summaryrefslogtreecommitdiff
path: root/source4/ldap_server
diff options
context:
space:
mode:
Diffstat (limited to 'source4/ldap_server')
-rw-r--r--source4/ldap_server/ldap_extended.c138
1 files changed, 96 insertions, 42 deletions
diff --git a/source4/ldap_server/ldap_extended.c b/source4/ldap_server/ldap_extended.c
index bc757fc973..06e5feb828 100644
--- a/source4/ldap_server/ldap_extended.c
+++ b/source4/ldap_server/ldap_extended.c
@@ -41,56 +41,110 @@ static void ldapsrv_start_tls(void *private)
packet_set_socket(ctx->conn->packet, ctx->conn->connection->socket);
}
-NTSTATUS ldapsrv_ExtendedRequest(struct ldapsrv_call *call)
+static NTSTATUS ldapsrv_StartTLS(struct ldapsrv_call *call,
+ struct ldapsrv_reply *reply,
+ const char **errstr)
{
- struct ldap_ExtendedRequest *req = &call->request->r.ExtendedRequest;
- struct ldapsrv_reply *reply;
+ struct ldapsrv_starttls_context *ctx;
- DEBUG(10, ("Extended\n"));
+ (*errstr) = NULL;
- reply = ldapsrv_init_reply(call, LDAP_TAG_ExtendedResponse);
- if (!reply) {
- return NT_STATUS_NO_MEMORY;
+ /*
+ * TODO: give LDAP_OPERATIONS_ERROR also when
+ * there're pending requests or there's
+ * a SASL bind in progress
+ * (see rfc4513 section 3.1.1)
+ */
+ if (call->conn->sockets.tls) {
+ (*errstr) = talloc_asprintf(reply, "START-TLS: TLS is already enabled on this LDAP session");
+ return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
}
- ZERO_STRUCT(reply->msg->r);
-
- /* check if we have a START_TLS call */
- if (strcmp(req->oid, LDB_EXTENDED_START_TLS_OID) == 0) {
- struct ldapsrv_starttls_context *ctx;
- int result = 0;
- const char *errstr;
- ctx = talloc(call, struct ldapsrv_starttls_context);
-
- if (ctx) {
- ctx->conn = call->conn;
- ctx->tls_socket = tls_init_server(call->conn->service->tls_params,
- call->conn->connection->socket,
- call->conn->connection->event.fde,
- NULL);
- }
-
- if (!ctx || !ctx->tls_socket) {
- result = LDAP_OPERATIONS_ERROR;
- errstr = talloc_asprintf(reply,
- "START-TLS: Failed to setup TLS socket");
- } else {
- result = LDAP_SUCCESS;
- errstr = NULL;
- call->send_callback = ldapsrv_start_tls;
- call->send_private = ctx;
- }
-
- reply->msg->r.ExtendedResponse.response.resultcode = result;
- reply->msg->r.ExtendedResponse.response.errormessage = errstr;
- reply->msg->r.ExtendedResponse.oid = talloc_strdup(reply, req->oid);
- if (!reply->msg->r.ExtendedResponse.oid) {
- return NT_STATUS_NO_MEMORY;
- }
+ ctx = talloc(call, struct ldapsrv_starttls_context);
+ NT_STATUS_HAVE_NO_MEMORY(ctx);
+
+ ctx->conn = call->conn;
+ ctx->tls_socket = tls_init_server(call->conn->service->tls_params,
+ call->conn->connection->socket,
+ call->conn->connection->event.fde,
+ NULL);
+ if (!ctx->tls_socket) {
+ (*errstr) = talloc_asprintf(reply, "START-TLS: Failed to setup TLS socket");
+ return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
}
- /* TODO: OID not recognized, return a protocol error */
+ call->send_callback = ldapsrv_start_tls;
+ call->send_private = ctx;
+
+ reply->msg->r.ExtendedResponse.response.resultcode = LDAP_SUCCESS;
+ reply->msg->r.ExtendedResponse.response.errormessage = NULL;
ldapsrv_queue_reply(call, reply);
return NT_STATUS_OK;
}
+
+struct ldapsrv_extended_operation {
+ const char *oid;
+ NTSTATUS (*fn)(struct ldapsrv_call *call, struct ldapsrv_reply *reply, const char **errorstr);
+};
+
+static struct ldapsrv_extended_operation extended_ops[] = {
+ {
+ .oid = LDB_EXTENDED_START_TLS_OID,
+ .fn = ldapsrv_StartTLS,
+ },{
+ .oid = NULL,
+ .fn = NULL,
+ }
+};
+
+NTSTATUS ldapsrv_ExtendedRequest(struct ldapsrv_call *call)
+{
+ struct ldap_ExtendedRequest *req = &call->request->r.ExtendedRequest;
+ struct ldapsrv_reply *reply;
+ int result = LDAP_PROTOCOL_ERROR;
+ const char *error_str = NULL;
+ NTSTATUS status = NT_STATUS_OK;
+ uint32_t i;
+
+ DEBUG(10, ("Extended\n"));
+
+ reply = ldapsrv_init_reply(call, LDAP_TAG_ExtendedResponse);
+ NT_STATUS_HAVE_NO_MEMORY(reply);
+
+ ZERO_STRUCT(reply->msg->r);
+ reply->msg->r.ExtendedResponse.oid = talloc_steal(reply, req->oid);
+ reply->msg->r.ExtendedResponse.response.resultcode = LDAP_PROTOCOL_ERROR;
+ reply->msg->r.ExtendedResponse.response.errormessage = NULL;
+
+ for (i=0; extended_ops[i].oid; i++) {
+ if (strcmp(extended_ops[i].oid,req->oid) != 0) continue;
+
+ /*
+ * if the backend function returns an error we
+ * need to send the reply otherwise the reply is already
+ * send and we need to return directly
+ */
+ status = extended_ops[i].fn(call, reply, &error_str);
+ NT_STATUS_IS_OK_RETURN(status);
+
+ if (NT_STATUS_IS_LDAP(status)) {
+ result = NT_STATUS_LDAP_CODE(status);
+ } else {
+ result = LDAP_OPERATIONS_ERROR;
+ error_str = talloc_asprintf(reply, "Extended Operation(%s) failed: %s",
+ req->oid, nt_errstr(status));
+ }
+ }
+ /* if we haven't found the oid, then status is still NT_STATUS_OK */
+ if (NT_STATUS_IS_OK(status)) {
+ error_str = talloc_asprintf(reply, "Extended Operation(%s) not supported",
+ req->oid);
+ }
+
+ reply->msg->r.ExtendedResponse.response.resultcode = result;
+ reply->msg->r.ExtendedResponse.response.errormessage = error_str;
+
+ ldapsrv_queue_reply(call, reply);
+ return NT_STATUS_OK;
+}