2001-11-20 11:54:15 +03:00
/*
2002-01-30 09:08:46 +03:00
Unix SMB / CIFS implementation .
2001-11-20 11:54:15 +03:00
ads ( active directory ) utility library
Copyright ( C ) Andrew Tridgell 2001
2001-12-20 06:54:52 +03:00
Copyright ( C ) Remus Koos 2001
2002-02-01 19:14:33 +03:00
Copyright ( C ) Jim McDonough 2002
2001-11-20 11:54:15 +03:00
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation ; either version 2 of the License , or
( at your option ) any later version .
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
You should have received a copy of the GNU General Public License
along with this program ; if not , write to the Free Software
Foundation , Inc . , 675 Mass Ave , Cambridge , MA 0213 9 , USA .
*/
# include "includes.h"
2002-10-01 22:26:00 +04:00
# ifdef HAVE_LDAP
2001-11-20 11:54:15 +03:00
2002-04-10 17:28:03 +04:00
/**
* @ file ldap . c
* @ brief basic ldap client - side routines for ads server communications
*
* The routines contained here should do the necessary ldap calls for
* ads setups .
2002-07-15 14:35:28 +04:00
*
* Important note : attribute names passed into ads_ routines must
* already be in UTF - 8 format . We do not convert them because in almost
* all cases , they are just ascii ( which is represented with the same
* codepoints in UTF - 8 ) . This may have to change at some point
2002-04-10 17:28:03 +04:00
* */
2002-08-17 21:00:51 +04:00
/*
try a connection to a given ldap server , returning True and setting the servers IP
in the ads struct if successful
*/
static BOOL ads_try_connect ( ADS_STRUCT * ads , const char * server , unsigned port )
{
char * srv ;
if ( ! server | | ! * server ) {
return False ;
}
DEBUG ( 5 , ( " ads_try_connect: trying ldap server '%s' port %u \n " , server , port ) ) ;
/* this copes with inet_ntoa brokenness */
srv = strdup ( server ) ;
ads - > ld = ldap_open ( srv , port ) ;
if ( ! ads - > ld ) {
free ( srv ) ;
return False ;
}
ads - > ldap_port = port ;
ads - > ldap_ip = * interpret_addr2 ( srv ) ;
free ( srv ) ;
2002-09-25 19:19:00 +04:00
2002-08-17 21:00:51 +04:00
return True ;
}
2002-10-01 22:26:00 +04:00
/*
try a connection to a given ldap server , based on URL , returning True if successful
*/
static BOOL ads_try_connect_uri ( ADS_STRUCT * ads )
{
# if defined(LDAP_API_FEATURE_X_OPENLDAP) && (LDAP_API_VERSION > 2000)
DEBUG ( 5 , ( " ads_try_connect: trying ldap server at URI '%s' \n " ,
ads - > server . ldap_uri ) ) ;
if ( ldap_initialize ( ( LDAP * * ) & ( ads - > ld ) , ads - > server . ldap_uri ) = = LDAP_SUCCESS ) {
return True ;
}
DEBUG ( 0 , ( " ldap_initialize: %s \n " , strerror ( errno ) ) ) ;
# else
DEBUG ( 1 , ( " no URL support in LDAP libs! \n " ) ) ;
# endif
return False ;
}
2002-08-17 21:00:51 +04:00
/* used by the IP comparison function */
struct ldap_ip {
struct in_addr ip ;
unsigned port ;
} ;
/* compare 2 ldap IPs by nearness to our interfaces - used in qsort */
static int ldap_ip_compare ( struct ldap_ip * ip1 , struct ldap_ip * ip2 )
{
return ip_compare ( & ip1 - > ip , & ip2 - > ip ) ;
}
/* try connecting to a ldap server via DNS */
static BOOL ads_try_dns ( ADS_STRUCT * ads )
{
2002-11-13 02:20:50 +03:00
const char * c_realm ;
const char * ptr ;
char * realm ;
2002-08-17 21:00:51 +04:00
char * list = NULL ;
pstring tok ;
struct ldap_ip * ip_list ;
int count , i = 0 ;
2002-11-13 02:20:50 +03:00
c_realm = ads - > server . realm ;
if ( ! c_realm | | ! * c_realm ) {
c_realm = lp_realm ( ) ;
2002-08-17 21:00:51 +04:00
}
2002-11-13 02:20:50 +03:00
if ( ! c_realm | | ! * c_realm ) {
c_realm = ads - > server . workgroup ;
2002-08-17 21:00:51 +04:00
}
2002-11-13 02:20:50 +03:00
if ( ! c_realm | | ! * c_realm ) {
c_realm = lp_workgroup ( ) ;
2002-08-17 21:00:51 +04:00
}
2002-11-13 02:20:50 +03:00
if ( ! c_realm ) {
2002-08-17 21:00:51 +04:00
return False ;
}
2002-11-13 02:20:50 +03:00
realm = smb_xstrdup ( c_realm ) ;
2002-08-17 21:00:51 +04:00
DEBUG ( 6 , ( " ads_try_dns: looking for realm '%s' \n " , realm ) ) ;
if ( ldap_domain2hostlist ( realm , & list ) ! = LDAP_SUCCESS ) {
SAFE_FREE ( realm ) ;
return False ;
}
DEBUG ( 6 , ( " ads_try_dns: ldap realm '%s' host list '%s' \n " , realm , list ) ) ;
SAFE_FREE ( realm ) ;
count = count_chars ( list , ' ' ) + 1 ;
ip_list = malloc ( count * sizeof ( struct ldap_ip ) ) ;
if ( ! ip_list ) {
return False ;
}
ptr = list ;
while ( next_token ( & ptr , tok , " " , sizeof ( tok ) ) ) {
unsigned port = LDAP_PORT ;
char * p = strchr ( tok , ' : ' ) ;
if ( p ) {
* p = 0 ;
port = atoi ( p + 1 ) ;
}
ip_list [ i ] . ip = * interpret_addr2 ( tok ) ;
ip_list [ i ] . port = port ;
if ( ! is_zero_ip ( ip_list [ i ] . ip ) ) {
i + + ;
}
}
free ( list ) ;
count = i ;
/* we sort the list of addresses by closeness to our interfaces. This
tries to prevent us using a DC on the other side of the country */
if ( count > 1 ) {
qsort ( ip_list , count , sizeof ( struct ldap_ip ) ,
QSORT_CAST ldap_ip_compare ) ;
}
for ( i = 0 ; i < count ; i + + ) {
if ( ads_try_connect ( ads , inet_ntoa ( ip_list [ i ] . ip ) , ip_list [ i ] . port ) ) {
free ( ip_list ) ;
return True ;
}
}
SAFE_FREE ( ip_list ) ;
return False ;
}
/* try connecting to a ldap server via netbios */
static BOOL ads_try_netbios ( ADS_STRUCT * ads )
{
2002-11-06 08:14:15 +03:00
struct in_addr * ip_list , pdc_ip ;
2002-08-17 21:00:51 +04:00
int count ;
int i ;
2002-11-13 02:20:50 +03:00
const char * workgroup = ads - > server . workgroup ;
2002-11-23 17:52:34 +03:00
BOOL list_ordered ;
2002-08-17 21:00:51 +04:00
if ( ! workgroup ) {
workgroup = lp_workgroup ( ) ;
}
DEBUG ( 6 , ( " ads_try_netbios: looking for workgroup '%s' \n " , workgroup ) ) ;
/* try the PDC first */
2002-11-06 08:14:15 +03:00
if ( get_pdc_ip ( workgroup , & pdc_ip ) ) {
DEBUG ( 6 , ( " ads_try_netbios: trying server '%s' \n " ,
inet_ntoa ( pdc_ip ) ) ) ;
if ( ads_try_connect ( ads , inet_ntoa ( pdc_ip ) , LDAP_PORT ) )
return True ;
2002-08-17 21:00:51 +04:00
}
/* now any DC, including backups */
2002-11-23 17:52:34 +03:00
if ( get_dc_list ( workgroup , & ip_list , & count , & list_ordered ) ) {
2002-08-17 21:00:51 +04:00
for ( i = 0 ; i < count ; i + + ) {
DEBUG ( 6 , ( " ads_try_netbios: trying server '%s' \n " ,
inet_ntoa ( ip_list [ i ] ) ) ) ;
if ( ads_try_connect ( ads , inet_ntoa ( ip_list [ i ] ) , LDAP_PORT ) ) {
free ( ip_list ) ;
return True ;
}
}
free ( ip_list ) ;
}
return False ;
}
2002-04-10 17:28:03 +04:00
/**
* Connect to the LDAP server
* @ param ads Pointer to an existing ADS_STRUCT
* @ return status of connection
* */
2001-12-19 15:21:12 +03:00
ADS_STATUS ads_connect ( ADS_STRUCT * ads )
2001-11-20 11:54:15 +03:00
{
int version = LDAP_VERSION3 ;
2001-12-19 15:21:12 +03:00
ADS_STATUS status ;
2001-11-20 11:54:15 +03:00
2001-12-05 12:19:25 +03:00
ads - > last_attempt = time ( NULL ) ;
2002-07-15 14:35:28 +04:00
ads - > ld = NULL ;
2002-10-01 22:26:00 +04:00
/* try with a URL based server */
if ( ads - > server . ldap_uri & &
ads_try_connect_uri ( ads ) ) {
goto got_connection ;
}
2002-08-17 21:00:51 +04:00
/* try with a user specified server */
if ( ads - > server . ldap_server & &
ads_try_connect ( ads , ads - > server . ldap_server , LDAP_PORT ) ) {
goto got_connection ;
2002-07-15 14:35:28 +04:00
}
2002-08-17 21:00:51 +04:00
/* try with a smb.conf ads server setting if we are connecting
to the primary workgroup or realm */
if ( ! ads - > server . foreign & &
ads_try_connect ( ads , lp_ads_server ( ) , LDAP_PORT ) ) {
goto got_connection ;
2002-07-15 14:35:28 +04:00
}
2002-08-17 21:00:51 +04:00
/* try via DNS */
if ( ads_try_dns ( ads ) ) {
goto got_connection ;
2002-09-25 19:19:00 +04:00
}
2002-08-17 21:00:51 +04:00
/* try via netbios lookups */
if ( ! lp_disable_netbios ( ) & & ads_try_netbios ( ads ) ) {
goto got_connection ;
2001-11-20 11:54:15 +03:00
}
2002-07-15 14:35:28 +04:00
2002-08-17 21:00:51 +04:00
return ADS_ERROR_SYSTEM ( errno ? errno : ENOENT ) ;
got_connection :
DEBUG ( 3 , ( " Connected to LDAP server %s \n " , inet_ntoa ( ads - > ldap_ip ) ) ) ;
2002-07-15 14:35:28 +04:00
2001-12-19 15:21:12 +03:00
status = ads_server_info ( ads ) ;
if ( ! ADS_ERR_OK ( status ) ) {
2001-12-08 14:18:56 +03:00
DEBUG ( 1 , ( " Failed to get ldap server info \n " ) ) ;
2001-12-19 15:21:12 +03:00
return status ;
2001-12-08 14:18:56 +03:00
}
2001-11-20 11:54:15 +03:00
ldap_set_option ( ads - > ld , LDAP_OPT_PROTOCOL_VERSION , & version ) ;
2002-08-17 21:00:51 +04:00
if ( ! ads - > auth . user_name ) {
/* by default use the machine account */
fstring myname ;
2002-11-13 02:20:50 +03:00
fstrcpy ( myname , global_myname ( ) ) ;
2002-08-17 21:00:51 +04:00
strlower ( myname ) ;
asprintf ( & ads - > auth . user_name , " HOST/%s " , myname ) ;
}
if ( ! ads - > auth . realm ) {
ads - > auth . realm = strdup ( ads - > config . realm ) ;
}
if ( ! ads - > auth . kdc_server ) {
ads - > auth . kdc_server = strdup ( inet_ntoa ( ads - > ldap_ip ) ) ;
}
2002-03-11 07:06:30 +03:00
# if KRB5_DNS_HACK
/* this is a really nasty hack to avoid ADS DNS problems. It needs a patch
