← Back to branch summary

~zulcss/samba/server-dailies-3.4

« back to all changes in this revision

Viewing changes to source4/ldap_server/ldap_extended.c

  • Committer: Chuck Short
  • Date: 2010-09-28 20:38:39 UTC
  • Revision ID: zulcss@ubuntu.com-20100928203839-pgjulytsi9ue63x1
Initial version

Show diffs side-by-side

added added

removed removed

Lines of Context:
source4/ldap_server/ldap_extended.c
 
1
/* 
 
2
   Unix SMB/CIFS implementation.
 
3
   LDAP server
 
4
   Copyright (C) Stefan Metzmacher 2004
 
5
   
 
6
   This program is free software; you can redistribute it and/or modify
 
7
   it under the terms of the GNU General Public License as published by
 
8
   the Free Software Foundation; either version 3 of the License, or
 
9
   (at your option) any later version.
 
10
   
 
11
   This program is distributed in the hope that it will be useful,
 
12
   but WITHOUT ANY WARRANTY; without even the implied warranty of
 
13
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
14
   GNU General Public License for more details.
 
15
   
 
16
   You should have received a copy of the GNU General Public License
 
17
   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
18
*/
 
19
 
 
20
#include "includes.h"
 
21
#include "ldap_server/ldap_server.h"
 
22
#include "../lib/util/dlinklist.h"
 
23
#include "libcli/ldap/ldap.h"
 
24
#include "lib/tls/tls.h"
 
25
#include "smbd/service_stream.h"
 
26
 
 
27
struct ldapsrv_starttls_context {
 
28
        struct ldapsrv_connection *conn;
 
29
        struct socket_context *tls_socket;
 
30
};
 
31
 
 
32
static void ldapsrv_start_tls(void *private_data)
 
33
{
 
34
        struct ldapsrv_starttls_context *ctx = talloc_get_type(private_data, struct ldapsrv_starttls_context);
 
35
        talloc_steal(ctx->conn->connection, ctx->tls_socket);
 
36
        talloc_unlink(ctx->conn->connection, ctx->conn->connection->socket);
 
37
 
 
38
        ctx->conn->sockets.tls = ctx->tls_socket;
 
39
        ctx->conn->connection->socket = ctx->tls_socket;
 
40
        packet_set_socket(ctx->conn->packet, ctx->conn->connection->socket);
 
41
        packet_set_unreliable_select(ctx->conn->packet);
 
42
}
 
43
 
 
44
static NTSTATUS ldapsrv_StartTLS(struct ldapsrv_call *call,
 
45
                                 struct ldapsrv_reply *reply,
 
46
                                 const char **errstr)
 
47
{
 
48
        struct ldapsrv_starttls_context *ctx;
 
49
 
 
50
        (*errstr) = NULL;
 
51
 
 
52
        /*
 
53
         * TODO: give LDAP_OPERATIONS_ERROR also when
 
54
         *       there're pending requests or there's
 
55
         *       a SASL bind in progress
 
56
         *       (see rfc4513 section 3.1.1)
 
57
         */
 
58
        if (call->conn->sockets.tls) {
 
59
                (*errstr) = talloc_asprintf(reply, "START-TLS: TLS is already enabled on this LDAP session");
 
60
                return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
 
61
        }
 
62
 
 
63
        ctx = talloc(call, struct ldapsrv_starttls_context);
 
64
        NT_STATUS_HAVE_NO_MEMORY(ctx);
 
65
 
 
66
        ctx->conn = call->conn;
 
67
        ctx->tls_socket = tls_init_server(call->conn->service->tls_params,
 
68
                                          call->conn->connection->socket,
 
69
                                          call->conn->connection->event.fde, 
 
70
                                          NULL);
 
71
        if (!ctx->tls_socket) {
 
72
                (*errstr) = talloc_asprintf(reply, "START-TLS: Failed to setup TLS socket");
 
73
                return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
 
74
        }
 
75
 
 
76
        call->send_callback = ldapsrv_start_tls;
 
77
        call->send_private  = ctx;
 
78
 
 
79
        reply->msg->r.ExtendedResponse.response.resultcode = LDAP_SUCCESS;
 
80
        reply->msg->r.ExtendedResponse.response.errormessage = NULL;
 
81
 
 
82
        ldapsrv_queue_reply(call, reply);
 
83
        return NT_STATUS_OK;
 
84
}
 
85
 
 
86
struct ldapsrv_extended_operation {
 
87
        const char *oid;
 
88
        NTSTATUS (*fn)(struct ldapsrv_call *call, struct ldapsrv_reply *reply, const char **errorstr);
 
89
};
 
90
 
 
91
static struct ldapsrv_extended_operation extended_ops[] = {
 
92
        {
 
93
                .oid    = LDB_EXTENDED_START_TLS_OID,
 
94
                .fn     = ldapsrv_StartTLS,
 
95
        },{
 
96
                .oid    = NULL,
 
97
                .fn     = NULL,
 
98
        }
 
99
};
 
100
 
 
101
NTSTATUS ldapsrv_ExtendedRequest(struct ldapsrv_call *call)
 
102
{
 
103
        struct ldap_ExtendedRequest *req = &call->request->r.ExtendedRequest;
 
104
        struct ldapsrv_reply *reply;
 
105
        int result = LDAP_PROTOCOL_ERROR;
 
106
        const char *error_str = NULL;
 
107
        NTSTATUS status = NT_STATUS_OK;
 
108
        uint32_t i;
 
109
 
 
110
        DEBUG(10, ("Extended\n"));
 
111
 
 
112
        reply = ldapsrv_init_reply(call, LDAP_TAG_ExtendedResponse);
 
113
        NT_STATUS_HAVE_NO_MEMORY(reply);
 
114
 
 
115
        ZERO_STRUCT(reply->msg->r);
 
116
        reply->msg->r.ExtendedResponse.oid = talloc_steal(reply, req->oid);
 
117
        reply->msg->r.ExtendedResponse.response.resultcode = LDAP_PROTOCOL_ERROR;
 
118
        reply->msg->r.ExtendedResponse.response.errormessage = NULL;
 
119
 
 
120
        for (i=0; extended_ops[i].oid; i++) {
 
121
                if (strcmp(extended_ops[i].oid,req->oid) != 0) continue;
 
122
 
 
123
                /* 
 
124
                 * if the backend function returns an error we
 
125
                 * need to send the reply otherwise the reply is already
 
126
                 * send and we need to return directly
 
127
                 */
 
128
                status = extended_ops[i].fn(call, reply, &error_str);
 
129
                NT_STATUS_IS_OK_RETURN(status);
 
130
 
 
131
                if (NT_STATUS_IS_LDAP(status)) {
 
132
                        result = NT_STATUS_LDAP_CODE(status);
 
133
                } else {
 
134
                        result = LDAP_OPERATIONS_ERROR;
 
135
                        error_str = talloc_asprintf(reply, "Extended Operation(%s) failed: %s",
 
136
                                                    req->oid, nt_errstr(status));
 
137
                }
 
138
        }
 
139
        /* if we haven't found the oid, then status is still NT_STATUS_OK */
 
140
        if (NT_STATUS_IS_OK(status)) {
 
141
                error_str = talloc_asprintf(reply, "Extended Operation(%s) not supported",
 
142
                                            req->oid);
 
143
        }
 
144
 
 
145
        reply->msg->r.ExtendedResponse.response.resultcode = result;
 
146
        reply->msg->r.ExtendedResponse.response.errormessage = error_str;
 
147
 
 
148
        ldapsrv_queue_reply(call, reply);
 
149
        return NT_STATUS_OK;
 
150
}