sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-25 06:04:04 +03:00
Code

s4:ldap_server: rewrite to socket layer to use tstream

Browse Source 
This should make our sasl and tls handling much more robust
against partial sent pdus.

metze
This commit is contained in:
Stefan Metzmacher 2010-09-22 14:24:03 +02:00 committed by Matthieu Patou
parent b5f2633f7a
commit b53fbc75ac
4 changed files with 713 additions and 324 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

99
source4/ldap_server/ldap_bind.c
View File

@ -25,7 +25,9 @@
#include "lib/ldb/include/ldb_errors.h" #include "lib/ldb/include/ldb_errors.h"
#include "dsdb/samdb/samdb.h" #include "dsdb/samdb/samdb.h"
#include "auth/gensec/gensec.h" #include "auth/gensec/gensec.h"
#include "auth/gensec/gensec_tstream.h"
#include "param/param.h" #include "param/param.h"
#include "../lib/util/tevent_ntstatus.h"
static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call) static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
{ {
@ -94,20 +96,42 @@ static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
return NT_STATUS_OK; return NT_STATUS_OK;
} }
struct ldapsrv_sasl_context { struct ldapsrv_sasl_postprocess_context {
struct ldapsrv_connection *conn; struct ldapsrv_connection *conn;
struct socket_context *sasl_socket; struct tstream_context *sasl;
}; };
static void ldapsrv_set_sasl(void *private_data) struct ldapsrv_sasl_postprocess_state {
{ uint8_t dummy;
struct ldapsrv_sasl_context *ctx = talloc_get_type(private_data, struct ldapsrv_sasl_context); };
talloc_steal(ctx->conn->connection, ctx->sasl_socket);
talloc_unlink(ctx->conn->connection, ctx->conn->connection->socket);
ctx->conn->sockets.sasl = ctx->sasl_socket; static struct tevent_req *ldapsrv_sasl_postprocess_send(TALLOC_CTX *mem_ctx,
ctx->conn->connection->socket = ctx->sasl_socket; struct tevent_context *ev,
packet_set_socket(ctx->conn->packet, ctx->conn->connection->socket); void *private_data)
{
struct ldapsrv_sasl_postprocess_context *context =
talloc_get_type_abort(private_data,
struct ldapsrv_sasl_postprocess_context);
struct tevent_req *req;
struct ldapsrv_sasl_postprocess_state *state;
req = tevent_req_create(mem_ctx, &state,
struct ldapsrv_sasl_postprocess_state);
if (req == NULL) {
return NULL;
}
TALLOC_FREE(context->conn->sockets.sasl);
context->conn->sockets.sasl = talloc_move(context->conn, &context->sasl);
context->conn->sockets.active = context->conn->sockets.sasl;
tevent_req_done(req);
return tevent_req_post(req, ev);
}
static NTSTATUS ldapsrv_sasl_postprocess_recv(struct tevent_req *req)
{
return tevent_req_simple_recv_ntstatus(req);
} }
static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call) static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
@ -152,7 +176,7 @@ static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
errstr = talloc_asprintf(reply, "SASL: Failed to start authentication system: %s", errstr = talloc_asprintf(reply, "SASL: Failed to start authentication system: %s",
nt_errstr(status)); nt_errstr(status));
} else { } else {
gensec_want_feature(conn->gensec, GENSEC_FEATURE_SIGN); gensec_want_feature(conn->gensec, GENSEC_FEATURE_SIGN);
gensec_want_feature(conn->gensec, GENSEC_FEATURE_SEAL); gensec_want_feature(conn->gensec, GENSEC_FEATURE_SEAL);
gensec_want_feature(conn->gensec, GENSEC_FEATURE_ASYNC_REPLIES); gensec_want_feature(conn->gensec, GENSEC_FEATURE_ASYNC_REPLIES);
@ -193,27 +217,41 @@ static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
errstr = NULL; errstr = NULL;
} else if (NT_STATUS_IS_OK(status)) { } else if (NT_STATUS_IS_OK(status)) {
struct auth_session_info *old_session_info=NULL; struct auth_session_info *old_session_info=NULL;
struct ldapsrv_sasl_context *ctx; struct ldapsrv_sasl_postprocess_context *context = NULL;
result = LDAP_SUCCESS; result = LDAP_SUCCESS;
errstr = NULL; errstr = NULL;
ctx = talloc(call, struct ldapsrv_sasl_context); if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
if (!ctx) { context = talloc(call, struct ldapsrv_sasl_postprocess_context);
status = NT_STATUS_NO_MEMORY;
} else {
ctx->conn = conn;
status = gensec_socket_init(conn->gensec,
conn->connection,
conn->connection->socket,
conn->connection->event.ctx,
stream_io_handler_callback,
conn->connection,
&ctx->sasl_socket);
}
if (!ctx || !NT_STATUS_IS_OK(status)) { if (!context) {
status = NT_STATUS_NO_MEMORY;
}
}
if (context && conn->sockets.tls) {
TALLOC_FREE(context);
status = NT_STATUS_NOT_SUPPORTED;
result = LDAP_UNWILLING_TO_PERFORM;
errstr = talloc_asprintf(reply,