to MIT kerberos to work ( tridge ) */
{
char * env ;
2002-08-17 21:00:51 +04:00
asprintf ( & env , " KRB5_KDC_ADDRESS_%s " , ads - > config . realm ) ;
setenv ( env , ads - > auth . kdc_server , 1 ) ;
2002-03-11 07:06:30 +03:00
free ( env ) ;
}
# endif
2002-09-25 19:19:00 +04:00
if ( ads - > auth . flags & ADS_AUTH_NO_BIND ) {
2002-08-17 21:00:51 +04:00
return ADS_SUCCESS ;
}
2002-10-01 22:26:00 +04:00
if ( ads - > auth . flags & ADS_AUTH_ANON_BIND ) {
return ADS_ERROR ( ldap_simple_bind_s ( ads - > ld , NULL , NULL ) ) ;
}
if ( ads - > auth . flags & ADS_AUTH_SIMPLE_BIND ) {
return ADS_ERROR ( ldap_simple_bind_s ( ads - > ld , ads - > auth . user_name , ads - > auth . password ) ) ;
}
2001-12-19 15:21:12 +03:00
return ads_sasl_bind ( ads ) ;
2001-11-20 11:54:15 +03:00
}
2002-07-15 14:35:28 +04:00
/*
Duplicate a struct berval into talloc ' ed memory
*/
static struct berval * dup_berval ( TALLOC_CTX * ctx , const struct berval * in_val )
{
struct berval * value ;
if ( ! in_val ) return NULL ;
value = talloc_zero ( ctx , sizeof ( struct berval ) ) ;
if ( in_val - > bv_len = = 0 ) return value ;
value - > bv_len = in_val - > bv_len ;
value - > bv_val = talloc_memdup ( ctx , in_val - > bv_val , in_val - > bv_len ) ;
return value ;
}
/*
Make a values list out of an array of ( struct berval * )
*/
static struct berval * * ads_dup_values ( TALLOC_CTX * ctx ,
const struct berval * * in_vals )
{
struct berval * * values ;
int i ;
if ( ! in_vals ) return NULL ;
for ( i = 0 ; in_vals [ i ] ; i + + ) ; /* count values */
values = ( struct berval * * ) talloc_zero ( ctx ,
( i + 1 ) * sizeof ( struct berval * ) ) ;
if ( ! values ) return NULL ;
for ( i = 0 ; in_vals [ i ] ; i + + ) {
values [ i ] = dup_berval ( ctx , in_vals [ i ] ) ;
}
return values ;
}
/*
UTF8 - encode a values list out of an array of ( char * )
*/
static char * * ads_push_strvals ( TALLOC_CTX * ctx , const char * * in_vals )
{
char * * values ;
int i ;
if ( ! in_vals ) return NULL ;
for ( i = 0 ; in_vals [ i ] ; i + + ) ; /* count values */
values = ( char * * ) talloc_zero ( ctx , ( i + 1 ) * sizeof ( char * ) ) ;
if ( ! values ) return NULL ;
for ( i = 0 ; in_vals [ i ] ; i + + ) {
2002-08-17 21:00:51 +04:00
push_utf8_talloc ( ctx , & values [ i ] , in_vals [ i ] ) ;
2002-07-15 14:35:28 +04:00
}
return values ;
}
/*
Pull a ( char * ) array out of a UTF8 - encoded values list
*/
static char * * ads_pull_strvals ( TALLOC_CTX * ctx , const char * * in_vals )
{
char * * values ;
int i ;
if ( ! in_vals ) return NULL ;
for ( i = 0 ; in_vals [ i ] ; i + + ) ; /* count values */
values = ( char * * ) talloc_zero ( ctx , ( i + 1 ) * sizeof ( char * ) ) ;
if ( ! values ) return NULL ;
for ( i = 0 ; in_vals [ i ] ; i + + ) {
2002-08-17 21:00:51 +04:00
pull_utf8_talloc ( ctx , & values [ i ] , in_vals [ i ] ) ;
2002-07-15 14:35:28 +04:00
}
return values ;
}
2002-03-19 15:58:38 +03:00
2002-04-10 17:28:03 +04:00
/**
* Do a search with paged results . cookie must be null on the first
* call , and then returned on each subsequent call . It will be null
* again when the entire search is complete
* @ param ads connection to ads server
* @ param bind_path Base dn for the search
* @ param scope Scope of search ( LDAP_BASE | LDAP_ONE | LDAP_SUBTREE )
2002-07-15 14:35:28 +04:00
* @ param exp Search expression - specified in local charset
* @ param attrs Attributes to retrieve - specified in utf8 or ascii
2002-04-10 17:28:03 +04:00
* @ param res * * which will contain results - free res * with ads_msgfree ( )
* @ param count Number of entries retrieved on this page
* @ param cookie The paged results cookie to be returned on subsequent calls
* @ return status of search
* */
2002-03-14 20:48:26 +03:00
ADS_STATUS ads_do_paged_search ( ADS_STRUCT * ads , const char * bind_path ,
int scope , const char * exp ,
const char * * attrs , void * * res ,
2002-04-10 17:28:03 +04:00
int * count , void * * cookie )
2002-03-14 20:48:26 +03:00
{
2002-07-15 14:35:28 +04:00
int rc , i , version ;
char * utf8_exp , * utf8_path , * * search_attrs ;
LDAPControl PagedResults , NoReferrals , * controls [ 3 ] , * * rcontrols ;
2002-04-10 17:28:03 +04:00
BerElement * cookie_be = NULL ;
struct berval * cookie_bv = NULL ;
2002-07-15 14:35:28 +04:00
TALLOC_CTX * ctx ;
2002-03-14 20:48:26 +03:00
* res = NULL ;
2002-07-15 14:35:28 +04:00
if ( ! ( ctx = talloc_init ( ) ) )
return ADS_ERROR ( LDAP_NO_MEMORY ) ;
2002-03-14 20:48:26 +03:00
2002-07-15 14:35:28 +04:00
/* 0 means the conversion worked but the result was empty
so we only fail if it ' s negative . In any case , it always
at least nulls out the dest */
2002-08-17 21:00:51 +04:00
if ( ( push_utf8_talloc ( ctx , & utf8_exp , exp ) < 0 ) | |
( push_utf8_talloc ( ctx , & utf8_path , bind_path ) < 0 ) ) {
2002-07-15 14:35:28 +04:00
rc = LDAP_NO_MEMORY ;
goto done ;
}
if ( ! attrs | | ! ( * attrs ) )
search_attrs = NULL ;
else {
/* This would be the utf8-encoded version...*/
/* if (!(search_attrs = ads_push_strvals(ctx, attrs))) */
2002-11-13 02:20:50 +03:00
if ( ! ( str_list_copy ( & search_attrs , attrs ) ) ) {
2002-07-15 14:35:28 +04:00
rc = LDAP_NO_MEMORY ;
goto done ;
}
}
/* Paged results only available on ldap v3 or later */
ldap_get_option ( ads - > ld , LDAP_OPT_PROTOCOL_VERSION , & version ) ;
if ( version < LDAP_VERSION3 ) {
rc = LDAP_NOT_SUPPORTED ;
goto done ;
}
2002-03-14 20:48:26 +03:00
2002-04-05 23:26:52 +04:00
cookie_be = ber_alloc_t ( LBER_USE_DER ) ;
2002-03-14 20:48:26 +03:00
if ( cookie & & * cookie ) {
2002-04-05 23:26:52 +04:00
ber_printf ( cookie_be , " {iO} " , ( ber_int_t ) 1000 , * cookie ) ;
2002-03-14 20:48:26 +03:00
ber_bvfree ( * cookie ) ; /* don't need it from last time */
2002-03-20 01:14:53 +03:00
* cookie = NULL ;
2002-03-14 20:48:26 +03:00
} else {
2002-04-05 23:26:52 +04:00
ber_printf ( cookie_be , " {io} " , ( ber_int_t ) 1000 , " " , 0 ) ;
2002-03-14 20:48:26 +03:00
}
2002-04-05 23:26:52 +04:00
ber_flatten ( cookie_be , & cookie_bv ) ;
2002-03-14 20:48:26 +03:00
PagedResults . ldctl_oid = ADS_PAGE_CTL_OID ;
2002-03-27 06:09:50 +03:00
PagedResults . ldctl_iscritical = ( char ) 1 ;
2002-04-05 23:26:52 +04:00
PagedResults . ldctl_value . bv_len = cookie_bv - > bv_len ;
PagedResults . ldctl_value . bv_val = cookie_bv - > bv_val ;
2002-03-27 05:58:58 +03:00
NoReferrals . ldctl_oid = ADS_NO_REFERRALS_OID ;
NoReferrals . ldctl_iscritical = ( char ) 0 ;
NoReferrals . ldctl_value . bv_len = 0 ;
NoReferrals . ldctl_value . bv_val = " " ;
2002-04-05 23:26:52 +04:00
2002-03-27 05:58:58 +03:00
controls [ 0 ] = & NoReferrals ;
controls [ 1 ] = & PagedResults ;
2002-04-10 17:28:03 +04:00
controls [ 2 ] = NULL ;
2002-03-14 20:48:26 +03:00
* res = NULL ;
2002-03-19 15:58:38 +03:00
/* we need to disable referrals as the openldap libs don't
2002-07-15 14:35:28 +04:00
handle them and paged results at the same time . Using them
together results in the result record containing the server
page control being removed from the result list ( tridge / jmcd )
2002-03-27 05:58:58 +03:00
leaving this in despite the control that says don ' t generate
referrals , in case the server doesn ' t support it ( jmcd )
*/
2002-03-19 15:58:38 +03:00
ldap_set_option ( ads - > ld , LDAP_OPT_REFERRALS , LDAP_OPT_OFF ) ;
2002-07-15 14:35:28 +04:00
rc = ldap_search_ext_s ( ads - > ld , utf8_path , scope , utf8_exp ,
search_attrs , 0 , controls ,
NULL , NULL , LDAP_NO_LIMIT , ( LDAPMessage * * ) res ) ;
2002-03-19 15:58:38 +03:00
2002-04-05 23:26:52 +04:00
ber_free ( cookie_be , 1 ) ;
ber_bvfree ( cookie_bv ) ;
2002-03-19 15:58:38 +03:00
if ( rc ) {
DEBUG ( 3 , ( " ldap_search_ext_s(%s) -> %s \n " , exp , ldap_err2string ( rc ) ) ) ;
2002-07-15 14:35:28 +04:00
goto done ;
2002-03-19 15:58:38 +03:00
}
2002-03-14 20:48:26 +03:00
rc = ldap_parse_result ( ads - > ld , * res , NULL , NULL , NULL ,
NULL , & rcontrols , 0 ) ;
2002-03-19 15:58:38 +03:00
if ( ! rcontrols ) {
2002-07-15 14:35:28 +04:00
goto done ;
2002-03-19 15:58:38 +03:00
}
2002-04-05 23:26:52 +04:00
for ( i = 0 ; rcontrols [ i ] ; i + + ) {
if ( strcmp ( ADS_PAGE_CTL_OID , rcontrols [ i ] - > ldctl_oid ) = = 0 ) {
cookie_be = ber_init ( & rcontrols [ i ] - > ldctl_value ) ;
ber_scanf ( cookie_be , " {iO} " , ( ber_int_t * ) count ,
& cookie_bv ) ;
2002-03-14 20:48:26 +03:00
/* the berval is the cookie, but must be freed when
it is all done */
2002-04-05 23:26:52 +04:00
if ( cookie_bv - > bv_len ) /* still more to do */
* cookie = ber_bvdup ( cookie_bv ) ;
2002-03-14 20:48:26 +03:00
else
* cookie = NULL ;
2002-04-05 23:26:52 +04:00
ber_bvfree ( cookie_bv ) ;
ber_free ( cookie_be , 1 ) ;
2002-03-14 20:48:26 +03:00
break ;
}
}
ldap_controls_free ( rcontrols ) ;
2002-07-15 14:35:28 +04:00
done :
talloc_destroy ( ctx ) ;
/* if/when we decide to utf8-encode attrs, take out this next line */
str_list_free ( & search_attrs ) ;
2002-03-14 20:48:26 +03:00
return ADS_ERROR ( rc ) ;
}
2002-03-20 01:14:53 +03:00
2002-04-10 17:28:03 +04:00
/**
* Get all results for a search . This uses ads_do_paged_search ( ) to return
* all entries in a large search .
