+
+ /* now we have to also listen on the specific interfaces,
+ so that replies always come from the right IP */
+ for (i=0; i<num_interfaces; i++) {
+ const char *address = talloc_strdup(tmp_ctx, iface_n_ip(ifaces, i));
+ status = cldapd_add_socket(cldapd, lp_ctx, address);
NT_STATUS_NOT_OK_RETURN(status);
- } else {
- int i;
-
- for (i=0; i<num_interfaces; i++) {
- const char *address = talloc_strdup(tmp_ctx, iface_n_ip(i));
- status = cldapd_add_socket(cldapd, address);
- NT_STATUS_NOT_OK_RETURN(status);
- }
}
talloc_free(tmp_ctx);
{
struct cldapd_server *cldapd;
NTSTATUS status;
+ struct interface *ifaces;
+
+ load_interfaces(task, lpcfg_interfaces(task->lp_ctx), &ifaces);
- if (iface_count() == 0) {
- task_server_terminate(task, "cldapd: no network interfaces configured");
+ if (iface_count(ifaces) == 0) {
+ task_server_terminate(task, "cldapd: no network interfaces configured", false);
+ return;
+ }
+
+ switch (lpcfg_server_role(task->lp_ctx)) {
+ case ROLE_STANDALONE:
+ task_server_terminate(task, "cldap_server: no CLDAP server required in standalone configuration",
+ false);
+ return;
+ case ROLE_DOMAIN_MEMBER:
+ task_server_terminate(task, "cldap_server: no CLDAP server required in member server configuration",
+ false);
return;
+ case ROLE_DOMAIN_CONTROLLER:
+ /* Yes, we want an CLDAP server */
+ break;
}
+ task_server_set_title(task, "task[cldapd]");
+
cldapd = talloc(task, struct cldapd_server);
if (cldapd == NULL) {
- task_server_terminate(task, "cldapd: out of memory");
+ task_server_terminate(task, "cldapd: out of memory", true);
return;
}
cldapd->task = task;
- cldapd->samctx = NULL;
+ cldapd->samctx = samdb_connect(cldapd, task->event_ctx, task->lp_ctx, system_session(task->lp_ctx), 0);
+ if (cldapd->samctx == NULL) {
+ task_server_terminate(task, "cldapd failed to open samdb", true);
+ return;
+ }
/* start listening on the configured network interfaces */
- status = cldapd_startup_interfaces(cldapd);
+ status = cldapd_startup_interfaces(cldapd, task->lp_ctx, ifaces);
if (!NT_STATUS_IS_OK(status)) {
- task_server_terminate(task, "cldapd failed to setup interfaces");
+ task_server_terminate(task, "cldapd failed to setup interfaces", true);
return;
}
-}
-
-/*
- initialise the cldapd server
- */
-static NTSTATUS cldapd_init(struct event_context *event_ctx, const struct model_ops *model_ops)
-{
- return task_server_startup(event_ctx, model_ops, cldapd_task_init);
+ irpc_add_name(task->msg_ctx, "cldap_server");
}
*/
NTSTATUS server_service_cldapd_init(void)
{
- return register_server_service("cldap", cldapd_init);
+ return register_server_service("cldap", cldapd_task_init);
}
git.samba.org / sfrench / samba-autobuild / .git / blobdiff