Changeset 740 for vendor/current/source4/ldap_server

Timestamp:

Nov 14, 2012, 12:59:34 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to 3.6.0

Location:

vendor/current/source4/ldap_server

Files:

• config.mk (deleted)
• devdocs/draft-armijo-ldap-syntax-00.txt (deleted)
• devdocs/ldapext-ldapv3-vlv-04.txt (deleted)
• devdocs/rfc2307.txt (deleted)
• devdocs/rfc2696.txt (deleted)
• devdocs/rfc2849.txt (deleted)
• devdocs/rfc2891.txt (deleted)
• devdocs/rfc3296.txt (deleted)
• devdocs/rfc4510.txt (deleted)
• devdocs/rfc4511.txt (deleted)
• devdocs/rfc4512.txt (deleted)
• devdocs/rfc4513.txt (deleted)
• devdocs/rfc4514.txt (deleted)
• devdocs/rfc4515.txt (deleted)
• devdocs/rfc4516.txt (deleted)
• devdocs/rfc4517.txt (deleted)
• devdocs/rfc4518.txt (deleted)
• devdocs/rfc4519.txt (deleted)
• devdocs/rfc4520.txt (deleted)
• devdocs/rfc4521.txt (deleted)
• devdocs/rfc4522.txt (deleted)
• devdocs/rfc4523.txt (deleted)
• devdocs/rfc4524.txt (deleted)
• devdocs/rfc4525.txt (deleted)
• devdocs/rfc4526.txt (deleted)
• devdocs/rfc4527.txt (deleted)
• devdocs/rfc4528.txt (deleted)
• devdocs/rfc4529.txt (deleted)
• devdocs/rfc4530.txt (deleted)
• devdocs/rfc4531.txt (deleted)
• devdocs/rfc4532.txt (deleted)
• devdocs/rfc4533.txt (deleted)
• ldap_backend.c (modified) (36 diffs)
• ldap_bind.c (modified) (10 diffs)
• ldap_extended.c (modified) (4 diffs)
• ldap_server.c (modified) (27 diffs)
• ldap_server.h (modified) (4 diffs)
• wscript_build (added)

vendor/current/source4/ldap_server/ldap_backend.c

@@ -22 +22 @@
 #include "ldap_server/ldap_server.h"
 #include "../lib/util/dlinklist.h"
-#include "libcli/ldap/ldap.h"
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
@@ -28 +27 @@
 #include "smbd/service_stream.h"
 #include "dsdb/samdb/samdb.h"
-#include "lib/ldb/include/ldb_errors.h"
-#include "lib/ldb_wrap.h"
-
-#define VALID_DN_SYNTAX(dn) do {\
-        if (!(dn)) {\
-                return NT_STATUS_NO_MEMORY;\
-        } else if ( ! ldb_dn_validate(dn)) {\
-                result = LDAP_INVALID_DN_SYNTAX;\
-                map_ldb_error(local_ctx, LDB_ERR_INVALID_DN_SYNTAX, &errstr);\
-                goto reply;\
-        }\
-} while(0)
+#include <ldb_errors.h>
+#include <ldb_module.h>
+#include "ldb_wrap.h"
 
 static int map_ldb_error(TALLOC_CTX *mem_ctx, int ldb_err,
-        const char **errstring)
+        const char *add_err_string, const char **errstring)
 {
         WERROR err;
+
+        /* Certain LDB modules need to return very special WERROR codes. Proof
+         * for them here and if they exist skip the rest of the mapping. */
+        if (add_err_string != NULL) {
+                char *endptr;
+                strtol(add_err_string, &endptr, 16);
+                if (endptr != add_err_string) {
+                        *errstring = add_err_string;
+                        return ldb_err;
+                }
+        }
+
+        /* Otherwise we calculate here a generic, but appropriate WERROR. */
 
         switch (ldb_err) {
@@ -60 +63 @@
         break;
         case LDB_ERR_SIZE_LIMIT_EXCEEDED:
-                err = WERR_DS_SIZE_LIMIT_EXCEEDED;
+                err = WERR_DS_SIZELIMIT_EXCEEDED;
         break;
         case LDB_ERR_COMPARE_FALSE:
@@ -166 +169 @@
         }
 