* @ param ads connection to ads server
* @ param bind_path Base dn for the search
* @ param scope Scope of search ( LDAP_BASE | LDAP_ONE | LDAP_SUBTREE )
* @ param exp Search expression
* @ param attrs Attributes to retrieve
* @ param res * * which will contain results - free res * with ads_msgfree ( )
* @ return status of search
* */
2002-03-20 01:14:53 +03:00
ADS_STATUS ads_do_search_all ( ADS_STRUCT * ads , const char * bind_path ,
int scope , const char * exp ,
const char * * attrs , void * * res )
{
void * cookie = NULL ;
int count = 0 ;
ADS_STATUS status ;
2002-04-10 17:28:03 +04:00
status = ads_do_paged_search ( ads , bind_path , scope , exp , attrs , res ,
& count , & cookie ) ;
2002-03-20 01:14:53 +03:00
if ( ! ADS_ERR_OK ( status ) ) return status ;
while ( cookie ) {
void * res2 = NULL ;
ADS_STATUS status2 ;
LDAPMessage * msg , * next ;
2002-04-10 17:28:03 +04:00
status2 = ads_do_paged_search ( ads , bind_path , scope , exp ,
attrs , & res2 , & count , & cookie ) ;
2002-03-20 01:14:53 +03:00
if ( ! ADS_ERR_OK ( status2 ) ) break ;
/* this relies on the way that ldap_add_result_entry() works internally. I hope
that this works on all ldap libs , but I have only tested with openldap */
for ( msg = ads_first_entry ( ads , res2 ) ; msg ; msg = next ) {
next = ads_next_entry ( ads , msg ) ;
ldap_add_result_entry ( ( LDAPMessage * * ) res , msg ) ;
}
/* note that we do not free res2, as the memory is now
part of the main returned list */
}
return status ;
}
2002-04-10 17:28:03 +04:00
/**
* Run a function on all results for a search . Uses ads_do_paged_search ( ) and
* runs the function as each page is returned , using ads_process_results ( )
* @ param ads connection to ads server
* @ param bind_path Base dn for the search
* @ param scope Scope of search ( LDAP_BASE | LDAP_ONE | LDAP_SUBTREE )
2002-07-15 14:35:28 +04:00
* @ param exp Search expression - specified in local charset
* @ param attrs Attributes to retrieve - specified in UTF - 8 or ascii
2002-04-10 17:28:03 +04:00
* @ param fn Function which takes attr name , values list , and data_area
* @ param data_area Pointer which is passed to function on each call
* @ return status of search
* */
ADS_STATUS ads_do_search_all_fn ( ADS_STRUCT * ads , const char * bind_path ,
int scope , const char * exp , const char * * attrs ,
2002-07-15 14:35:28 +04:00
BOOL ( * fn ) ( char * , void * * , void * ) ,
2002-04-10 17:28:03 +04:00
void * data_area )
2002-04-05 23:26:52 +04:00
{
void * cookie = NULL ;
int count = 0 ;
ADS_STATUS status ;
void * res ;
2002-04-10 17:28:03 +04:00
status = ads_do_paged_search ( ads , bind_path , scope , exp , attrs , & res ,
& count , & cookie ) ;
2002-04-05 23:26:52 +04:00
if ( ! ADS_ERR_OK ( status ) ) return status ;
ads_process_results ( ads , res , fn , data_area ) ;
ads_msgfree ( ads , res ) ;
while ( cookie ) {
2002-04-10 17:28:03 +04:00
status = ads_do_paged_search ( ads , bind_path , scope , exp , attrs ,
& res , & count , & cookie ) ;
2002-04-05 23:26:52 +04:00
if ( ! ADS_ERR_OK ( status ) ) break ;
ads_process_results ( ads , res , fn , data_area ) ;
ads_msgfree ( ads , res ) ;
}
return status ;
}
2002-04-10 17:28:03 +04:00
/**
* Do a search with a timeout .
* @ param ads connection to ads server
* @ param bind_path Base dn for the search
* @ param scope Scope of search ( LDAP_BASE | LDAP_ONE | LDAP_SUBTREE )
* @ param exp Search expression
* @ param attrs Attributes to retrieve
* @ param res * * which will contain results - free res * with ads_msgfree ( )
* @ return status of search
* */
2001-12-19 15:21:12 +03:00
ADS_STATUS ads_do_search ( ADS_STRUCT * ads , const char * bind_path , int scope ,
const char * exp ,
const char * * attrs , void * * res )
2001-12-05 12:19:25 +03:00
{
struct timeval timeout ;
2001-12-19 15:21:12 +03:00
int rc ;
2002-07-15 14:35:28 +04:00
char * utf8_exp , * utf8_path , * * search_attrs = NULL ;
TALLOC_CTX * ctx ;
2002-09-25 19:19:00 +04:00
if ( ! ( ctx = talloc_init ( ) ) ) {
DEBUG ( 1 , ( " ads_do_search: talloc_init() failed! " ) ) ;
2002-07-15 14:35:28 +04:00
return ADS_ERROR ( LDAP_NO_MEMORY ) ;
2002-09-25 19:19:00 +04:00
}
2002-07-15 14:35:28 +04:00
/* 0 means the conversion worked but the result was empty
so we only fail if it ' s negative . In any case , it always
at least nulls out the dest */
2002-08-17 21:00:51 +04:00
if ( ( push_utf8_talloc ( ctx , & utf8_exp , exp ) < 0 ) | |
( push_utf8_talloc ( ctx , & utf8_path , bind_path ) < 0 ) ) {
2002-09-25 19:19:00 +04:00
DEBUG ( 1 , ( " ads_do_search: push_utf8_talloc() failed! " ) ) ;
2002-07-15 14:35:28 +04:00
rc = LDAP_NO_MEMORY ;
goto done ;
}
if ( ! attrs | | ! ( * attrs ) )
search_attrs = NULL ;
else {
/* This would be the utf8-encoded version...*/
/* if (!(search_attrs = ads_push_strvals(ctx, attrs))) */
2002-08-17 21:00:51 +04:00
if ( ! ( str_list_copy ( & search_attrs , attrs ) ) )
2002-07-15 14:35:28 +04:00
{
2002-09-25 19:19:00 +04:00
DEBUG ( 1 , ( " ads_do_search: str_list_copy() failed! " ) ) ;
2002-07-15 14:35:28 +04:00
rc = LDAP_NO_MEMORY ;
goto done ;
}
}
2001-12-05 12:19:25 +03:00
2001-12-08 14:18:56 +03:00
timeout . tv_sec = ADS_SEARCH_TIMEOUT ;
timeout . tv_usec = 0 ;
* res = NULL ;
2001-12-05 12:19:25 +03:00
2002-07-15 14:35:28 +04:00
/* see the note in ads_do_paged_search - we *must* disable referrals */
ldap_set_option ( ads - > ld , LDAP_OPT_REFERRALS , LDAP_OPT_OFF ) ;
rc = ldap_search_ext_s ( ads - > ld , utf8_path , scope , utf8_exp ,
search_attrs , 0 , NULL , NULL ,
2001-12-19 15:21:12 +03:00
& timeout , LDAP_NO_LIMIT , ( LDAPMessage * * ) res ) ;
2002-03-14 20:48:26 +03:00
2002-03-13 09:43:52 +03:00
if ( rc = = LDAP_SIZELIMIT_EXCEEDED ) {
DEBUG ( 3 , ( " Warning! sizelimit exceeded in ldap. Truncating. \n " ) ) ;
rc = 0 ;
}
2002-03-14 20:48:26 +03:00
2002-07-15 14:35:28 +04:00
done :
talloc_destroy ( ctx ) ;
/* if/when we decide to utf8-encode attrs, take out this next line */
str_list_free ( & search_attrs ) ;
2001-12-19 15:21:12 +03:00
return ADS_ERROR ( rc ) ;
2001-12-05 12:19:25 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* Do a general ADS search
* @ param ads connection to ads server
* @ param res * * which will contain results - free res * with ads_msgfree ( )
* @ param exp Search expression
* @ param attrs Attributes to retrieve
* @ return status of search
* */
2001-12-19 15:21:12 +03:00
ADS_STATUS ads_search ( ADS_STRUCT * ads , void * * res ,
const char * exp ,
const char * * attrs )
2001-11-25 04:31:07 +03:00
{
2002-08-17 21:00:51 +04:00
return ads_do_search ( ads , ads - > config . bind_path , LDAP_SCOPE_SUBTREE ,
2001-12-08 14:18:56 +03:00
exp , attrs , res ) ;
2001-11-25 04:31:07 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* Do a search on a specific DistinguishedName
* @ param ads connection to ads server
* @ param res * * which will contain results - free res * with ads_msgfree ( )
* @ param dn DistinguishName to search
* @ param attrs Attributes to retrieve
* @ return status of search
* */
2001-12-19 15:21:12 +03:00
ADS_STATUS ads_search_dn ( ADS_STRUCT * ads , void * * res ,
const char * dn ,
const char * * attrs )
2001-12-04 15:08:16 +03:00
{
2001-12-08 14:18:56 +03:00
return ads_do_search ( ads , dn , LDAP_SCOPE_BASE , " (objectclass=*) " , attrs, res) ;
2001-12-04 15:08:16 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* Free up memory from a ads_search
* @ param ads connection to ads server
* @ param msg Search results to free
* */
2001-12-05 09:26:56 +03:00
void ads_msgfree ( ADS_STRUCT * ads , void * msg )
{
if ( ! msg ) return ;
ldap_msgfree ( msg ) ;
}
2001-11-25 04:31:07 +03:00
2002-04-10 17:28:03 +04:00
/**
* Free up memory from various ads requests
* @ param ads connection to ads server
* @ param mem Area to free
* */
2002-02-02 05:04:01 +03:00
void ads_memfree ( ADS_STRUCT * ads , void * mem )
{
2002-07-15 14:35:28 +04:00
SAFE_FREE ( mem ) ;
2002-02-02 05:04:01 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* Get a dn from search results
* @ param ads connection to ads server
* @ param res Search results
* @ return dn string
* */
2002-02-02 05:04:01 +03:00
char * ads_get_dn ( ADS_STRUCT * ads , void * res )
{
2002-07-15 14:35:28 +04:00
char * utf8_dn , * unix_dn ;
utf8_dn = ldap_get_dn ( ads - > ld , res ) ;
pull_utf8_allocate ( ( void * * ) & unix_dn , utf8_dn ) ;
ldap_memfree ( utf8_dn ) ;
return unix_dn ;
2002-02-02 05:04:01 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* Find a machine account given a hostname
* @ param ads connection to ads server
* @ param res * * which will contain results - free res * with ads_msgfree ( )
* @ param host Hostname to search for
* @ return status of search
* */
2001-12-19 15:21:12 +03:00
ADS_STATUS ads_find_machine_acct ( ADS_STRUCT * ads , void * * res , const char * host )
2001-11-20 11:54:15 +03:00
{
2001-12-19 15:21:12 +03:00
ADS_STATUS status ;
2001-11-20 11:54:15 +03:00
char * exp ;
2002-01-03 14:59:33 +03:00
const char * attrs [ ] = { " * " , " nTSecurityDescriptor " , NULL } ;
2001-11-20 11:54:15 +03:00
/* the easiest way to find a machine account anywhere in the tree
is to look for hostname $ */
2002-10-01 22:26:00 +04:00
if ( asprintf ( & exp , " (samAccountName=%s$) " , host ) = = - 1 ) {
DEBUG ( 1 , ( " asprintf failed! \n " ) ) ;
return ADS_ERROR_NT ( NT_STATUS_NO_MEMORY ) ;
}
2002-01-03 14:59:33 +03:00
status = ads_search ( ads , res , exp , attrs ) ;
2001-11-20 11:54:15 +03:00
free ( exp ) ;
2001-12-19 15:21:12 +03:00
return status ;
2001-11-20 11:54:15 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* Initialize a list of mods to be used in a modify request
* @ param ctx An initialized TALLOC_CTX
* @ return allocated ADS_MODLIST
* */
2002-02-12 21:22:33 +03:00
ADS_MODLIST ads_init_mods ( TALLOC_CTX * ctx )
2002-02-01 19:14:33 +03:00
{
2002-02-11 18:47:02 +03:00
# define ADS_MODLIST_ALLOC_SIZE 10
2002-02-01 19:14:33 +03:00
LDAPMod * * mods ;
2002-02-12 21:22:33 +03:00
if ( ( mods = ( LDAPMod * * ) talloc_zero ( ctx , sizeof ( LDAPMod * ) *
( ADS_MODLIST_ALLOC_SIZE + 1 ) ) ) )
2002-02-03 01:06:10 +03:00
/* -1 is safety to make sure we don't go over the end.