"SASL:[%s]: Sign or Seal are not allowed if TLS is used",
req->creds.SASL.mechanism);
}
if (context) {
context->conn = conn;
status = gensec_create_tstream(context,
context->conn->gensec,
context->conn->sockets.raw,
&context->sasl);
}
if (result != LDAP_SUCCESS) {
conn->session_info = old_session_info;
} else if (!NT_STATUS_IS_OK(status)) {
conn->session_info = old_session_info; conn->session_info = old_session_info;
result = LDAP_OPERATIONS_ERROR; result = LDAP_OPERATIONS_ERROR;
errstr = talloc_asprintf(reply, errstr = talloc_asprintf(reply,
@ -221,9 +259,6 @@ static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
req->creds.SASL.mechanism, nt_errstr(status)); req->creds.SASL.mechanism, nt_errstr(status));
} else { } else {
call->send_callback = ldapsrv_set_sasl;
call->send_private = ctx;
old_session_info = conn->session_info; old_session_info = conn->session_info;
conn->session_info = NULL; conn->session_info = NULL;
status = gensec_session_info(conn->gensec, &conn->session_info); status = gensec_session_info(conn->gensec, &conn->session_info);
@ -251,6 +286,12 @@ static NTSTATUS ldapsrv_BindSASL(struct ldapsrv_call *call)
} }
} }
} }
if (NT_STATUS_IS_OK(status) && context) {
call->postprocess_send = ldapsrv_sasl_postprocess_send;
call->postprocess_recv = ldapsrv_sasl_postprocess_recv;
call->postprocess_private = context;
}
} else { } else {
status = auth_nt_status_squash(status); status = auth_nt_status_squash(status);
if (result == 0) { if (result == 0) {

107
source4/ldap_server/ldap_extended.c
View File

@ -22,28 +22,91 @@
#include "../lib/util/dlinklist.h" #include "../lib/util/dlinklist.h"
#include "lib/tls/tls.h" #include "lib/tls/tls.h"
#include "smbd/service_stream.h" #include "smbd/service_stream.h"
#include "../lib/util/tevent_ntstatus.h"
struct ldapsrv_starttls_context { struct ldapsrv_starttls_postprocess_context {
struct ldapsrv_connection *conn; struct ldapsrv_connection *conn;
struct socket_context *tls_socket;
}; };
static void ldapsrv_start_tls(void *private_data) struct ldapsrv_starttls_postprocess_state {
{ struct ldapsrv_connection *conn;
struct ldapsrv_starttls_context *ctx = talloc_get_type(private_data, struct ldapsrv_starttls_context); };
talloc_steal(ctx->conn->connection, ctx->tls_socket);
ctx->conn->sockets.tls = ctx->tls_socket; static void ldapsrv_starttls_postprocess_done(struct tevent_req *subreq);
ctx->conn->connection->socket = ctx->tls_socket;
packet_set_socket(ctx->conn->packet, ctx->conn->connection->socket); static struct tevent_req *ldapsrv_starttls_postprocess_send(TALLOC_CTX *mem_ctx,
packet_set_unreliable_select(ctx->conn->packet); struct tevent_context *ev,
void *private_data)
{
struct ldapsrv_starttls_postprocess_context *context =
talloc_get_type_abort(private_data,
struct ldapsrv_starttls_postprocess_context);
struct ldapsrv_connection *conn = context->conn;
struct tevent_req *req;
struct ldapsrv_starttls_postprocess_state *state;
struct tevent_req *subreq;
req = tevent_req_create(mem_ctx, &state,
struct ldapsrv_starttls_postprocess_state);
if (req == NULL) {
return NULL;
}
state->conn = conn;
subreq = tstream_tls_accept_send(conn,
conn->connection->event.ctx,
conn->sockets.raw,
conn->service->tls_params);
if (tevent_req_nomem(subreq, req)) {
return tevent_req_post(req, ev);
}
tevent_req_set_callback(subreq, ldapsrv_starttls_postprocess_done, req);
return req;
}
static void ldapsrv_starttls_postprocess_done(struct tevent_req *subreq)
{
struct tevent_req *req =
tevent_req_callback_data(subreq,
struct tevent_req);
struct ldapsrv_starttls_postprocess_state *state =
tevent_req_data(req,
struct ldapsrv_starttls_postprocess_state);
struct ldapsrv_connection *conn = state->conn;
int ret;
int sys_errno;
ret = tstream_tls_accept_recv(subreq, &sys_errno,
conn, &conn->sockets.tls);
TALLOC_FREE(subreq);
if (ret == -1) {
NTSTATUS status = map_nt_error_from_unix(sys_errno);
DEBUG(1,("ldapsrv_starttls_postprocess_done: accept_tls_loop: "
"tstream_tls_accept_recv() - %d:%s => %s",
sys_errno, strerror(sys_errno), nt_errstr(status)));
tevent_req_nterror(req, status);
return;
}
conn->sockets.active = conn->sockets.tls;
tevent_req_done(req);
}
static NTSTATUS ldapsrv_starttls_postprocess_recv(struct tevent_req *req)
{
return tevent_req_simple_recv_ntstatus(req);
} }
static NTSTATUS ldapsrv_StartTLS(struct ldapsrv_call *call, static NTSTATUS ldapsrv_StartTLS(struct ldapsrv_call *call,
struct ldapsrv_reply *reply, struct ldapsrv_reply *reply,
const char **errstr) const char **errstr)
{ {
