sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-24 21:34:56 +03:00
Code
5158636aff
samba-mirror/source4/ldap_server/ldap_bind.c

159 lines
4.6 KiB
C
Raw Normal View History

r2864: - Bind and Unbind are no directory partition operations - move Bind Unbind code to a seperate file metze (This used to be commit 3aa1a298970eab563ff6304210bee4696ecec105)
2004-10-08 16:31:13 +04:00
/*
Unix SMB/CIFS implementation.
LDAP server
Copyright (C) Stefan Metzmacher 2004
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
r3464: split out registry.h, rap.h and ldap_server.h (This used to be commit 70d2090f6bf2c7e0caf1e9c020f330de88871f8e)
2004-11-02 09:52:59 +03:00
#include "ldap_server/ldap_server.h"
r4459: GENSEC refinements: In developing a GSSAPI plugin for GENSEC, it became clear that the API needed to change: - GSSAPI exposes only a wrap() and unwrap() interface, and determines the location of the signature itself. - The 'have feature' API did not correctly function in the recursive SPNEGO environment. As such, NTLMSSP has been updated to support these methods. The LDAP client and server have been updated to use the new wrap() and unwrap() methods, and now pass the LDAP-* tests in our smbtorture. (Unfortunely I still get valgrind warnings, in the code that was previously unreachable). Andrew Bartlett (This used to be commit 9923c3bc1b5a6e93a5996aadb039bd229e888ac6)
2005-01-01 01:45:11 +03:00
#include "auth/auth.h"
r5305: removed libcli/ldap/ldap.h from includes.h (This used to be commit 0df3fdd8178085c40f9cd776cc3e1486ca559c8e)
2005-02-10 10:08:40 +03:00
#include "libcli/ldap/ldap.h"
r7633: this patch started as an attempt to make the dcerpc code use a given event_context for the socket_connect() call, so that when things that use dcerpc are running alongside anything else it doesn't block the whole process during a connect. Then of course I needed to change any code that created a dcerpc connection (such as the auth code) to also take an event context, and anything that called that and so on .... thus the size of the patch. There were 3 places where I punted: - abartlet wanted me to add a gensec_set_event_context() call instead of adding it to the gensec init calls. Andrew, my apologies for not doing this. I didn't do it as adding a new parameter allowed me to catch all the callers with the compiler. Now that its done, we could go back and use gensec_set_event_context() - the ejs code calls auth initialisation, which means it should pass in the event context from the web server. I punted on that. Needs fixing. - I used a NULL event context in dcom_get_pipe(). This is equivalent to what we did already, but should be fixed to use a callers event context. Jelmer, can you think of a clean way to do that? I also cleaned up a couple of things: - libnet_context_destroy() makes no sense. I removed it. - removed some unused vars in various places (This used to be commit 3a3025485bdb8f600ab528c0b4b4eef0c65e3fc9)
2005-06-16 15:36:09 +04:00
#include "smbd/service_stream.h"
r2864: - Bind and Unbind are no directory partition operations - move Bind Unbind code to a seperate file metze (This used to be commit 3aa1a298970eab563ff6304210bee4696ecec105)
2004-10-08 16:31:13 +04:00
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
r2864: - Bind and Unbind are no directory partition operations - move Bind Unbind code to a seperate file metze (This used to be commit 3aa1a298970eab563ff6304210bee4696ecec105)
2004-10-08 16:31:13 +04:00
{
r7593: simplified the memory management in the ldap code. Having a mem_ctx element in a structure is not necessary any more. (This used to be commit 912d0427f52eac811b27bf7e385b0642f7dc7f53)
2005-06-15 04:27:51 +04:00
struct ldap_BindRequest *req = &call->request->r.BindRequest;
r2864: - Bind and Unbind are no directory partition operations - move Bind Unbind code to a seperate file metze (This used to be commit 3aa1a298970eab563ff6304210bee4696ecec105)
2004-10-08 16:31:13 +04:00
struct ldapsrv_reply *reply;
struct ldap_BindResponse *resp;
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
DEBUG(10, ("BindSimple dn: %s\n",req->dn));
r2864: - Bind and Unbind are no directory partition operations - move Bind Unbind code to a seperate file metze (This used to be commit 3aa1a298970eab563ff6304210bee4696ecec105)
2004-10-08 16:31:13 +04:00
reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
if (!reply) {
return NT_STATUS_NO_MEMORY;
}
r7593: simplified the memory management in the ldap code. Having a mem_ctx element in a structure is not necessary any more. (This used to be commit 912d0427f52eac811b27bf7e385b0642f7dc7f53)
2005-06-15 04:27:51 +04:00
resp = &reply->msg->r.BindResponse;
r2864: - Bind and Unbind are no directory partition operations - move Bind Unbind code to a seperate file metze (This used to be commit 3aa1a298970eab563ff6304210bee4696ecec105)
2004-10-08 16:31:13 +04:00
resp->response.resultcode = 0;
resp->response.dn = NULL;
resp->response.errormessage = NULL;
resp->response.referral = NULL;
resp->SASL.secblob = data_blob(NULL, 0);
r7747: - simplified the ldap server buffer handling - got rid of the special cases for sasl buffers - added a tls_socket_pending() call to determine how much data is waiting on a tls connection - removed the attempt at async handling of ldap calls. The buffers/sockets are all async, but the calls themselves are sync. (This used to be commit 73cb4aad229d08e17e22d5792580bd43a61b142a)
2005-06-19 13:31:34 +04:00
ldapsrv_queue_reply(call, reply);
return NT_STATUS_OK;
r2864: - Bind and Unbind are no directory partition operations - move Bind Unbind code to a seperate file metze (This used to be commit 3aa1a298970eab563ff6304210bee4696ecec105)
2004-10-08 16:31:13 +04:00
}
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
{
r7593: simplified the memory management in the ldap code. Having a mem_ctx element in a structure is not necessary any more. (This used to be commit 912d0427f52eac811b27bf7e385b0642f7dc7f53)
2005-06-15 04:27:51 +04:00
struct ldap_BindRequest *req = &call->request->r.BindRequest;
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
struct ldapsrv_reply *reply;
struct ldap_BindResponse *resp;
r4459: GENSEC refinements: In developing a GSSAPI plugin for GENSEC, it became clear that the API needed to change: - GSSAPI exposes only a wrap() and unwrap() interface, and determines the location of the signature itself. - The 'have feature' API did not correctly function in the recursive SPNEGO environment. As such, NTLMSSP has been updated to support these methods. The LDAP client and server have been updated to use the new wrap() and unwrap() methods, and now pass the LDAP-* tests in our smbtorture. (Unfortunely I still get valgrind warnings, in the code that was previously unreachable). Andrew Bartlett (This used to be commit 9923c3bc1b5a6e93a5996aadb039bd229e888ac6)
2005-01-01 01:45:11 +03:00
struct ldapsrv_connection *conn;
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
int result;
const char *errstr;
NTSTATUS status = NT_STATUS_OK;
r7568: enable the NTLMSSP bulk data sign/seal code for out ldap server. This now works with windows clients, as I fixed the zero length bind ack packet. Andrew, note that this has the strncmp("NTLMSSP", data, 7) hack. Please replace with a more correct fix as we discussed. (This used to be commit 69b02e8adb25a5152aec15f55b2b2f67457cf08a)
2005-06-14 07:55:27 +04:00
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
DEBUG(10, ("BindSASL dn: %s\n",req->dn));
if (!call->conn->gensec) {
call->conn->session_info = NULL;
r7633: this patch started as an attempt to make the dcerpc code use a given event_context for the socket_connect() call, so that when things that use dcerpc are running alongside anything else it doesn't block the whole process during a connect. Then of course I needed to change any code that created a dcerpc connection (such as the auth code) to also take an event context, and anything that called that and so on .... thus the size of the patch. There were 3 places where I punted: - abartlet wanted me to add a gensec_set_event_context() call instead of adding it to the gensec init calls. Andrew, my apologies for not doing this. I didn't do it as adding a new parameter allowed me to catch all the callers with the compiler. Now that its done, we could go back and use gensec_set_event_context() - the ejs code calls auth initialisation, which means it should pass in the event context from the web server. I punted on that. Needs fixing. - I used a NULL event context in dcom_get_pipe(). This is equivalent to what we did already, but should be fixed to use a callers event context. Jelmer, can you think of a clean way to do that? I also cleaned up a couple of things: - libnet_context_destroy() makes no sense. I removed it. - removed some unused vars in various places (This used to be commit 3a3025485bdb8f600ab528c0b4b4eef0c65e3fc9)