need to reset it to NULL before doing ldap modify */
2002-02-11 18:47:02 +03:00
mods [ ADS_MODLIST_ALLOC_SIZE ] = ( LDAPMod * ) - 1 ;
2002-02-01 19:14:33 +03:00
2002-02-11 18:47:02 +03:00
return mods ;
2002-02-01 19:14:33 +03:00
}
2002-07-15 14:35:28 +04:00
2002-02-01 19:14:33 +03:00
/*
add an attribute to the list , with values list already constructed
*/
2002-02-12 21:22:33 +03:00
static ADS_STATUS ads_modlist_add ( TALLOC_CTX * ctx , ADS_MODLIST * mods ,
2002-07-15 14:35:28 +04:00
int mod_op , const char * name ,
const void * * invals )
2002-02-01 19:14:33 +03:00
{
int curmod ;
2002-02-11 18:47:02 +03:00
LDAPMod * * modlist = ( LDAPMod * * ) * mods ;
2002-07-15 14:35:28 +04:00
void * * values ;
if ( ! invals ) {
values = NULL ;
mod_op = LDAP_MOD_DELETE ;
} else {
if ( mod_op & LDAP_MOD_BVALUES )
values = ( void * * ) ads_dup_values ( ctx ,
( const struct berval * * ) invals ) ;
else
values = ( void * * ) ads_push_strvals ( ctx ,
( const char * * ) invals ) ;
}
2002-02-01 19:14:33 +03:00
/* find the first empty slot */
2002-02-06 05:28:46 +03:00
for ( curmod = 0 ; modlist [ curmod ] & & modlist [ curmod ] ! = ( LDAPMod * ) - 1 ;
curmod + + ) ;
2002-02-11 18:47:02 +03:00
if ( modlist [ curmod ] = = ( LDAPMod * ) - 1 ) {
2002-02-12 21:22:33 +03:00
if ( ! ( modlist = talloc_realloc ( ctx , modlist ,
( curmod + ADS_MODLIST_ALLOC_SIZE + 1 ) * sizeof ( LDAPMod * ) ) ) )
2002-02-11 18:47:02 +03:00
return ADS_ERROR ( LDAP_NO_MEMORY ) ;
memset ( & modlist [ curmod ] , 0 ,
ADS_MODLIST_ALLOC_SIZE * sizeof ( LDAPMod * ) ) ;
modlist [ curmod + ADS_MODLIST_ALLOC_SIZE ] = ( LDAPMod * ) - 1 ;
* mods = modlist ;
}
2002-02-06 05:28:46 +03:00
2002-02-12 21:22:33 +03:00
if ( ! ( modlist [ curmod ] = talloc_zero ( ctx , sizeof ( LDAPMod ) ) ) )
2002-02-03 01:06:10 +03:00
return ADS_ERROR ( LDAP_NO_MEMORY ) ;
2002-07-15 14:35:28 +04:00
modlist [ curmod ] - > mod_type = talloc_strdup ( ctx , name ) ;
2002-02-12 21:22:33 +03:00
if ( mod_op & LDAP_MOD_BVALUES )
modlist [ curmod ] - > mod_bvalues = ( struct berval * * ) values ;
else
2002-07-15 14:35:28 +04:00
modlist [ curmod ] - > mod_values = ( char * * ) values ;
2002-02-01 20:13:39 +03:00
modlist [ curmod ] - > mod_op = mod_op ;
2002-02-03 01:06:10 +03:00
return ADS_ERROR ( LDAP_SUCCESS ) ;
2002-02-01 19:14:33 +03:00
}
2002-04-10 17:28:03 +04:00
/**
2002-07-15 14:35:28 +04:00
* Add a single string value to a mod list
2002-04-10 17:28:03 +04:00
* @ param ctx An initialized TALLOC_CTX
* @ param mods An initialized ADS_MODLIST
* @ param name The attribute name to add
2002-07-15 14:35:28 +04:00
* @ param val The value to add - NULL means DELETE
2002-04-10 17:28:03 +04:00
* @ return ADS STATUS indicating success of add
* */
2002-07-15 14:35:28 +04:00
ADS_STATUS ads_mod_str ( TALLOC_CTX * ctx , ADS_MODLIST * mods ,
const char * name , const char * val )
2002-02-01 19:14:33 +03:00
{
2002-09-25 19:19:00 +04:00
const char * values [ 2 ] ;
values [ 0 ] = val ;
values [ 1 ] = NULL ;
2002-07-15 14:35:28 +04:00
if ( ! val )
2002-02-12 21:22:33 +03:00
return ads_modlist_add ( ctx , mods , LDAP_MOD_DELETE , name , NULL ) ;
2002-07-15 14:35:28 +04:00
return ads_modlist_add ( ctx , mods , LDAP_MOD_REPLACE , name ,
( const void * * ) values ) ;
2002-02-01 19:14:33 +03:00
}
2002-04-10 17:28:03 +04:00
/**
2002-07-15 14:35:28 +04:00
* Add an array of string values to a mod list
2002-04-10 17:28:03 +04:00
* @ param ctx An initialized TALLOC_CTX
* @ param mods An initialized ADS_MODLIST
* @ param name The attribute name to add
2002-07-15 14:35:28 +04:00
* @ param vals The array of string values to add - NULL means DELETE
2002-04-10 17:28:03 +04:00
* @ return ADS STATUS indicating success of add
* */
2002-07-15 14:35:28 +04:00
ADS_STATUS ads_mod_strlist ( TALLOC_CTX * ctx , ADS_MODLIST * mods ,
const char * name , const char * * vals )
2002-02-03 01:06:10 +03:00
{
2002-07-15 14:35:28 +04:00
if ( ! vals )
return ads_modlist_add ( ctx , mods , LDAP_MOD_DELETE , name , NULL ) ;
return ads_modlist_add ( ctx , mods , LDAP_MOD_REPLACE ,
name , ( const void * * ) vals ) ;
2002-02-01 19:14:33 +03:00
}
2002-04-10 17:28:03 +04:00
/**
2002-07-15 14:35:28 +04:00
* Add a single ber - encoded value to a mod list
2002-04-10 17:28:03 +04:00
* @ param ctx An initialized TALLOC_CTX
* @ param mods An initialized ADS_MODLIST
* @ param name The attribute name to add
2002-07-15 14:35:28 +04:00
* @ param val The value to add - NULL means DELETE
2002-04-10 17:28:03 +04:00
* @ return ADS STATUS indicating success of add
* */
2002-07-15 14:35:28 +04:00
static ADS_STATUS ads_mod_ber ( TALLOC_CTX * ctx , ADS_MODLIST * mods ,
const char * name , const struct berval * val )
2002-02-12 21:22:33 +03:00
{
2002-09-25 19:19:00 +04:00
const struct berval * values [ 2 ] ;
values [ 0 ] = val ;
values [ 1 ] = NULL ;
2002-02-12 21:22:33 +03:00
if ( ! val )
2002-07-15 14:35:28 +04:00
return ads_modlist_add ( ctx , mods , LDAP_MOD_DELETE , name , NULL ) ;
return ads_modlist_add ( ctx , mods , LDAP_MOD_REPLACE | LDAP_MOD_BVALUES ,
name , ( const void * * ) values ) ;
2002-02-01 19:14:33 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* Perform an ldap modify
* @ param ads connection to ads server
* @ param mod_dn DistinguishedName to modify
* @ param mods list of modifications to perform
* @ return status of modify
* */
2002-02-11 18:47:02 +03:00
ADS_STATUS ads_gen_mod ( ADS_STRUCT * ads , const char * mod_dn , ADS_MODLIST mods )
2002-02-01 19:14:33 +03:00
{
int ret , i ;
2002-07-15 14:35:28 +04:00
char * utf8_dn = NULL ;
2002-02-03 01:06:10 +03:00
/*
2002-02-06 05:28:46 +03:00
this control is needed to modify that contains a currently
non - existent attribute ( but allowable for the object ) to run
2002-02-03 01:06:10 +03:00
*/
2002-02-06 05:28:46 +03:00
LDAPControl PermitModify = {
2002-09-25 19:19:00 +04:00
ADS_PERMIT_MODIFY_OID ,
2002-02-06 05:28:46 +03:00
{ 0 , NULL } ,
( char ) 1 } ;
2002-03-04 04:07:02 +03:00
LDAPControl * controls [ 2 ] ;
controls [ 0 ] = & PermitModify ;
controls [ 1 ] = NULL ;
2002-02-03 01:06:10 +03:00
2002-10-01 22:26:00 +04:00
if ( push_utf8_allocate ( & utf8_dn , mod_dn ) = = - 1 ) {
return ADS_ERROR_NT ( NT_STATUS_NO_MEMORY ) ;
}
2002-07-15 14:35:28 +04:00
2002-02-01 19:14:33 +03:00
/* find the end of the list, marked by NULL or -1 */
2002-02-11 18:47:02 +03:00
for ( i = 0 ; ( mods [ i ] ! = 0 ) & & ( mods [ i ] ! = ( LDAPMod * ) - 1 ) ; i + + ) ;
2002-02-01 19:14:33 +03:00
/* make sure the end of the list is NULL */
mods [ i ] = NULL ;
2002-10-01 22:26:00 +04:00
ret = ldap_modify_ext_s ( ads - > ld , utf8_dn ,
2002-07-15 14:35:28 +04:00
( LDAPMod * * ) mods , controls , NULL ) ;
SAFE_FREE ( utf8_dn ) ;
2002-02-01 19:14:33 +03:00
return ADS_ERROR ( ret ) ;
}
2001-11-20 11:54:15 +03:00
2002-04-10 17:28:03 +04:00
/**
* Perform an ldap add
* @ param ads connection to ads server
* @ param new_dn DistinguishedName to add
* @ param mods list of attributes and values for DN
* @ return status of add
* */
2002-02-12 21:22:33 +03:00
ADS_STATUS ads_gen_add ( ADS_STRUCT * ads , const char * new_dn , ADS_MODLIST mods )
2001-11-20 11:54:15 +03:00
{
2002-07-15 14:35:28 +04:00
int ret , i ;
char * utf8_dn = NULL ;
2001-11-20 11:54:15 +03:00
2002-10-01 22:26:00 +04:00
if ( push_utf8_allocate ( & utf8_dn , new_dn ) = = - 1 ) {
DEBUG ( 1 , ( " ads_gen_add: push_utf8_allocate failed! " ) ) ;
return ADS_ERROR_NT ( NT_STATUS_NO_MEMORY ) ;
}
2002-07-15 14:35:28 +04:00
2002-02-12 21:22:33 +03:00
/* find the end of the list, marked by NULL or -1 */
for ( i = 0 ; ( mods [ i ] ! = 0 ) & & ( mods [ i ] ! = ( LDAPMod * ) - 1 ) ; i + + ) ;
/* make sure the end of the list is NULL */
2001-11-20 11:54:15 +03:00
mods [ i ] = NULL ;
2002-07-15 14:35:28 +04:00
ret = ldap_add_s ( ads - > ld , utf8_dn ? utf8_dn : new_dn , mods ) ;
SAFE_FREE ( utf8_dn ) ;
return ADS_ERROR ( ret ) ;
2001-11-20 11:54:15 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* Delete a DistinguishedName
* @ param ads connection to ads server
* @ param new_dn DistinguishedName to delete
* @ return status of delete
* */
2002-02-02 05:04:01 +03:00
ADS_STATUS ads_del_dn ( ADS_STRUCT * ads , char * del_dn )
{
2002-07-15 14:35:28 +04:00
int ret ;
char * utf8_dn = NULL ;
2002-10-01 22:26:00 +04:00
if ( push_utf8_allocate ( & utf8_dn , del_dn ) = = - 1 ) {
DEBUG ( 1 , ( " ads_del_dn: push_utf8_allocate failed! " ) ) ;