struct ldapsrv_starttls_context *ctx; struct ldapsrv_starttls_postprocess_context *context;
(*errstr) = NULL; (*errstr) = NULL;
@ -58,21 +121,19 @@ static NTSTATUS ldapsrv_StartTLS(struct ldapsrv_call *call,
return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
} }
ctx = talloc(call, struct ldapsrv_starttls_context); if (call->conn->sockets.sasl) {
NT_STATUS_HAVE_NO_MEMORY(ctx); (*errstr) = talloc_asprintf(reply, "START-TLS: SASL is already enabled on this LDAP session");
ctx->conn = call->conn;
ctx->tls_socket = tls_init_server(call->conn->service->tls_params,
call->conn->connection->socket,
call->conn->connection->event.fde,
NULL);
if (!ctx->tls_socket) {
(*errstr) = talloc_asprintf(reply, "START-TLS: Failed to setup TLS socket");
return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
} }
call->send_callback = ldapsrv_start_tls; context = talloc(call, struct ldapsrv_starttls_postprocess_context);
call->send_private = ctx; NT_STATUS_HAVE_NO_MEMORY(context);
context->conn = call->conn;
call->postprocess_send = ldapsrv_starttls_postprocess_send;
call->postprocess_recv = ldapsrv_starttls_postprocess_recv;
call->postprocess_private = context;
reply->msg->r.ExtendedResponse.response.resultcode = LDAP_SUCCESS; reply->msg->r.ExtendedResponse.response.resultcode = LDAP_SUCCESS;
reply->msg->r.ExtendedResponse.response.errormessage = NULL; reply->msg->r.ExtendedResponse.response.errormessage = NULL;

796
source4/ldap_server/ldap_server.c
View File

@ -22,6 +22,7 @@
*/ */
#include "includes.h" #include "includes.h"
#include "system/network.h"
#include "lib/events/events.h" #include "lib/events/events.h"
#include "auth/auth.h" #include "auth/auth.h"
#include "auth/credentials/credentials.h" #include "auth/credentials/credentials.h"
@ -42,173 +43,97 @@
#include "lib/socket/netif.h" #include "lib/socket/netif.h"
#include "dsdb/samdb/samdb.h" #include "dsdb/samdb/samdb.h"
#include "param/param.h" #include "param/param.h"
#include "../lib/tsocket/tsocket.h"
#include "../lib/util/tevent_ntstatus.h"
#include "../libcli/util/tstream.h"
static void ldapsrv_terminate_connection_done(struct tevent_req *subreq);
/* /*
close the socket and shutdown a server_context close the socket and shutdown a server_context
*/ */
void ldapsrv_terminate_connection(struct ldapsrv_connection *conn, static void ldapsrv_terminate_connection(struct ldapsrv_connection *conn,
const char *reason) const char *reason)
{ {
packet_recv_disable(conn->packet); struct tevent_req *subreq;
TALLOC_FREE(conn->packet);
if (conn->limits.reason) {
return;
}
conn->limits.endtime = timeval_current_ofs(0, 500);
DEBUG(2,("ldapsrv_terminate_connection: %s - disconnecting\n",
reason));
tevent_queue_stop(conn->sockets.send_queue);
if (conn->active_call) {
tevent_req_cancel(conn->active_call);
conn->active_call = NULL;
}
conn->limits.reason = talloc_strdup(conn, reason);
if (conn->limits.reason == NULL) {
TALLOC_FREE(conn->sockets.tls);
TALLOC_FREE(conn->sockets.sasl);
TALLOC_FREE(conn->sockets.raw);
stream_terminate_connection(conn->connection, reason);
return;
}
subreq = tstream_disconnect_send(conn,
conn->connection->event.ctx,
conn->sockets.active);
if (subreq == NULL) {
TALLOC_FREE(conn->sockets.tls);
TALLOC_FREE(conn->sockets.sasl);
TALLOC_FREE(conn->sockets.raw);
stream_terminate_connection(conn->connection, reason);
return;
}
tevent_req_set_endtime(subreq,
conn->connection->event.ctx,
conn->limits.endtime);
tevent_req_set_callback(subreq, ldapsrv_terminate_connection_done, conn);
}
static void ldapsrv_terminate_connection_done(struct tevent_req *subreq)
{
struct ldapsrv_connection *conn =
tevent_req_callback_data(subreq,
struct ldapsrv_connection);
int ret;
int sys_errno;
ret = tstream_disconnect_recv(subreq, &sys_errno);
TALLOC_FREE(subreq);
if (conn->sockets.active == conn->sockets.raw) {
TALLOC_FREE(conn->sockets.tls);
TALLOC_FREE(conn->sockets.sasl);
TALLOC_FREE(conn->sockets.raw);
stream_terminate_connection(conn->connection,
conn->limits.reason);
return;
}
TALLOC_FREE(conn->sockets.tls); TALLOC_FREE(conn->sockets.tls);
stream_terminate_connection(conn->connection, reason); TALLOC_FREE(conn->sockets.sasl);
} conn->sockets.active = conn->sockets.raw;
/* subreq = tstream_disconnect_send(conn,
handle packet errors conn->connection->event.ctx,
*/ conn->sockets.active);
static void ldapsrv_error_handler(void *private_data, NTSTATUS status) if (subreq == NULL) {
{ TALLOC_FREE(conn->sockets.raw);
struct ldapsrv_connection *conn = talloc_get_type(private_data, stream_terminate_connection(conn->connection,