-        *errstring = talloc_asprintf(mem_ctx, "%08x: %s", W_ERROR_V(err),
+        *errstring = talloc_asprintf(mem_ctx, "%08X: %s", W_ERROR_V(err),
                 ldb_strerror(ldb_err));
+        if (add_err_string != NULL) {
+                *errstring = talloc_asprintf(mem_ctx, "%s - %s", *errstring,
+                                             add_err_string);
+        }
         
         /* result is 1:1 for now */
@@ -178 +185 @@
 NTSTATUS ldapsrv_backend_Init(struct ldapsrv_connection *conn) 
 {
-        conn->ldb = ldb_wrap_connect(conn, 
+        conn->ldb = samdb_connect(conn, 
                                      conn->connection->event.ctx,
                                      conn->lp_ctx,
-                                     lp_sam_url(conn->lp_ctx), 
                                      conn->session_info,
-                                     samdb_credentials(conn, conn->connection->event.ctx, conn->lp_ctx), 
-                                     conn->global_catalog ? LDB_FLG_RDONLY : 0, NULL);
+                                     conn->global_catalog ? LDB_FLG_RDONLY : 0);
         if (conn->ldb == NULL) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -194 +199 @@
                 struct gensec_security_ops **ops
                         = gensec_use_kerberos_mechs(conn, backends, conn->server_credentials);
-                int i, j = 0;
+                unsigned int i, j = 0;
                 for (i = 0; ops && ops[i]; i++) {
-                        if (!lp_parm_bool(conn->lp_ctx,  NULL, "gensec", ops[i]->name, ops[i]->enabled))
+                        if (!lpcfg_parm_bool(conn->lp_ctx,  NULL, "gensec", ops[i]->name, ops[i]->enabled))
                                 continue;
 
@@ -216 +221 @@
                 }
                 talloc_unlink(conn, ops);
-                ldb_set_opaque(conn->ldb, "supportedSASLMechanims", sasl_mechs);
+
+                /* ldb can have a different lifetime to conn, so we
+                   need to ensure that sasl_mechs lives as long as the
+                   ldb does */
+                talloc_steal(conn->ldb, sasl_mechs);
+
+                ldb_set_opaque(conn->ldb, "supportedSASLMechanisms", sasl_mechs);
         }
 