return ADS_ERROR_NT ( NT_STATUS_NO_MEMORY ) ;
}
2002-07-15 14:35:28 +04:00
ret = ldap_delete ( ads - > ld , utf8_dn ? utf8_dn : del_dn ) ;
return ADS_ERROR ( ret ) ;
2002-02-02 05:04:01 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* Build an org unit string
* if org unit is Computers or blank then assume a container , otherwise
* assume a \ separated list of organisational units
* @ param org_unit Organizational unit
* @ return org unit string - caller must free
* */
2002-01-16 05:22:30 +03:00
char * ads_ou_string ( const char * org_unit )
{
if ( ! org_unit | | ! * org_unit | | strcasecmp ( org_unit , " Computers " ) = = 0 ) {
return strdup ( " cn=Computers " ) ;
}
return ads_build_path ( org_unit , " \\ / " , " ou= " , 1 ) ;
}
2001-11-20 11:54:15 +03:00
/*
add a machine account to the ADS server
*/
2001-12-19 15:21:12 +03:00
static ADS_STATUS ads_add_machine_acct ( ADS_STRUCT * ads , const char * hostname ,
const char * org_unit )
2001-11-20 11:54:15 +03:00
{
2001-12-19 15:21:12 +03:00
ADS_STATUS ret ;
2001-11-20 11:54:15 +03:00
char * host_spn , * host_upn , * new_dn , * samAccountName , * controlstr ;
2002-01-16 05:22:30 +03:00
char * ou_str ;
2002-02-12 21:22:33 +03:00
TALLOC_CTX * ctx ;
ADS_MODLIST mods ;
2002-07-15 14:35:28 +04:00
const char * objectClass [ ] = { " top " , " person " , " organizationalPerson " ,
" user " , " computer " , NULL } ;
2002-11-13 02:20:50 +03:00
const char * servicePrincipalName [ 3 ] = { NULL , NULL , NULL } ;
char * psp ;
2002-10-29 17:47:11 +03:00
unsigned acct_control ;
2001-11-20 11:54:15 +03:00
2002-02-12 21:22:33 +03:00
if ( ! ( ctx = talloc_init_named ( " machine_account " ) ) )
return ADS_ERROR ( LDAP_NO_MEMORY ) ;
ret = ADS_ERROR ( LDAP_NO_MEMORY ) ;
if ( ! ( host_spn = talloc_asprintf ( ctx , " HOST/%s " , hostname ) ) )
goto done ;
2002-08-17 21:00:51 +04:00
if ( ! ( host_upn = talloc_asprintf ( ctx , " %s@%s " , host_spn , ads - > config . realm ) ) )
2002-02-12 21:22:33 +03:00
goto done ;
2002-01-16 05:22:30 +03:00
ou_str = ads_ou_string ( org_unit ) ;
2002-10-01 22:26:00 +04:00
if ( ! ou_str ) {
DEBUG ( 1 , ( " ads_ou_string returned NULL (malloc failure?) \n " ) ) ;
goto done ;
}
2002-02-12 21:22:33 +03:00
new_dn = talloc_asprintf ( ctx , " cn=%s,%s,%s " , hostname , ou_str ,
2002-08-17 21:00:51 +04:00
ads - > config . bind_path ) ;
2002-10-29 17:47:11 +03:00
servicePrincipalName [ 0 ] = talloc_asprintf ( ctx , " HOST/%s " , hostname ) ;
2002-11-13 02:20:50 +03:00
psp = talloc_asprintf ( ctx , " HOST/%s.%s " ,
2002-10-29 17:47:11 +03:00
hostname ,
ads - > config . realm ) ;
2002-11-13 02:20:50 +03:00
strlower ( & psp [ 5 ] ) ;
servicePrincipalName [ 1 ] = psp ;
2002-10-29 17:47:11 +03:00
2002-01-16 05:22:30 +03:00
free ( ou_str ) ;
2002-02-12 21:22:33 +03:00
if ( ! new_dn )
goto done ;
if ( ! ( samAccountName = talloc_asprintf ( ctx , " %s$ " , hostname ) ) )
goto done ;
2002-10-29 17:47:11 +03:00
acct_control = UF_WORKSTATION_TRUST_ACCOUNT | UF_DONT_EXPIRE_PASSWD ;
# ifndef ENCTYPE_ARCFOUR_HMAC
acct_control | = UF_USE_DES_KEY_ONLY ;
# endif
if ( ! ( controlstr = talloc_asprintf ( ctx , " %u " , acct_control ) ) )
2002-02-12 21:22:33 +03:00
goto done ;
if ( ! ( mods = ads_init_mods ( ctx ) ) )
goto done ;
2002-07-15 14:35:28 +04:00
ads_mod_str ( ctx , & mods , " cn " , hostname ) ;
ads_mod_str ( ctx , & mods , " sAMAccountName " , samAccountName ) ;
ads_mod_strlist ( ctx , & mods , " objectClass " , objectClass ) ;
ads_mod_str ( ctx , & mods , " userPrincipalName " , host_upn ) ;
2002-10-29 17:47:11 +03:00
ads_mod_strlist ( ctx , & mods , " servicePrincipalName " , servicePrincipalName ) ;
2002-07-15 14:35:28 +04:00
ads_mod_str ( ctx , & mods , " dNSHostName " , hostname ) ;
ads_mod_str ( ctx , & mods , " userAccountControl " , controlstr ) ;
ads_mod_str ( ctx , & mods , " operatingSystem " , " Samba " ) ;
ads_mod_str ( ctx , & mods , " operatingSystemVersion " , VERSION ) ;
2002-02-12 21:22:33 +03:00
2002-03-10 04:54:44 +03:00
ads_gen_add ( ads , new_dn , mods ) ;
ret = ads_set_machine_sd ( ads , hostname , new_dn ) ;
2002-02-12 21:22:33 +03:00
done :
talloc_destroy ( ctx ) ;
2001-11-20 11:54:15 +03:00
return ret ;
}
2001-11-25 04:06:56 +03:00
/*
dump a binary result from ldap
*/
static void dump_binary ( const char * field , struct berval * * values )
{
int i , j ;
for ( i = 0 ; values [ i ] ; i + + ) {
printf ( " %s: " , field ) ;
for ( j = 0 ; j < values [ i ] - > bv_len ; j + + ) {
printf ( " %02X " , ( unsigned char ) values [ i ] - > bv_val [ j ] ) ;
}
printf ( " \n " ) ;
}
}
2002-10-29 17:47:11 +03:00
struct uuid {
uint32 i1 ;
uint16 i2 ;
uint16 i3 ;
uint8 s [ 8 ] ;
} ;
static void dump_guid ( const char * field , struct berval * * values )
{
int i ;
GUID guid ;
for ( i = 0 ; values [ i ] ; i + + ) {
memcpy ( guid . info , values [ i ] - > bv_val , sizeof ( guid . info ) ) ;
printf ( " %s: %s \n " , field , uuid_string_static ( guid ) ) ;
}
}
2001-12-19 11:44:23 +03:00
/*
dump a sid result from ldap
*/
static void dump_sid ( const char * field , struct berval * * values )
{
int i ;
for ( i = 0 ; values [ i ] ; i + + ) {
DOM_SID sid ;
sid_parse ( values [ i ] - > bv_val , values [ i ] - > bv_len , & sid ) ;
printf ( " %s: %s \n " , field , sid_string_static ( & sid ) ) ;
}
}
2002-03-10 04:54:44 +03:00
/*
dump ntSecurityDescriptor
*/
static void dump_sd ( const char * filed , struct berval * * values )
{
prs_struct ps ;
SEC_DESC * psd = 0 ;
TALLOC_CTX * ctx = 0 ;
if ( ! ( ctx = talloc_init_named ( " sec_io_desc " ) ) )
return ;
/* prepare data */
prs_init ( & ps , values [ 0 ] - > bv_len , ctx , UNMARSHALL ) ;
prs_append_data ( & ps , values [ 0 ] - > bv_val , values [ 0 ] - > bv_len ) ;
ps . data_offset = 0 ;
/* parse secdesc */
if ( ! sec_io_desc ( " sd " , & psd , & ps , 1 ) ) {
prs_mem_free ( & ps ) ;
talloc_destroy ( ctx ) ;
return ;
}
if ( psd ) ads_disp_sd ( psd ) ;
prs_mem_free ( & ps ) ;
talloc_destroy ( ctx ) ;
}
2001-11-25 04:06:56 +03:00
/*
dump a string result from ldap
*/
2002-07-15 14:35:28 +04:00
static void dump_string ( const char * field , char * * values )
2001-11-25 04:06:56 +03:00
{
int i ;
for ( i = 0 ; values [ i ] ; i + + ) {
2002-07-15 14:35:28 +04:00
printf ( " %s: %s \n " , field , values [ i ] ) ;
2001-11-25 04:06:56 +03:00
}
}
2001-11-20 11:54:15 +03:00
/*
2002-03-30 00:06:33 +03:00
dump a field from LDAP on stdout
2001-11-20 11:54:15 +03:00
used for debugging
*/
2002-03-30 00:06:33 +03:00
2002-07-15 14:35:28 +04:00
static BOOL ads_dump_field ( char * field , void * * values , void * data_area )
2001-11-20 11:54:15 +03:00
{
2001-11-25 04:06:56 +03:00
struct {
char * name ;
2002-07-15 14:35:28 +04:00
BOOL string ;
2001-11-25 04:06:56 +03:00
void ( * handler ) ( const char * , struct berval * * ) ;
} handlers [ ] = {
2002-10-29 17:47:11 +03:00
{ " objectGUID " , False , dump_guid } ,
2002-07-15 14:35:28 +04:00
{ " nTSecurityDescriptor " , False , dump_sd } ,
2002-08-17 21:00:51 +04:00
{ " dnsRecord " , False , dump_binary } ,
2002-07-15 14:35:28 +04:00
{ " objectSid " , False , dump_sid } ,
{ NULL , True , NULL }
2001-11-25 04:06:56 +03:00
} ;
2002-03-30 00:06:33 +03:00
int i ;
if ( ! field ) { /* must be end of an entry */
printf ( " \n " ) ;
2002-07-15 14:35:28 +04:00
return False ;
2002-03-30 00:06:33 +03:00
}
for ( i = 0 ; handlers [ i ] . name ; i + + ) {
if ( StrCaseCmp ( handlers [ i ] . name , field ) = = 0 ) {
2002-07-15 14:35:28 +04:00
if ( ! values ) /* first time, indicate string or not */
return handlers [ i ] . string ;
2002-03-30 00:06:33 +03:00
handlers [ i ] . handler ( field , ( struct berval * * ) values ) ;
break ;
}
}
if ( ! handlers [ i ] . name ) {
2002-07-15 14:35:28 +04:00
if ( ! values ) /* first time, indicate string conversion */
return True ;
dump_string ( field , ( char * * ) values ) ;
2002-03-30 00:06:33 +03:00
}
2002-07-15 14:35:28 +04:00
return False ;
2002-03-30 00:06:33 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* Dump a result from LDAP on stdout
* used for debugging
* @ param ads connection to ads server
* @ param res Results to dump
* */
2002-03-30 00:06:33 +03:00
void ads_dump ( ADS_STRUCT * ads , void * res )
{
ads_process_results ( ads , res , ads_dump_field , NULL ) ;
}
2002-04-10 17:28:03 +04:00
/**
* Walk through results , calling a function for each entry found .