struct ldapsrv_connection); conn->limits.reason);
ldapsrv_terminate_connection(conn, nt_errstr(status));
}
/*
process a decoded ldap message
*/
static void ldapsrv_process_message(struct ldapsrv_connection *conn,
struct ldap_message *msg)
{
struct ldapsrv_call *call;
NTSTATUS status;
DATA_BLOB blob;
call = talloc(conn, struct ldapsrv_call);
if (!call) {
ldapsrv_terminate_connection(conn, "no memory");
return;
}
call->request = talloc_steal(call, msg);
call->conn = conn;
call->replies = NULL;
call->send_callback = NULL;
call->send_private = NULL;
/* make the call */
status = ldapsrv_do_call(call);
if (!NT_STATUS_IS_OK(status)) {
talloc_free(call);
return; return;
} }
tevent_req_set_endtime(subreq,
blob = data_blob(NULL, 0); conn->connection->event.ctx,
conn->limits.endtime);
if (call->replies == NULL) { tevent_req_set_callback(subreq, ldapsrv_terminate_connection_done, conn);
talloc_free(call);
return;
}
/* build all the replies into a single blob */
while (call->replies) {
DATA_BLOB b;
bool ret;
msg = call->replies->msg;
if (!ldap_encode(msg, samba_ldap_control_handlers(), &b, call)) {
DEBUG(0,("Failed to encode ldap reply of type %d\n", msg->type));
talloc_free(call);
return;
}
ret = data_blob_append(call, &blob, b.data, b.length);
data_blob_free(&b);
talloc_set_name_const(blob.data, "Outgoing, encoded LDAP packet");
if (!ret) {
talloc_free(call);
return;
}
DLIST_REMOVE(call->replies, call->replies);
}
packet_send_callback(conn->packet, blob,
call->send_callback, call->send_private);
talloc_free(call);
return;
}
/*
disable packets on other sockets while processing this one
*/
static void ldapsrv_disable_recv(struct ldapsrv_connection *conn)
{
struct ldapsrv_packet_interfaces *p;
for (p=conn->service->packet_interfaces; p; p=p->next) {
if (p->packet != conn->packet) {
packet_recv_disable(p->packet);
}
}
}
/*
disable packets on other sockets while processing this one
*/
static void ldapsrv_enable_recv(struct ldapsrv_connection *conn)
{
struct ldapsrv_packet_interfaces *p;
for (p=conn->service->packet_interfaces; p; p=p->next) {
if (p->packet != conn->packet) {
packet_recv_enable(p->packet);
}
}
}
/*
decode/process data
*/
static NTSTATUS ldapsrv_decode(void *private_data, DATA_BLOB blob)
{
NTSTATUS status;
struct ldapsrv_connection *conn = talloc_get_type(private_data,
struct ldapsrv_connection);
struct asn1_data *asn1 = asn1_init(conn);
struct ldap_message *msg = talloc(conn, struct ldap_message);
if (asn1 == NULL || msg == NULL) {
return NT_STATUS_NO_MEMORY;
}
if (!asn1_load(asn1, blob)) {
talloc_free(msg);
talloc_free(asn1);
return NT_STATUS_NO_MEMORY;
}
status = ldap_decode(asn1, samba_ldap_control_handlers(), msg);
if (!NT_STATUS_IS_OK(status)) {
asn1_free(asn1);
return status;
}
data_blob_free(&blob);
talloc_steal(conn, msg);
asn1_free(asn1);
/* disable messages on other sockets while processing this one */
ldapsrv_disable_recv(conn);
ldapsrv_process_message(conn, msg);
ldapsrv_enable_recv(conn);
return NT_STATUS_OK;
}
/*
Idle timeout handler
*/
static void ldapsrv_conn_idle_timeout(struct tevent_context *ev,
struct tevent_timer *te,
struct timeval t,
void *private_data)
{
struct ldapsrv_connection *conn = talloc_get_type(private_data, struct ldapsrv_connection);
ldapsrv_terminate_connection(conn, "Timeout. No requests after bind");
} }
/* /*
@ -216,25 +141,7 @@ static void ldapsrv_conn_idle_timeout(struct tevent_context *ev,
*/ */
void ldapsrv_recv(struct stream_connection *c, uint16_t flags) void ldapsrv_recv(struct stream_connection *c, uint16_t flags)
{ {
struct ldapsrv_connection *conn = smb_panic(__location__);
talloc_get_type(c->private_data, struct ldapsrv_connection);
if (conn->limits.ite) { /* clean initial timeout if any */
talloc_free(conn->limits.ite);
conn->limits.ite = NULL;
}
if (conn->limits.te) { /* clean idle timeout if any */
talloc_free(conn->limits.te);
conn->limits.te = NULL;
}
packet_recv(conn->packet);
/* set idle timeout */
conn->limits.te = event_add_timed(c->event.ctx, conn,
timeval_current_ofs(conn->limits.conn_idle_time, 0),
ldapsrv_conn_idle_timeout, conn);
} }
/* /*
@ -242,20 +149,7 @@ void ldapsrv_recv(struct stream_connection *c, uint16_t flags)
*/ */
static void ldapsrv_send(struct stream_connection *c, uint16_t flags) static void ldapsrv_send(struct stream_connection *c, uint16_t flags)
{ {
struct ldapsrv_connection *conn = smb_panic(__location__);
talloc_get_type(c->private_data, struct ldapsrv_connection);
packet_queue_run(conn->packet);
}
static void ldapsrv_conn_init_timeout(struct tevent_context *ev,