@@ -270 +281 @@
         ldapsrv_queue_reply(call, reply);
         return NT_STATUS_OK;
+}
+
+static int ldapsrv_add_with_controls(struct ldapsrv_call *call,
+                                     const struct ldb_message *message,
+                                     struct ldb_control **controls,
+                                     void *context)
+{
+        struct ldb_context *ldb = call->conn->ldb;
+        struct ldb_request *req;
+        int ret;
+
+        ret = ldb_msg_sanity_check(ldb, message);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        ret = ldb_build_add_req(&req, ldb, ldb,
+                                        message,
+                                        controls,
+                                        context,
+                                        ldb_modify_default_callback,
+                                        NULL);
+
+        if (ret != LDB_SUCCESS) return ret;
+
+        ret = ldb_transaction_start(ldb);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        if (!call->conn->is_privileged) {
+                ldb_req_mark_untrusted(req);
+        }
+
+        LDB_REQ_SET_LOCATION(req);
+
+        ret = ldb_request(ldb, req);
+        if (ret == LDB_SUCCESS) {
+                ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+        }
+
+        if (ret == LDB_SUCCESS) {
+                ret = ldb_transaction_commit(ldb);
+        }
+        else {
+                ldb_transaction_cancel(ldb);
+        }
+
+        talloc_free(req);
+        return ret;
+}
+
+/* create and execute a modify request */
+static int ldapsrv_mod_with_controls(struct ldapsrv_call *call,
+                                     const struct ldb_message *message,
+                                     struct ldb_control **controls,
+                                     void *context)
+{
+        struct ldb_context *ldb = call->conn->ldb;
+        struct ldb_request *req;
+        int ret;
+
+        ret = ldb_msg_sanity_check(ldb, message);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        ret = ldb_build_mod_req(&req, ldb, ldb,
+                                        message,
+                                        controls,
+                                        context,
+                                        ldb_modify_default_callback,
+                                        NULL);
+
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        ret = ldb_transaction_start(ldb);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        if (!call->conn->is_privileged) {
+                ldb_req_mark_untrusted(req);
+        }
+
+        LDB_REQ_SET_LOCATION(req);
+
+        ret = ldb_request(ldb, req);
+        if (ret == LDB_SUCCESS) {
+                ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+        }
+
+        if (ret == LDB_SUCCESS) {
+                ret = ldb_transaction_commit(ldb);
+        }
+        else {
+                ldb_transaction_cancel(ldb);
+        }
+
+        talloc_free(req);
+        return ret;
+}
+
+/* create and execute a delete request */
+static int ldapsrv_del_with_controls(struct ldapsrv_call *call,
+                                     struct ldb_dn *dn,
+                                     struct ldb_control **controls,
+                                     void *context)
+{
+        struct ldb_context *ldb = call->conn->ldb;
+        struct ldb_request *req;
+        int ret;
+
+        ret = ldb_build_del_req(&req, ldb, ldb,
+                                        dn,
+                                        controls,
+                                        context,
+                                        ldb_modify_default_callback,
+                                        NULL);
+
+        if (ret != LDB_SUCCESS) return ret;
+
+        ret = ldb_transaction_start(ldb);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        if (!call->conn->is_privileged) {
+                ldb_req_mark_untrusted(req);
+        }
+
+        LDB_REQ_SET_LOCATION(req);
+
+        ret = ldb_request(ldb, req);
+        if (ret == LDB_SUCCESS) {
+                ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+        }
+
+        if (ret == LDB_SUCCESS) {
+                ret = ldb_transaction_commit(ldb);
+        }
+        else {
+                ldb_transaction_cancel(ldb);
+        }
+
+        talloc_free(req);
+        return ret;
+}
+
+static int ldapsrv_rename_with_controls(struct ldapsrv_call *call,
+                                        struct ldb_dn *olddn,
+                                        struct ldb_dn *newdn,
+                                        struct ldb_control **controls,
+                                        void *context)
+{
+        struct ldb_context *ldb = call->conn->ldb;
+        struct ldb_request *req;
+        int ret;
+
+        ret = ldb_build_rename_req(&req, ldb, ldb,
+                                        olddn,
+                                        newdn,
+                                        NULL,
+                                        context,
+                                        ldb_modify_default_callback,
+                                        NULL);
+
+        if (ret != LDB_SUCCESS) return ret;
+
+        ret = ldb_transaction_start(ldb);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+
+        if (!call->conn->is_privileged) {
+                ldb_req_mark_untrusted(req);
+        }
+
+        LDB_REQ_SET_LOCATION(req);
+
+        ret = ldb_request(ldb, req);
+        if (ret == LDB_SUCCESS) {
+                ret = ldb_wait(req->handle, LDB_WAIT_ALL);
+        }
+
+        if (ret == LDB_SUCCESS) {
+                ret = ldb_transaction_commit(ldb);
+        }
+        else {
+                ldb_transaction_cancel(ldb);
+        }
+
+        talloc_free(req);
+        return ret;
 }
 
@@ -293 +500 @@
         int result = -1;
         int ldb_ret = -1;
-        int i, j;
+        unsigned int i, j;
         int extended_type = 1;
 
@@ -304 +511 @@
 
         basedn = ldb_dn_new(local_ctx, samdb, req->basedn);
-        VALID_DN_SYNTAX(basedn);
+        NT_STATUS_HAVE_NO_MEMORY(basedn);
 