* The function receives a field name , a berval * array of values ,
* and a data area passed through from the start . The function is
* called once with null for field and values at the end of each
* entry .
* @ param ads connection to ads server
* @ param res Results to process
* @ param fn Function for processing each result
* @ param data_area user - defined area to pass to function
* */
2002-03-30 00:06:33 +03:00
void ads_process_results ( ADS_STRUCT * ads , void * res ,
2002-07-15 14:35:28 +04:00
BOOL ( * fn ) ( char * , void * * , void * ) ,
2002-03-30 00:06:33 +03:00
void * data_area )
{
void * msg ;
2002-07-15 14:35:28 +04:00
TALLOC_CTX * ctx ;
if ( ! ( ctx = talloc_init ( ) ) )
return ;
2002-03-30 00:06:33 +03:00
for ( msg = ads_first_entry ( ads , res ) ; msg ;
msg = ads_next_entry ( ads , msg ) ) {
2002-07-15 14:35:28 +04:00
char * utf8_field ;
2002-03-30 00:06:33 +03:00
BerElement * b ;
2002-07-15 14:35:28 +04:00
for ( utf8_field = ldap_first_attribute ( ads - > ld ,
( LDAPMessage * ) msg , & b ) ;
utf8_field ;
utf8_field = ldap_next_attribute ( ads - > ld ,
( LDAPMessage * ) msg , b ) ) {
struct berval * * ber_vals ;
char * * str_vals , * * utf8_vals ;
char * field ;
BOOL string ;
2002-08-17 21:00:51 +04:00
pull_utf8_talloc ( ctx , & field , utf8_field ) ;
2002-07-15 14:35:28 +04:00
string = fn ( field , NULL , data_area ) ;
if ( string ) {
utf8_vals = ldap_get_values ( ads - > ld ,
( LDAPMessage * ) msg , field ) ;
str_vals = ads_pull_strvals ( ctx ,
( const char * * ) utf8_vals ) ;
fn ( field , ( void * * ) str_vals , data_area ) ;
ldap_value_free ( utf8_vals ) ;
} else {
ber_vals = ldap_get_values_len ( ads - > ld ,
( LDAPMessage * ) msg , field ) ;
fn ( field , ( void * * ) ber_vals , data_area ) ;
ldap_value_free_len ( ber_vals ) ;
}
ldap_memfree ( utf8_field ) ;
2001-11-20 11:54:15 +03:00
}
2002-03-30 00:06:33 +03:00
ber_free ( b , 0 ) ;
2002-07-15 14:35:28 +04:00
talloc_destroy_pool ( ctx ) ;
2002-03-30 00:06:33 +03:00
fn ( NULL , NULL , data_area ) ; /* completed an entry */
2001-11-20 11:54:15 +03:00
}
2002-07-15 14:35:28 +04:00
talloc_destroy ( ctx ) ;
2001-11-20 11:54:15 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* count how many replies are in a LDAPMessage
* @ param ads connection to ads server
* @ param res Results to count
* @ return number of replies
* */
2001-11-20 11:54:15 +03:00
int ads_count_replies ( ADS_STRUCT * ads , void * res )
{
return ldap_count_entries ( ads - > ld , ( LDAPMessage * ) res ) ;
}
2002-04-10 17:28:03 +04:00
/**
* Join a machine to a realm
* Creates the machine account and sets the machine password
* @ param ads connection to ads server
* @ param hostname name of host to add
* @ param org_unit Organizational unit to place machine in
* @ return status of join
* */
2001-12-19 15:21:12 +03:00
ADS_STATUS ads_join_realm ( ADS_STRUCT * ads , const char * hostname , const char * org_unit )
2001-11-20 11:54:15 +03:00
{
2001-12-19 15:21:12 +03:00
ADS_STATUS status ;
2001-11-20 11:54:15 +03:00
LDAPMessage * res ;
2001-11-25 04:06:56 +03:00
char * host ;
/* hostname must be lowercase */
host = strdup ( hostname ) ;
strlower ( host ) ;
2001-11-20 11:54:15 +03:00
2001-12-19 15:21:12 +03:00
status = ads_find_machine_acct ( ads , ( void * * ) & res , host ) ;
if ( ADS_ERR_OK ( status ) & & ads_count_replies ( ads , res ) = = 1 ) {
2002-03-10 04:54:44 +03:00
DEBUG ( 0 , ( " Host account for %s already exists - deleting old account \n " , host ) ) ;
2002-01-11 07:50:45 +03:00
status = ads_leave_realm ( ads , host ) ;
if ( ! ADS_ERR_OK ( status ) ) {
DEBUG ( 0 , ( " Failed to delete host '%s' from the '%s' realm. \n " ,
2002-08-17 21:00:51 +04:00
host , ads - > config . realm ) ) ;
2002-01-11 07:50:45 +03:00
return status ;
}
2001-11-20 11:54:15 +03:00
}
2001-12-19 15:21:12 +03:00
status = ads_add_machine_acct ( ads , host , org_unit ) ;
if ( ! ADS_ERR_OK ( status ) ) {
DEBUG ( 0 , ( " ads_add_machine_acct: %s \n " , ads_errstr ( status ) ) ) ;
return status ;
2001-11-20 11:54:15 +03:00
}
2001-12-19 15:21:12 +03:00
status = ads_find_machine_acct ( ads , ( void * * ) & res , host ) ;
if ( ! ADS_ERR_OK ( status ) ) {
2001-11-20 11:54:15 +03:00
DEBUG ( 0 , ( " Host account test failed \n " ) ) ;
2001-12-19 15:21:12 +03:00
return status ;
2001-11-20 11:54:15 +03:00
}
2001-11-25 04:06:56 +03:00
free ( host ) ;
2001-12-19 15:21:12 +03:00
return status ;
2001-11-24 17:16:41 +03:00
}
2001-11-20 11:54:15 +03:00
2002-04-10 17:28:03 +04:00
/**
* Delete a machine from the realm
* @ param ads connection to ads server
* @ param hostname Machine to remove
* @ return status of delete
* */
2001-12-19 15:21:12 +03:00
ADS_STATUS ads_leave_realm ( ADS_STRUCT * ads , const char * hostname )
2001-11-24 17:16:41 +03:00
{
2001-12-19 15:21:12 +03:00
ADS_STATUS status ;
2001-11-24 17:16:41 +03:00
void * res ;
2001-11-25 04:06:56 +03:00
char * hostnameDN , * host ;
2001-12-19 15:21:12 +03:00
int rc ;
2001-11-25 04:06:56 +03:00
/* hostname must be lowercase */
host = strdup ( hostname ) ;
strlower ( host ) ;
2001-11-24 17:16:41 +03:00
2001-12-19 15:21:12 +03:00
status = ads_find_machine_acct ( ads , & res , host ) ;
if ( ! ADS_ERR_OK ( status ) ) {
2001-11-25 04:06:56 +03:00
DEBUG ( 0 , ( " Host account for %s does not exist. \n " , host ) ) ;
2001-12-19 15:21:12 +03:00
return status ;
2001-11-24 17:16:41 +03:00
}
2002-02-02 05:04:01 +03:00
hostnameDN = ads_get_dn ( ads , ( LDAPMessage * ) res ) ;
2001-11-24 17:16:41 +03:00
rc = ldap_delete_s ( ads - > ld , hostnameDN ) ;
2002-02-02 05:04:01 +03:00
ads_memfree ( ads , hostnameDN ) ;
2001-11-24 17:16:41 +03:00
if ( rc ! = LDAP_SUCCESS ) {
2001-12-19 15:21:12 +03:00
return ADS_ERROR ( rc ) ;
2001-11-24 17:16:41 +03:00
}
2001-12-19 15:21:12 +03:00
status = ads_find_machine_acct ( ads , & res , host ) ;
if ( ADS_ERR_OK ( status ) & & ads_count_replies ( ads , res ) = = 1 ) {
DEBUG ( 0 , ( " Failed to remove host account. \n " ) ) ;
return status ;
2001-11-24 17:16:41 +03:00
}
2001-11-25 04:06:56 +03:00
free ( host ) ;
2001-12-19 15:21:12 +03:00
return status ;
2001-11-20 11:54:15 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* add machine account to existing security descriptor
* @ param ads connection to ads server
* @ param hostname machine to add
* @ param dn DN of security descriptor
* @ return status
* */
2002-03-10 04:54:44 +03:00
ADS_STATUS ads_set_machine_sd ( ADS_STRUCT * ads , const char * hostname , char * dn )
{
const char * attrs [ ] = { " ntSecurityDescriptor " , " objectSid " , 0 } ;
char * exp = 0 ;
size_t sd_size = 0 ;
2002-07-15 14:35:28 +04:00
struct berval bval = { 0 , NULL } ;
2002-03-10 04:54:44 +03:00
prs_struct ps_wire ;
LDAPMessage * res = 0 ;
LDAPMessage * msg = 0 ;
ADS_MODLIST mods = 0 ;
NTSTATUS status ;
ADS_STATUS ret ;
DOM_SID sid ;
SEC_DESC * psd = 0 ;
TALLOC_CTX * ctx = 0 ;
if ( ! ads ) return ADS_ERROR ( LDAP_SERVER_DOWN ) ;
ret = ADS_ERROR ( LDAP_SUCCESS ) ;
2002-10-01 22:26:00 +04:00
if ( asprintf ( & exp , " (samAccountName=%s$) " , hostname ) = = - 1 ) {
DEBUG ( 1 , ( " ads_set_machine_sd: asprintf failed! \n " ) ) ;
return ADS_ERROR_NT ( NT_STATUS_NO_MEMORY ) ;
}
2002-03-10 04:54:44 +03:00
ret = ads_search ( ads , ( void * ) & res , exp , attrs ) ;
if ( ! ADS_ERR_OK ( ret ) ) return ret ;
msg = ads_first_entry ( ads , res ) ;
ads_pull_sid ( ads , msg , attrs [ 1 ] , & sid ) ;
2002-10-01 22:26:00 +04:00
if ( ! ( ctx = talloc_init_named ( " sec_io_desc " ) ) ) {
ret = ADS_ERROR ( LDAP_NO_MEMORY ) ;
goto ads_set_sd_error ;
}
2002-03-10 04:54:44 +03:00
2002-10-01 22:26:00 +04:00
if ( ! ads_pull_sd ( ads , ctx , msg , attrs [ 0 ] , & psd ) ) {
ret = ADS_ERROR_NT ( NT_STATUS_INVALID_PARAMETER ) ;
2002-03-10 04:54:44 +03:00
goto ads_set_sd_error ;
2002-10-01 22:26:00 +04:00
}
2002-03-10 04:54:44 +03:00
status = sec_desc_add_sid ( ctx , & psd , & sid , SEC_RIGHTS_FULL_CTRL , & sd_size ) ;
2002-10-01 22:26:00 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
ret = ADS_ERROR_NT ( status ) ;
2002-03-10 04:54:44 +03:00
goto ads_set_sd_error ;
2002-10-01 22:26:00 +04:00
}
2002-03-10 04:54:44 +03:00
prs_init ( & ps_wire , sd_size , ctx , MARSHALL ) ;
2002-10-01 22:26:00 +04:00
if ( ! sec_io_desc ( " sd_wire " , & psd , & ps_wire , 1 ) ) {
ret = ADS_ERROR ( LDAP_NO_MEMORY ) ;
2002-03-10 04:54:44 +03:00
goto ads_set_sd_error ;
2002-10-01 22:26:00 +04:00
}
2002-03-10 04:54:44 +03:00
#if 0
file_save ( " /tmp/sec_desc.new " , ps_wire . data_p , sd_size ) ;
# endif
if ( ! ( mods = ads_init_mods ( ctx ) ) ) return ADS_ERROR ( LDAP_NO_MEMORY ) ;
2002-07-15 14:35:28 +04:00
bval . bv_len = sd_size ;
bval . bv_val = prs_data_p ( & ps_wire ) ;