2005-06-16 15:36:09 +04:00
status = gensec_server_start(call->conn, &call->conn->gensec,
call->conn->connection->event.ctx);
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to start GENSEC server code: %s\n", nt_errstr(status)));
return status;
}
r4355: More work from the elves on Christmas eve: - Update Samba4's kerberos code to match the 'salting' changes in Samba3 (and many other cleanups by jra). - Move GENSEC into the modern era of talloc destructors. This avoids many of the memory leaks in this code, as we now can't somehow 'forget' to call the end routine. - This required fixing some of the talloc hierarchies. - The new krb5 seems more sensitive to getting the service name right, so start actually setting the service name on the krb5 context. Andrew Bartlett (This used to be commit 278bf1a61a6da6ef955a12c13d7b1a0357cebf1f)
2004-12-24 12:54:23 +03:00
gensec_set_target_service(call->conn->gensec, "ldap");
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
r7568: enable the NTLMSSP bulk data sign/seal code for out ldap server. This now works with windows clients, as I fixed the zero length bind ack packet. Andrew, note that this has the strncmp("NTLMSSP", data, 7) hack. Please replace with a more correct fix as we discussed. (This used to be commit 69b02e8adb25a5152aec15f55b2b2f67457cf08a)
2005-06-14 07:55:27 +04:00
gensec_want_feature(call->conn->gensec, GENSEC_FEATURE_SIGN);
r4459: GENSEC refinements: In developing a GSSAPI plugin for GENSEC, it became clear that the API needed to change: - GSSAPI exposes only a wrap() and unwrap() interface, and determines the location of the signature itself. - The 'have feature' API did not correctly function in the recursive SPNEGO environment. As such, NTLMSSP has been updated to support these methods. The LDAP client and server have been updated to use the new wrap() and unwrap() methods, and now pass the LDAP-* tests in our smbtorture. (Unfortunely I still get valgrind warnings, in the code that was previously unreachable). Andrew Bartlett (This used to be commit 9923c3bc1b5a6e93a5996aadb039bd229e888ac6)
2005-01-01 01:45:11 +03:00
gensec_want_feature(call->conn->gensec, GENSEC_FEATURE_SEAL);
r9417: Ask for the ASYNC_REPLIES feature, as will want that. Andrew Bartlett (This used to be commit 8cb8f99ae602f3bca0235e5e695ecb1ba55b0e46)
2005-08-20 10:14:46 +04:00
gensec_want_feature(call->conn->gensec, GENSEC_FEATURE_ASYNC_REPLIES);
r7594: abartlet is right that this hack is not actually necessary, it just prevents a bogus: GSS Update failed: Miscellaneous failure (see text): ASN.1 identifier doesn't match expected value error on every ldap connection. I'll remove it and let the error remain until Andrew works out a better fix. (This used to be commit 6123eb2ecad6f53521b546f76954523fbc0fb981)
2005-06-15 04:30:03 +04:00
status = gensec_start_mech_by_sasl_name(call->conn->gensec, req->creds.SASL.mechanism);
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Failed to start GENSEC SASL[%s] server code: %s\n",
req->creds.SASL.mechanism, nt_errstr(status)));
goto reply;
}
}
reply:
reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
if (!reply) {
return NT_STATUS_NO_MEMORY;
}
r7593: simplified the memory management in the ldap code. Having a mem_ctx element in a structure is not necessary any more. (This used to be commit 912d0427f52eac811b27bf7e385b0642f7dc7f53)
2005-06-15 04:27:51 +04:00
resp = &reply->msg->r.BindResponse;
r4459: GENSEC refinements: In developing a GSSAPI plugin for GENSEC, it became clear that the API needed to change: - GSSAPI exposes only a wrap() and unwrap() interface, and determines the location of the signature itself. - The 'have feature' API did not correctly function in the recursive SPNEGO environment. As such, NTLMSSP has been updated to support these methods. The LDAP client and server have been updated to use the new wrap() and unwrap() methods, and now pass the LDAP-* tests in our smbtorture. (Unfortunely I still get valgrind warnings, in the code that was previously unreachable). Andrew Bartlett (This used to be commit 9923c3bc1b5a6e93a5996aadb039bd229e888ac6)