struct tevent_timer *te,
struct timeval t,
void *private_data)
{
struct ldapsrv_connection *conn = talloc_get_type(private_data, struct ldapsrv_connection);
ldapsrv_terminate_connection(conn, "Timeout. No requests after initial connection");
} }
static int ldapsrv_load_limits(struct ldapsrv_connection *conn) static int ldapsrv_load_limits(struct ldapsrv_connection *conn)
@ -356,14 +250,14 @@ failed:
return -1; return -1;
} }
/* static struct tevent_req *ldapsrv_process_call_send(TALLOC_CTX *mem_ctx,
remove a packet interface from the service level list struct tevent_context *ev,
*/ struct tevent_queue *call_queue,
static int packet_interface_destructor(struct ldapsrv_packet_interfaces *packet_interface) struct ldapsrv_call *call);
{ static NTSTATUS ldapsrv_process_call_recv(struct tevent_req *req);
DLIST_REMOVE(packet_interface->service->packet_interfaces, packet_interface);
return 0; static bool ldapsrv_call_read_next(struct ldapsrv_connection *conn);
} static void ldapsrv_accept_tls_done(struct tevent_req *subreq);
/* /*
initialise a server_context from a open socket and register a event handler initialise a server_context from a open socket and register a event handler
@ -379,6 +273,9 @@ static void ldapsrv_accept(struct stream_connection *c,
struct socket_address *socket_address; struct socket_address *socket_address;
NTSTATUS status; NTSTATUS status;
int port; int port;
int ret;
struct tevent_req *subreq;
struct timeval endtime;
conn = talloc_zero(c, struct ldapsrv_connection); conn = talloc_zero(c, struct ldapsrv_connection);
if (!conn) { if (!conn) {
@ -386,10 +283,31 @@ static void ldapsrv_accept(struct stream_connection *c,
return; return;
} }
conn->packet = NULL; conn->sockets.send_queue = tevent_queue_create(conn, "ldapsev send queue");
if (conn->sockets.send_queue == NULL) {
stream_terminate_connection(c,
"ldapsrv_accept: tevent_queue_create failed");
return;
}
TALLOC_FREE(c->event.fde);
/*
* Clone the fd that the connection isn't closed if we create a client
* connection.
*/
ret = tstream_bsd_existing_socket(conn,
socket_get_fd(c->socket),
&conn->sockets.raw);
if (ret == -1) {
stream_terminate_connection(c,
"ldapsrv_accept: out of memory");
return;
}
socket_set_flags(c->socket, SOCKET_FLAG_NOCLOSE);
conn->connection = c; conn->connection = c;
conn->service = ldapsrv_service; conn->service = ldapsrv_service;
conn->sockets.raw = c->socket;
conn->lp_ctx = ldapsrv_service->task->lp_ctx; conn->lp_ctx = ldapsrv_service->task->lp_ctx;
c->private_data = conn; c->private_data = conn;
@ -401,54 +319,9 @@ static void ldapsrv_accept(struct stream_connection *c,
} }
port = socket_address->port; port = socket_address->port;
talloc_free(socket_address); talloc_free(socket_address);
if (port == 3268) /* Global catalog */ {
if (port == 636) {
struct socket_context *tls_socket = tls_init_server(ldapsrv_service->tls_params, c->socket,
c->event.fde, NULL);
if (!tls_socket) {
ldapsrv_terminate_connection(conn, "ldapsrv_accept: tls_init_server() failed");
return;
}
talloc_steal(c, tls_socket);
c->socket = tls_socket;
conn->sockets.tls = tls_socket;
} else if (port == 3268) /* Global catalog */ {
conn->global_catalog = true; conn->global_catalog = true;
} }
conn->packet = packet_init(conn);
if (conn->packet == NULL) {
ldapsrv_terminate_connection(conn, "out of memory");
return;
}
packet_set_private(conn->packet, conn);
packet_set_socket(conn->packet, c->socket);
packet_set_callback(conn->packet, ldapsrv_decode);
packet_set_full_request(conn->packet, ldap_full_packet);
packet_set_error_handler(conn->packet, ldapsrv_error_handler);
packet_set_event_context(conn->packet, c->event.ctx);
packet_set_fde(conn->packet, c->event.fde);
packet_set_serialise(conn->packet);
if (conn->sockets.tls) {
packet_set_unreliable_select(conn->packet);
}
/* Ensure we don't get packets until the database is ready below */
packet_recv_disable(conn->packet);
/* add to the service level list of packet interfaces, to
* allow us to serialise between connections
*/
conn->packet_interface = talloc(conn, struct ldapsrv_packet_interfaces);
if (conn->packet_interface == NULL) {
ldapsrv_terminate_connection(conn, "out of memory");
}
conn->packet_interface->service = ldapsrv_service;
conn->packet_interface->packet = conn->packet;
DLIST_ADD(conn->service->packet_interfaces, conn->packet_interface);
talloc_set_destructor(conn->packet_interface, packet_interface_destructor);
server_credentials = cli_credentials_init(conn); server_credentials = cli_credentials_init(conn);