ads_mod_ber ( ctx , & mods , attrs [ 0 ] , & bval ) ;
2002-03-10 04:54:44 +03:00
ret = ads_gen_mod ( ads , dn , mods ) ;
ads_set_sd_error :
2002-10-01 22:26:00 +04:00
ads_msgfree ( ads , res ) ;
2002-03-10 04:54:44 +03:00
prs_mem_free ( & ps_wire ) ;
talloc_destroy ( ctx ) ;
2002-10-01 22:26:00 +04:00
return ret ;
2001-11-24 17:16:41 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* pull the first entry from a ADS result
* @ param ads connection to ads server
* @ param res Results of search
* @ return first entry from result
* */
2001-12-03 09:04:18 +03:00
void * ads_first_entry ( ADS_STRUCT * ads , void * res )
{
return ( void * ) ldap_first_entry ( ads - > ld , ( LDAPMessage * ) res ) ;
}
2002-04-10 17:28:03 +04:00
/**
* pull the next entry from a ADS result
* @ param ads connection to ads server
* @ param res Results of search
* @ return next entry from result
* */
2001-12-03 09:04:18 +03:00
void * ads_next_entry ( ADS_STRUCT * ads , void * res )
{
return ( void * ) ldap_next_entry ( ads - > ld , ( LDAPMessage * ) res ) ;
}
2002-04-10 17:28:03 +04:00
/**
* pull a single string from a ADS result
* @ param ads connection to ads server
* @ param mem_ctx TALLOC_CTX to use for allocating result string
* @ param msg Results of search
* @ param field Attribute to retrieve
* @ return Result string in talloc context
* */
2001-12-03 09:04:18 +03:00
char * ads_pull_string ( ADS_STRUCT * ads ,
TALLOC_CTX * mem_ctx , void * msg , const char * field )
{
char * * values ;
2001-12-05 10:35:57 +03:00
char * ret = NULL ;
2002-07-15 14:35:28 +04:00
char * ux_string ;
int rc ;
2001-12-03 09:04:18 +03:00
values = ldap_get_values ( ads - > ld , msg , field ) ;
2001-12-05 10:35:57 +03:00
if ( ! values ) return NULL ;
if ( values [ 0 ] ) {
2002-08-17 21:00:51 +04:00
rc = pull_utf8_talloc ( mem_ctx , & ux_string ,
2002-07-15 14:35:28 +04:00
values [ 0 ] ) ;
if ( rc ! = - 1 )
ret = ux_string ;
2001-12-05 10:35:57 +03:00
}
2001-12-03 09:04:18 +03:00
ldap_value_free ( values ) ;
return ret ;
}
2002-07-15 14:35:28 +04:00
/**
* pull an array of strings from a ADS result
* @ param ads connection to ads server
* @ param mem_ctx TALLOC_CTX to use for allocating result string
* @ param msg Results of search
* @ param field Attribute to retrieve
* @ return Result strings in talloc context
* */
char * * ads_pull_strings ( ADS_STRUCT * ads ,
TALLOC_CTX * mem_ctx , void * msg , const char * field )
{
char * * values ;
char * * ret = NULL ;
int i , n ;
values = ldap_get_values ( ads - > ld , msg , field ) ;
if ( ! values ) return NULL ;
for ( i = 0 ; values [ i ] ; i + + ) /* noop */ ;
n = i ;
ret = talloc ( mem_ctx , sizeof ( char * ) * ( n + 1 ) ) ;
for ( i = 0 ; i < n ; i + + ) {
2002-08-17 21:00:51 +04:00
if ( pull_utf8_talloc ( mem_ctx , & ret [ i ] , values [ i ] ) = = - 1 ) {
2002-07-15 14:35:28 +04:00
return NULL ;
}
}
ret [ i ] = NULL ;
ldap_value_free ( values ) ;
return ret ;
}
2002-04-10 17:28:03 +04:00
/**
* pull a single uint32 from a ADS result
* @ param ads connection to ads server
* @ param msg Results of search
* @ param field Attribute to retrieve
* @ param v Pointer to int to store result
* @ return boolean inidicating success
2001-12-03 09:04:18 +03:00
*/
BOOL ads_pull_uint32 ( ADS_STRUCT * ads ,
void * msg , const char * field , uint32 * v )
{
char * * values ;
values = ldap_get_values ( ads - > ld , msg , field ) ;
2001-12-05 10:35:57 +03:00
if ( ! values ) return False ;
if ( ! values [ 0 ] ) {
ldap_value_free ( values ) ;
return False ;
}
2001-12-03 09:04:18 +03:00
* v = atoi ( values [ 0 ] ) ;
ldap_value_free ( values ) ;
return True ;
}
2002-04-10 17:28:03 +04:00
/**
* pull a single DOM_SID from a ADS result
* @ param ads connection to ads server
* @ param msg Results of search
* @ param field Attribute to retrieve
* @ param sid Pointer to sid to store result
* @ return boolean inidicating success
2001-12-03 09:04:18 +03:00
*/
BOOL ads_pull_sid ( ADS_STRUCT * ads ,
void * msg , const char * field , DOM_SID * sid )
{
struct berval * * values ;
2001-12-05 10:35:57 +03:00
BOOL ret = False ;
2001-12-03 09:04:18 +03:00
values = ldap_get_values_len ( ads - > ld , msg , field ) ;
2001-12-05 10:35:57 +03:00
if ( ! values ) return False ;
2001-12-03 09:04:18 +03:00
2001-12-05 10:35:57 +03:00
if ( values [ 0 ] ) {
ret = sid_parse ( values [ 0 ] - > bv_val , values [ 0 ] - > bv_len , sid ) ;
}
2001-12-03 09:04:18 +03:00
ldap_value_free_len ( values ) ;
return ret ;
}
2002-04-10 17:28:03 +04:00
/**
* pull an array of DOM_SIDs from a ADS result
* @ param ads connection to ads server
* @ param mem_ctx TALLOC_CTX for allocating sid array
* @ param msg Results of search
* @ param field Attribute to retrieve
* @ param sids pointer to sid array to allocate
* @ return the count of SIDs pulled
* */
2001-12-04 15:08:16 +03:00
int ads_pull_sids ( ADS_STRUCT * ads , TALLOC_CTX * mem_ctx ,
void * msg , const char * field , DOM_SID * * sids )
{
struct berval * * values ;
BOOL ret ;
int count , i ;
values = ldap_get_values_len ( ads - > ld , msg , field ) ;
if ( ! values ) return 0 ;
for ( i = 0 ; values [ i ] ; i + + ) /* nop */ ;
( * sids ) = talloc ( mem_ctx , sizeof ( DOM_SID ) * i ) ;
count = 0 ;
for ( i = 0 ; values [ i ] ; i + + ) {
ret = sid_parse ( values [ i ] - > bv_val , values [ i ] - > bv_len , & ( * sids ) [ count ] ) ;
if ( ret ) count + + ;
}
ldap_value_free_len ( values ) ;
return count ;
}
2002-10-01 22:26:00 +04:00
/**
* pull a SEC_DESC from a ADS result
* @ param ads connection to ads server
* @ param mem_ctx TALLOC_CTX for allocating sid array
* @ param msg Results of search
* @ param field Attribute to retrieve
* @ param sd Pointer to * SEC_DESC to store result ( talloc ( ) ed )
* @ return boolean inidicating success
*/
BOOL ads_pull_sd ( ADS_STRUCT * ads , TALLOC_CTX * mem_ctx ,
void * msg , const char * field , SEC_DESC * * sd )
{
struct berval * * values ;
prs_struct ps ;
BOOL ret = False ;
values = ldap_get_values_len ( ads - > ld , msg , field ) ;
if ( ! values ) return False ;
if ( values [ 0 ] ) {
prs_init ( & ps , values [ 0 ] - > bv_len , mem_ctx , UNMARSHALL ) ;
prs_append_data ( & ps , values [ 0 ] - > bv_val , values [ 0 ] - > bv_len ) ;
ps . data_offset = 0 ;
ret = sec_io_desc ( " sd " , sd , & ps , 1 ) ;
}
ldap_value_free_len ( values ) ;
return ret ;
}
/*
* in order to support usernames longer than 21 characters we need to
* use both the sAMAccountName and the userPrincipalName attributes
* It seems that not all users have the userPrincipalName attribute set
*
* @ param ads connection to ads server
* @ param mem_ctx TALLOC_CTX for allocating sid array
* @ param msg Results of search
* @ return the username
*/
char * ads_pull_username ( ADS_STRUCT * ads , TALLOC_CTX * mem_ctx , void * msg )
{
char * ret , * p ;
ret = ads_pull_string ( ads , mem_ctx , msg , " userPrincipalName " ) ;
if ( ret & & ( p = strchr ( ret , ' @ ' ) ) ) {
* p = 0 ;
return ret ;
}
return ads_pull_string ( ads , mem_ctx , msg , " sAMAccountName " ) ;
}
2001-12-03 09:04:18 +03:00
2002-04-10 17:28:03 +04:00
/**
* find the update serial number - this is the core of the ldap cache
* @ param ads connection to ads server
* @ param ads connection to ADS server
* @ param usn Pointer to retrieved update serial number
* @ return status of search
* */
2001-12-19 15:21:12 +03:00
ADS_STATUS ads_USN ( ADS_STRUCT * ads , uint32 * usn )
2001-11-28 06:56:30 +03:00
{
const char * attrs [ ] = { " highestCommittedUSN " , NULL } ;
2001-12-19 15:21:12 +03:00
ADS_STATUS status ;
2001-11-28 06:56:30 +03:00
void * res ;
2001-12-19 15:21:12 +03:00
status = ads_do_search ( ads , " " , LDAP_SCOPE_BASE , " (objectclass=*) " , attrs , & res ) ;
if ( ! ADS_ERR_OK ( status ) ) return status ;
if ( ads_count_replies ( ads , res ) ! = 1 ) {
return ADS_ERROR ( LDAP_NO_RESULTS_RETURNED ) ;
}
ads_pull_uint32 ( ads , res , " highestCommittedUSN " , usn ) ;
2001-12-05 12:19:25 +03:00
ads_msgfree ( ads , res ) ;
2001-12-19 15:21:12 +03:00
return ADS_SUCCESS ;
2001-11-28 06:56:30 +03:00
}
2002-09-25 19:19:00 +04:00
/* parse a ADS timestring - typical string is
' 20020917091222.0 Z0 ' which means 09 : 12.22 17 th September
2002 , timezone 0 */
static time_t ads_parse_time ( const char * str )
{
struct tm tm ;
ZERO_STRUCT ( tm ) ;
if ( sscanf ( str , " %4d%2d%2d%2d%2d%2d " ,
& tm . tm_year , & tm . tm_mon , & tm . tm_mday ,
& tm . tm_hour , & tm . tm_min , & tm . tm_sec ) ! = 6 ) {
return 0 ;
}
tm . tm_year - = 1900 ;
tm . tm_mon - = 1 ;
return timegm ( & tm ) ;
}
2001-12-03 09:04:18 +03:00
2002-04-10 17:28:03 +04:00
/**
* Find the servers name and realm - this can be done before authentication