2005-01-01 01:45:11 +03:00
conn = call->conn;
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
if (NT_STATUS_IS_OK(status)) {
status = gensec_update(call->conn->gensec, reply,
r7568: enable the NTLMSSP bulk data sign/seal code for out ldap server. This now works with windows clients, as I fixed the zero length bind ack packet. Andrew, note that this has the strncmp("NTLMSSP", data, 7) hack. Please replace with a more correct fix as we discussed. (This used to be commit 69b02e8adb25a5152aec15f55b2b2f67457cf08a)
2005-06-14 07:55:27 +04:00
req->creds.SASL.secblob, &resp->SASL.secblob);
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
}
if (NT_STATUS_EQUAL(NT_STATUS_MORE_PROCESSING_REQUIRED, status)) {
result = LDAP_SASL_BIND_IN_PROGRESS;
errstr = NULL;
} else if (NT_STATUS_IS_OK(status)) {
result = LDAP_SUCCESS;
errstr = NULL;
r7854: only enable wrapping in the ldap server if it was negotiated by gensec (This used to be commit 355983493bc87b9e812152ef81773dccb23e03d5)
2005-06-24 04:03:17 +04:00
if (gensec_have_feature(call->conn->gensec, GENSEC_FEATURE_SEAL) ||
gensec_have_feature(call->conn->gensec, GENSEC_FEATURE_SIGN)) {
call->conn->enable_wrap = True;
}
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
} else {
result = 49;
errstr = talloc_asprintf(reply, "SASL:[%s]: %s", req->creds.SASL.mechanism, nt_errstr(status));
}
resp->response.resultcode = result;
resp->response.dn = NULL;
resp->response.errormessage = errstr;
resp->response.referral = NULL;
r7747: - simplified the ldap server buffer handling - got rid of the special cases for sasl buffers - added a tls_socket_pending() call to determine how much data is waiting on a tls connection - removed the attempt at async handling of ldap calls. The buffers/sockets are all async, but the calls themselves are sync. (This used to be commit 73cb4aad229d08e17e22d5792580bd43a61b142a)
2005-06-19 13:31:34 +04:00
ldapsrv_queue_reply(call, reply);
return NT_STATUS_OK;
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
}
NTSTATUS ldapsrv_BindRequest(struct ldapsrv_call *call)
{
r7593: simplified the memory management in the ldap code. Having a mem_ctx element in a structure is not necessary any more. (This used to be commit 912d0427f52eac811b27bf7e385b0642f7dc7f53)
2005-06-15 04:27:51 +04:00
struct ldap_BindRequest *req = &call->request->r.BindRequest;
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
struct ldapsrv_reply *reply;
struct ldap_BindResponse *resp;
switch (req->mechanism) {
case LDAP_AUTH_MECH_SIMPLE:
return ldapsrv_BindSimple(call);
case LDAP_AUTH_MECH_SASL:
return ldapsrv_BindSASL(call);
}
reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
if (!reply) {
return NT_STATUS_NO_MEMORY;
}
r7593: simplified the memory management in the ldap code. Having a mem_ctx element in a structure is not necessary any more. (This used to be commit 912d0427f52eac811b27bf7e385b0642f7dc7f53)
2005-06-15 04:27:51 +04:00
resp = &reply->msg->r.BindResponse;
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
resp->response.resultcode = 7;
resp->response.dn = NULL;
resp->response.errormessage = talloc_asprintf(reply, "Bad AuthenticationChoice [%d]", req->mechanism);
resp->response.referral = NULL;
resp->SASL.secblob = data_blob(NULL, 0);
r7747: - simplified the ldap server buffer handling - got rid of the special cases for sasl buffers - added a tls_socket_pending() call to determine how much data is waiting on a tls connection - removed the attempt at async handling of ldap calls. The buffers/sockets are all async, but the calls themselves are sync. (This used to be commit 73cb4aad229d08e17e22d5792580bd43a61b142a)
2005-06-19 13:31:34 +04:00
ldapsrv_queue_reply(call, reply);
return NT_STATUS_OK;
r2878: add server sasl support (there are a lot of clean ups following later, but the LDAP-BASIC test works :-) metze (This used to be commit 34fe29c04a76f2f53f27adcaf9be2dce8d177516)
2004-10-10 02:00:00 +04:00
}
r2864: - Bind and Unbind are no directory partition operations - move Bind Unbind code to a seperate file metze (This used to be commit 3aa1a298970eab563ff6304210bee4696ecec105)
2004-10-08 16:31:13 +04:00
NTSTATUS ldapsrv_UnbindRequest(struct ldapsrv_call *call)
{
DEBUG(10, ("UnbindRequest\n"));
return NT_STATUS_OK;
}
Copy Permalink