if (!server_credentials) { if (!server_credentials) {
@ -477,13 +350,405 @@ static void ldapsrv_accept(struct stream_connection *c,
/* register the server */ /* register the server */
irpc_add_name(c->msg_ctx, "ldap_server"); irpc_add_name(c->msg_ctx, "ldap_server");
/* set connections limits */ conn->sockets.active = conn->sockets.raw;
conn->limits.ite = event_add_timed(c->event.ctx, conn,
timeval_current_ofs(conn->limits.initial_timeout, 0),
ldapsrv_conn_init_timeout, conn);
packet_recv_enable(conn->packet); if (port != 636) {
ldapsrv_call_read_next(conn);
return;
}
endtime = timeval_current_ofs(conn->limits.conn_idle_time, 0);
subreq = tstream_tls_accept_send(conn,
conn->connection->event.ctx,
conn->sockets.raw,
conn->service->tls_params);
if (subreq == NULL) {
ldapsrv_terminate_connection(conn, "ldapsrv_accept: "
"no memory for tstream_tls_accept_send");
return;
}
tevent_req_set_endtime(subreq,
conn->connection->event.ctx,
endtime);
tevent_req_set_callback(subreq, ldapsrv_accept_tls_done, conn);
}
static void ldapsrv_accept_tls_done(struct tevent_req *subreq)
{
struct ldapsrv_connection *conn =
tevent_req_callback_data(subreq,
struct ldapsrv_connection);
int ret;
int sys_errno;
ret = tstream_tls_accept_recv(subreq, &sys_errno,
conn, &conn->sockets.tls);
TALLOC_FREE(subreq);
if (ret == -1) {
const char *reason;
reason = talloc_asprintf(conn, "ldapsrv_accept_tls_loop: "
"tstream_tls_accept_recv() - %d:%s",
sys_errno, strerror(sys_errno));
if (!reason) {
reason = "ldapsrv_accept_tls_loop: "
"tstream_tls_accept_recv() - failed";
}
ldapsrv_terminate_connection(conn, reason);
return;
}
conn->sockets.active = conn->sockets.tls;
ldapsrv_call_read_next(conn);
}
static void ldapsrv_call_read_done(struct tevent_req *subreq);
static bool ldapsrv_call_read_next(struct ldapsrv_connection *conn)
{
struct tevent_req *subreq;
if (timeval_is_zero(&conn->limits.endtime)) {
conn->limits.endtime =
timeval_current_ofs(conn->limits.initial_timeout, 0);
} else {
conn->limits.endtime =
timeval_current_ofs(conn->limits.conn_idle_time, 0);
}
/*
* The minimun size of a LDAP pdu is 7 bytes
*
* dumpasn1 -hh ldap-unbind-min.dat
*
* <30 05 02 01 09 42 00>
* 0 5: SEQUENCE {
* <02 01 09>
* 2 1: INTEGER 9
* <42 00>
* 5 0: [APPLICATION 2]
* : Error: Object has zero length.
* : }
*
* dumpasn1 -hh ldap-unbind-windows.dat
*
* <30 84 00 00 00 05 02 01 09 42 00>
* 0 5: SEQUENCE {
* <02 01 09>
* 6 1: INTEGER 9
* <42 00>
* 9 0: [APPLICATION 2]
* : Error: Object has zero length.
* : }
*
* This means using an initial read size
* of 7 is ok.
*/
subreq = tstream_read_pdu_blob_send(conn,
conn->connection->event.ctx,
conn->sockets.active,
7, /* initial_read_size */
ldap_full_packet,
conn);
if (subreq == NULL) {
ldapsrv_terminate_connection(conn, "ldapsrv_call_read_next: "
"no memory for tstream_read_pdu_blob_send");
return false;
}
tevent_req_set_endtime(subreq,
conn->connection->event.ctx,
conn->limits.endtime);
tevent_req_set_callback(subreq, ldapsrv_call_read_done, conn);
return true;
}
static void ldapsrv_call_process_done(struct tevent_req *subreq);
static void ldapsrv_call_read_done(struct tevent_req *subreq)
{
struct ldapsrv_connection *conn =
tevent_req_callback_data(subreq,
struct ldapsrv_connection);
NTSTATUS status;
struct ldapsrv_call *call;
struct asn1_data *asn1;
DATA_BLOB blob;
call = talloc_zero(conn, struct ldapsrv_call);
if (!call) {
ldapsrv_terminate_connection(conn, "no memory");
return;
}
call->conn = conn;
status = tstream_read_pdu_blob_recv(subreq,
call,
&blob);
TALLOC_FREE(subreq);
if (!NT_STATUS_IS_OK(status)) {
const char *reason;
reason = talloc_asprintf(call, "ldapsrv_call_loop: "
"tstream_read_pdu_blob_recv() - %s",
nt_errstr(status));
if (!reason) {
reason = nt_errstr(status);
}
ldapsrv_terminate_connection(conn, reason);
return;
}
asn1 = asn1_init(call);
if (asn1 == NULL) {
ldapsrv_terminate_connection(conn, "no memory");
return;
}
call->request = talloc(call, struct ldap_message);
if (call->request == NULL) {
ldapsrv_terminate_connection(conn, "no memory");
return;
}
if (!asn1_load(asn1, blob)) {
ldapsrv_terminate_connection(conn, "asn1_load failed");
return;
}
status = ldap_decode(asn1, samba_ldap_control_handlers(),
call->request);
if (!NT_STATUS_IS_OK(status)) {
ldapsrv_terminate_connection(conn, nt_errstr(status));
return;
}
data_blob_free(&blob);
/* queue the call in the global queue */
subreq = ldapsrv_process_call_send(call,
conn->connection->event.ctx,
conn->service->call_queue,
call);
if (subreq == NULL) {