* The ldapServiceName field on w2k looks like this :
* vnet3 . home . samba . org : win2000 - vnet3 $ @ VNET3 . HOME . SAMBA . ORG
* @ param ads connection to ads server
* @ return status of search
* */
2001-12-19 15:21:12 +03:00
ADS_STATUS ads_server_info ( ADS_STRUCT * ads )
2001-12-08 14:18:56 +03:00
{
2002-09-25 19:19:00 +04:00
const char * attrs [ ] = { " ldapServiceName " , " currentTime " , NULL } ;
2001-12-19 15:21:12 +03:00
ADS_STATUS status ;
2001-12-08 14:18:56 +03:00
void * res ;
2002-09-25 19:19:00 +04:00
char * value ;
2001-12-08 15:00:27 +03:00
char * p ;
2002-09-25 19:19:00 +04:00
char * timestr ;
TALLOC_CTX * ctx ;
if ( ! ( ctx = talloc_init ( ) ) ) {
return ADS_ERROR ( LDAP_NO_MEMORY ) ;
}
2001-12-08 14:18:56 +03:00
2001-12-19 15:21:12 +03:00
status = ads_do_search ( ads , " " , LDAP_SCOPE_BASE , " (objectclass=*) " , attrs , & res ) ;
if ( ! ADS_ERR_OK ( status ) ) return status ;
2001-12-08 14:18:56 +03:00
2002-09-25 19:19:00 +04:00
value = ads_pull_string ( ads , ctx , res , " ldapServiceName " ) ;
if ( ! value ) {
return ADS_ERROR ( LDAP_NO_RESULTS_RETURNED ) ;
}
timestr = ads_pull_string ( ads , ctx , res , " currentTime " ) ;
if ( ! timestr ) {
return ADS_ERROR ( LDAP_NO_RESULTS_RETURNED ) ;
}
ldap_msgfree ( res ) ;
2001-12-08 14:18:56 +03:00
2002-09-25 19:19:00 +04:00
p = strchr ( value , ' : ' ) ;
2001-12-08 14:18:56 +03:00
if ( ! p ) {
2002-09-25 19:19:00 +04:00
talloc_destroy ( ctx ) ;
DEBUG ( 1 , ( " ads_server_info: returned ldap server name did not contain a ':' so was deemed invalid \n " ) ) ;
2001-12-19 15:21:12 +03:00
return ADS_ERROR ( LDAP_DECODING_ERROR ) ;
2001-12-08 14:18:56 +03:00
}
2002-08-17 21:00:51 +04:00
SAFE_FREE ( ads - > config . ldap_server_name ) ;
2001-12-08 14:18:56 +03:00
2002-08-17 21:00:51 +04:00
ads - > config . ldap_server_name = strdup ( p + 1 ) ;
p = strchr ( ads - > config . ldap_server_name , ' $ ' ) ;
2001-12-08 14:18:56 +03:00
if ( ! p | | p [ 1 ] ! = ' @ ' ) {
2002-09-25 19:19:00 +04:00
talloc_destroy ( ctx ) ;
2002-11-16 00:43:57 +03:00
DEBUG ( 1 , ( " ads_server_info: returned ldap server name (%s) does not contain '$@' so was deemed invalid \n " , ads - > config . ldap_server_name ) ) ;
2002-08-17 21:00:51 +04:00
SAFE_FREE ( ads - > config . ldap_server_name ) ;
2001-12-19 15:21:12 +03:00
return ADS_ERROR ( LDAP_DECODING_ERROR ) ;
2001-12-08 14:18:56 +03:00
}
* p = 0 ;
2002-08-17 21:00:51 +04:00
SAFE_FREE ( ads - > config . realm ) ;
SAFE_FREE ( ads - > config . bind_path ) ;
2001-12-19 11:44:23 +03:00
2002-08-17 21:00:51 +04:00
ads - > config . realm = strdup ( p + 2 ) ;
ads - > config . bind_path = ads_build_dn ( ads - > config . realm ) ;
2001-12-08 14:18:56 +03:00
2002-10-01 22:26:00 +04:00
DEBUG ( 3 , ( " got ldap server name %s@%s, using bind path: %s \n " ,
ads - > config . ldap_server_name , ads - > config . realm ,
ads - > config . bind_path ) ) ;
2001-12-08 14:18:56 +03:00
2002-09-25 19:19:00 +04:00
ads - > config . current_time = ads_parse_time ( timestr ) ;
if ( ads - > config . current_time ! = 0 ) {
ads - > auth . time_offset = ads - > config . current_time - time ( NULL ) ;
DEBUG ( 4 , ( " time offset is %d seconds \n " , ads - > auth . time_offset ) ) ;
}
talloc_destroy ( ctx ) ;
2001-12-19 15:21:12 +03:00
return ADS_SUCCESS ;
2001-12-08 14:18:56 +03:00
}
2001-12-03 09:04:18 +03:00
2001-12-19 11:44:23 +03:00
2002-04-10 17:28:03 +04:00
/**
* find the list of trusted domains
* @ param ads connection to ads server
* @ param mem_ctx TALLOC_CTX for allocating results
* @ param num_trusts pointer to number of trusts
* @ param names pointer to trusted domain name list
* @ param sids pointer to list of sids of trusted domains
* @ return the count of SIDs pulled
* */
2001-12-19 15:21:12 +03:00
ADS_STATUS ads_trusted_domains ( ADS_STRUCT * ads , TALLOC_CTX * mem_ctx ,
2002-08-17 21:00:51 +04:00
int * num_trusts ,
char * * * names ,
char * * * alt_names ,
DOM_SID * * sids )
2001-12-19 11:44:23 +03:00
{
2002-08-17 21:00:51 +04:00
const char * attrs [ ] = { " name " , " flatname " , " securityIdentifier " ,
" trustDirection " , NULL } ;
2001-12-19 15:21:12 +03:00
ADS_STATUS status ;
2001-12-19 11:44:23 +03:00
void * res , * msg ;
int count , i ;
* num_trusts = 0 ;
2001-12-19 15:21:12 +03:00
status = ads_search ( ads , & res , " (objectcategory=trustedDomain) " , attrs ) ;
if ( ! ADS_ERR_OK ( status ) ) return status ;
2001-12-19 11:44:23 +03:00
count = ads_count_replies ( ads , res ) ;
if ( count = = 0 ) {
ads_msgfree ( ads , res ) ;
2001-12-19 15:21:12 +03:00
return ADS_ERROR ( LDAP_NO_RESULTS_RETURNED ) ;
2001-12-19 11:44:23 +03:00
}
( * names ) = talloc ( mem_ctx , sizeof ( char * ) * count ) ;
2002-08-17 21:00:51 +04:00
( * alt_names ) = talloc ( mem_ctx , sizeof ( char * ) * count ) ;
2001-12-19 11:44:23 +03:00
( * sids ) = talloc ( mem_ctx , sizeof ( DOM_SID ) * count ) ;
2001-12-19 15:21:12 +03:00
if ( ! * names | | ! * sids ) return ADS_ERROR ( LDAP_NO_MEMORY ) ;
2001-12-19 11:44:23 +03:00
for ( i = 0 , msg = ads_first_entry ( ads , res ) ; msg ; msg = ads_next_entry ( ads , msg ) ) {
2002-08-17 21:00:51 +04:00
uint32 direction ;
/* direction is a 2 bit bitfield, 1 means they trust us
but we don ' t trust them , so we should not list them
as users from that domain can ' t login */
if ( ads_pull_uint32 ( ads , msg , " trustDirection " , & direction ) & &
direction = = 1 ) {
continue ;
}
( * names ) [ i ] = ads_pull_string ( ads , mem_ctx , msg , " name " ) ;
( * alt_names ) [ i ] = ads_pull_string ( ads , mem_ctx , msg , " flatname " ) ;
if ( ( * alt_names ) [ i ] & & ( * alt_names ) [ i ] [ 0 ] ) {
/* we prefer the flatname as the primary name
for consistency with RPC */
char * name = ( * alt_names ) [ i ] ;
( * alt_names ) [ i ] = ( * names ) [ i ] ;
( * names ) [ i ] = name ;
}
2002-02-07 05:44:37 +03:00
if ( ads_pull_sid ( ads , msg , " securityIdentifier " , & ( * sids ) [ i ] ) ) {
i + + ;
}
2001-12-19 11:44:23 +03:00
}
ads_msgfree ( ads , res ) ;
* num_trusts = i ;
2001-12-19 15:21:12 +03:00
return ADS_SUCCESS ;
2001-12-19 11:44:23 +03:00
}
2002-04-10 17:28:03 +04:00
/**
* find the domain sid for our domain
* @ param ads connection to ads server
* @ param sid Pointer to domain sid
* @ return status of search
* */
2001-12-21 02:35:14 +03:00
ADS_STATUS ads_domain_sid ( ADS_STRUCT * ads , DOM_SID * sid )
{
const char * attrs [ ] = { " objectSid " , NULL } ;
void * res ;
ADS_STATUS rc ;
2002-08-17 21:00:51 +04:00
rc = ads_do_search ( ads , ads - > config . bind_path , LDAP_SCOPE_BASE , " (objectclass=*) " ,
2001-12-21 02:35:14 +03:00
attrs , & res ) ;
if ( ! ADS_ERR_OK ( rc ) ) return rc ;
if ( ! ads_pull_sid ( ads , res , " objectSid " , sid ) ) {
return ADS_ERROR_SYSTEM ( ENOENT ) ;
}
ads_msgfree ( ads , res ) ;
return ADS_SUCCESS ;
}
2002-08-17 21:00:51 +04:00
/* this is rather complex - we need to find the allternate (netbios) name
for the domain , but there isn ' t a simple query to do this . Instead
we look for the principle names on the DCs account and find one that has
the right form , then extract the netbios name of the domain from that
*/
ADS_STATUS ads_workgroup_name ( ADS_STRUCT * ads , TALLOC_CTX * mem_ctx , char * * workgroup )
{
char * exp ;
ADS_STATUS rc ;
char * * principles ;
char * prefix ;
int prefix_length ;
int i ;
void * res ;
const char * attrs [ ] = { " servicePrincipalName " , NULL } ;
( * workgroup ) = NULL ;
asprintf ( & exp , " (&(objectclass=computer)(dnshostname=%s.%s)) " ,
ads - > config . ldap_server_name , ads - > config . realm ) ;
rc = ads_search ( ads , & res , exp , attrs ) ;
free ( exp ) ;
if ( ! ADS_ERR_OK ( rc ) ) {
return rc ;
}
principles = ads_pull_strings ( ads , mem_ctx , res , " servicePrincipalName " ) ;
ads_msgfree ( ads , res ) ;
if ( ! principles ) {
return ADS_ERROR ( LDAP_NO_RESULTS_RETURNED ) ;
}
asprintf ( & prefix , " HOST/%s.%s/ " ,
ads - > config . ldap_server_name ,
ads - > config . realm ) ;
prefix_length = strlen ( prefix ) ;
for ( i = 0 ; principles [ i ] ; i + + ) {
if ( strncasecmp ( principles [ i ] , prefix , prefix_length ) = = 0 & &
strcasecmp ( ads - > config . realm , principles [ i ] + prefix_length ) ! = 0 & &
! strchr ( principles [ i ] + prefix_length , ' . ' ) ) {
/* found an alternate (short) name for the domain. */
DEBUG ( 3 , ( " Found alternate name '%s' for realm '%s' \n " ,
principles [ i ] + prefix_length ,
ads - > config . realm ) ) ;
( * workgroup ) = talloc_strdup ( mem_ctx , principles [ i ] + prefix_length ) ;
break ;
}
}
free ( prefix ) ;
if ( ! * workgroup ) {
return ADS_ERROR ( LDAP_NO_RESULTS_RETURNED ) ;
}
return ADS_SUCCESS ;
}
2001-11-20 11:54:15 +03:00
# endif