ldapsrv_terminate_connection(conn, "ldapsrv_process_call_send failed");
return;
}
tevent_req_set_callback(subreq, ldapsrv_call_process_done, call);
conn->active_call = subreq;
}
static void ldapsrv_call_writev_done(struct tevent_req *subreq);
static void ldapsrv_call_process_done(struct tevent_req *subreq)
{
struct ldapsrv_call *call =
tevent_req_callback_data(subreq,
struct ldapsrv_call);
struct ldapsrv_connection *conn = call->conn;
NTSTATUS status;
DATA_BLOB blob = data_blob_null;
conn->active_call = NULL;
status = ldapsrv_process_call_recv(subreq);
TALLOC_FREE(subreq);
if (!NT_STATUS_IS_OK(status)) {
ldapsrv_terminate_connection(conn, nt_errstr(status));
return;
}
/* build all the replies into a single blob */
while (call->replies) {
DATA_BLOB b;
bool ret;
if (!ldap_encode(call->replies->msg, samba_ldap_control_handlers(), &b, call)) {
DEBUG(0,("Failed to encode ldap reply of type %d\n",
call->replies->msg->type));
ldapsrv_terminate_connection(conn, "ldap_encode failed");
return;
}
ret = data_blob_append(call, &blob, b.data, b.length);
data_blob_free(&b);
talloc_set_name_const(blob.data, "Outgoing, encoded LDAP packet");
if (!ret) {
ldapsrv_terminate_connection(conn, "data_blob_append failed");
return;
}
DLIST_REMOVE(call->replies, call->replies);
}
if (blob.length == 0) {
TALLOC_FREE(call);
ldapsrv_call_read_next(conn);
return;
}
call->out_iov.iov_base = blob.data;
call->out_iov.iov_len = blob.length;
subreq = tstream_writev_queue_send(call,
conn->connection->event.ctx,
conn->sockets.active,
conn->sockets.send_queue,
&call->out_iov, 1);
if (subreq == NULL) {
ldapsrv_terminate_connection(conn, "stream_writev_queue_send failed");
return;
}
tevent_req_set_callback(subreq, ldapsrv_call_writev_done, call);
}
static void ldapsrv_call_postprocess_done(struct tevent_req *subreq);
static void ldapsrv_call_writev_done(struct tevent_req *subreq)
{
struct ldapsrv_call *call =
tevent_req_callback_data(subreq,
struct ldapsrv_call);
struct ldapsrv_connection *conn = call->conn;
int sys_errno;
int rc;
rc = tstream_writev_queue_recv(subreq, &sys_errno);
TALLOC_FREE(subreq);
if (rc == -1) {
const char *reason;
reason = talloc_asprintf(call, "ldapsrv_call_writev_done: "
"tstream_writev_queue_recv() - %d:%s",
sys_errno, strerror(sys_errno));
if (reason == NULL) {
reason = "ldapsrv_call_writev_done: "
"tstream_writev_queue_recv() failed";
}
ldapsrv_terminate_connection(conn, reason);
return;
}
if (call->postprocess_send) {
subreq = call->postprocess_send(call,
conn->connection->event.ctx,
call->postprocess_private);
if (subreq == NULL) {
ldapsrv_terminate_connection(conn, "ldapsrv_call_writev_done: "
"call->postprocess_send - no memory");
return;
}
tevent_req_set_callback(subreq,
ldapsrv_call_postprocess_done,
call);
return;
}
TALLOC_FREE(call);
ldapsrv_call_read_next(conn);
}
static void ldapsrv_call_postprocess_done(struct tevent_req *subreq)
{
struct ldapsrv_call *call =
tevent_req_callback_data(subreq,
struct ldapsrv_call);
struct ldapsrv_connection *conn = call->conn;
NTSTATUS status;
status = call->postprocess_recv(subreq);
TALLOC_FREE(subreq);
if (!NT_STATUS_IS_OK(status)) {
const char *reason;
reason = talloc_asprintf(call, "ldapsrv_call_postprocess_done: "
"call->postprocess_recv() - %s",
nt_errstr(status));
if (reason == NULL) {
reason = nt_errstr(status);
}
ldapsrv_terminate_connection(conn, reason);
return;
}
TALLOC_FREE(call);
ldapsrv_call_read_next(conn);
}
struct ldapsrv_process_call_state {
struct ldapsrv_call *call;
};
static void ldapsrv_process_call_trigger(struct tevent_req *req,
void *private_data);
static struct tevent_req *ldapsrv_process_call_send(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
struct tevent_queue *call_queue,
struct ldapsrv_call *call)
{
struct tevent_req *req;
struct ldapsrv_process_call_state *state;
bool ok;
req = tevent_req_create(mem_ctx, &state,
struct ldapsrv_process_call_state);
if (req == NULL) {
return req;
}
state->call = call;
ok = tevent_queue_add(call_queue, ev, req,
ldapsrv_process_call_trigger, NULL);
if (!ok) {
tevent_req_nomem(NULL, req);
return tevent_req_post(req, ev);
}
return req;
}
static void ldapsrv_process_call_trigger(struct tevent_req *req,
void *private_data)
{
struct ldapsrv_process_call_state *state =
tevent_req_data(req,
struct ldapsrv_process_call_state);
NTSTATUS status;
/* make the call */
status = ldapsrv_do_call(state->call);
if (!NT_STATUS_IS_OK(status)) {
tevent_req_nterror(req, status);
return;
}
tevent_req_done(req);
}
static NTSTATUS ldapsrv_process_call_recv(struct tevent_req *req)
{
NTSTATUS status;
if (tevent_req_is_nterror(req, &status)) {
tevent_req_received(req);
return status;
}
tevent_req_received(req);
return NT_STATUS_OK;
} }
static void ldapsrv_accept_nonpriv(struct stream_connection *c) static void ldapsrv_accept_nonpriv(struct stream_connection *c)
@ -562,7 +827,7 @@ static NTSTATUS add_socket(struct tevent_context *event_context,
return status; return status;
} }
if (tls_support(ldap_service->tls_params)) { if (tstream_tls_params_enabled(ldap_service->tls_params)) {
/* add ldaps server */ /* add ldaps server */
port = 636; port = 636;
status = stream_setup_socket(event_context, lp_ctx, status = stream_setup_socket(event_context, lp_ctx,
@ -616,6 +881,7 @@ static void ldapsrv_task_init(struct task_server *task)
#ifdef WITH_LDAPI_PRIV_SOCKET #ifdef WITH_LDAPI_PRIV_SOCKET
char *priv_dir; char *priv_dir;
#endif #endif
const char *dns_host_name;
struct ldapsrv_service *ldap_service; struct ldapsrv_service *ldap_service;
NTSTATUS status; NTSTATUS status;
const struct model_ops *model_ops; const struct model_ops *model_ops;
@ -645,8 +911,28 @@ static void ldapsrv_task_init(struct task_server *task)
ldap_service->task = task; ldap_service->task = task;
ldap_service->tls_params = tls_initialise(ldap_service, task->lp_ctx); dns_host_name = talloc_asprintf(ldap_service, "%s.%s",
if (ldap_service->tls_params == NULL) goto failed; lpcfg_netbios_name(task->lp_ctx),
lpcfg_dnsdomain(task->lp_ctx));
if (dns_host_name == NULL) goto failed;
status = tstream_tls_params_server(ldap_service,
dns_host_name,
lpcfg_tls_enabled(task->lp_ctx),
lpcfg_tls_keyfile(ldap_service, task->lp_ctx),
lpcfg_tls_certfile(ldap_service, task->lp_ctx),
lpcfg_tls_cafile(ldap_service, task->lp_ctx),
lpcfg_tls_crlfile(ldap_service, task->lp_ctx),
lpcfg_tls_dhpfile(ldap_service, task->lp_ctx),
&ldap_service->tls_params);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(0,("ldapsrv failed tstream_tls_patams_server - %s\n",
nt_errstr(status)));
goto failed;
}
ldap_service->call_queue = tevent_queue_create(ldap_service, "ldapsrv_call_queue");
if (ldap_service->call_queue == NULL) goto failed;
if (lpcfg_interfaces(task->lp_ctx) && lpcfg_bind_interfaces_only(task->lp_ctx)) { if (lpcfg_interfaces(task->lp_ctx) && lpcfg_bind_interfaces_only(task->lp_ctx)) {
struct interface *ifaces; struct interface *ifaces;

35
source4/ldap_server/ldap_server.h
View File

@ -21,6 +21,7 @@
#include "libcli/ldap/libcli_ldap.h" #include "libcli/ldap/libcli_ldap.h"
#include "lib/socket/socket.h" #include "lib/socket/socket.h"
#include "lib/stream/packet.h" #include "lib/stream/packet.h"
#include "system/network.h"
struct ldapsrv_connection { struct ldapsrv_connection {
struct loadparm_context *lp_ctx; struct loadparm_context *lp_ctx;
@ -32,26 +33,25 @@ struct ldapsrv_connection {
struct ldb_context *ldb; struct ldb_context *ldb;
struct { struct {
struct socket_context *raw; struct tevent_queue *send_queue;
struct socket_context *tls; struct tstream_context *raw;
struct socket_context *sasl; struct tstream_context *tls;
struct tstream_context *sasl;
struct tstream_context *active;
} sockets; } sockets;
bool global_catalog; bool global_catalog;
struct packet_context *packet;
struct { struct {
int initial_timeout; int initial_timeout;
int conn_idle_time; int conn_idle_time;
int max_page_size; int max_page_size;
int search_timeout; int search_timeout;
struct timeval endtime;
struct tevent_timer *ite; const char *reason;
struct tevent_timer *te;
} limits; } limits;
struct ldapsrv_packet_interfaces *packet_interface; struct tevent_req *active_call;
}; };
struct ldapsrv_call { struct ldapsrv_call {
@ -61,18 +61,19 @@ struct ldapsrv_call {
struct ldapsrv_reply *prev, *next; struct ldapsrv_reply *prev, *next;
struct ldap_message *msg; struct ldap_message *msg;
} *replies; } *replies;
packet_send_callback_fn_t send_callback; struct iovec out_iov;
void *send_private;
struct tevent_req *(*postprocess_send)(TALLOC_CTX *mem_ctx,
struct tevent_context *ev,
void *private_data);
NTSTATUS (*postprocess_recv)(struct tevent_req *req);
void *postprocess_private;
}; };
struct ldapsrv_service { struct ldapsrv_service {
struct tls_params *tls_params; struct tstream_tls_params *tls_params;
struct task_server *task; struct task_server *task;
struct ldapsrv_packet_interfaces { struct tevent_queue *call_queue;
struct ldapsrv_packet_interfaces *next, *prev;
struct packet_context *packet;
struct ldapsrv_service *service;
} *packet_interfaces;
}; };
#include "ldap_server/proto.h" #include "ldap_server/proto.h"