         DEBUG(10, ("SearchRequest: basedn: [%s]\n", req->basedn));
@@ -327 +534 @@
                 default:
                         result = LDAP_PROTOCOL_ERROR;
-                        map_ldb_error(local_ctx, LDB_ERR_PROTOCOL_ERROR,
+                        map_ldb_error(local_ctx, LDB_ERR_PROTOCOL_ERROR, NULL,
                                 &errstr);
                         errstr = talloc_asprintf(local_ctx,
@@ -390 +597 @@
 
         ldb_set_timeout(samdb, lreq, req->timelimit);
+
+        if (!call->conn->is_privileged) {
+                ldb_req_mark_untrusted(lreq);
+        }
+
+        LDB_REQ_SET_LOCATION(lreq);
 
         ldb_ret = ldb_request(samdb, lreq);
@@ -432 +645 @@
                         ldapsrv_queue_reply(call, ent_r);
                 }
+
+                /* Send back referrals if they do exist (search operations) */
+                if (res->refs != NULL) {
+                        char **ref;
+                        struct ldap_SearchResRef *ent_ref;
+
+                        for (ref = res->refs; *ref != NULL; ++ref) {
+                                ent_r = ldapsrv_init_reply(call, LDAP_TAG_SearchResultReference);
+                                NT_STATUS_HAVE_NO_MEMORY(ent_r);
+
+                                /* Better to have the whole referrals kept here,
+                                 * than to find someone further up didn't put
+                                 * a value in the right spot in the talloc tree
+                                 */
+                                talloc_steal(ent_r, *ref);
+
+                                ent_ref = &ent_r->msg->r.SearchResultReference;
+                                ent_ref->referral = *ref;
+
+                                ldapsrv_queue_reply(call, ent_r);
+                        }
+                }
         }
 
@@ -455 +690 @@
         } else {
                 DEBUG(10,("SearchRequest: error\n"));
-                result = map_ldb_error(local_ctx, ldb_ret, &errstr);
+                result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
+                                       &errstr);
         }
 
@@ -479 +715 @@
         int result = LDAP_SUCCESS;
         int ldb_ret;
-        int i,j;
+        unsigned int i,j;
+        struct ldb_result *res = NULL;
 
         DEBUG(10, ("ModifyRequest"));
-        DEBUGADD(10, (" dn: %s", req->dn));
+        DEBUGADD(10, (" dn: %s\n", req->dn));
 
         local_ctx = talloc_named(call, 0, "ModifyRequest local memory context");
@@ -488 +725 @@
 
         dn = ldb_dn_new(local_ctx, samdb, req->dn);
-        VALID_DN_SYNTAX(dn);
+        NT_STATUS_HAVE_NO_MEMORY(dn);
 
         DEBUG(10, ("ModifyRequest: dn: [%s]\n", req->dn));
@@ -513 +750 @@
                                 result = LDAP_PROTOCOL_ERROR;
                                 map_ldb_error(local_ctx,
-                                        LDB_ERR_PROTOCOL_ERROR, &errstr);
+                                        LDB_ERR_PROTOCOL_ERROR, NULL, &errstr);
                                 errstr = talloc_asprintf(local_ctx,
                                         "%s. Invalid LDAP_MODIFY_* type", errstr);
@@ -535 +772 @@
 
                                 for (j=0; j < msg->elements[i].num_values; j++) {
-                                        if (!(req->mods[i].attrib.values[j].length > 0)) {
-                                                result = LDAP_OTHER;
-
-                                                map_ldb_error(local_ctx,
-                                                        LDB_ERR_OTHER, &errstr);
-                                                errstr = talloc_asprintf(local_ctx,
-                                                        "%s. Empty attribute values not allowed", errstr);
-                                                goto reply;
-                                        }
                                         msg->elements[i].values[j].length = req->mods[i].attrib.values[j].length;
                                         msg->elements[i].values[j].data = req->mods[i].attrib.values[j].data;                   
@@ -549 +777 @@
                         }
                 }
-        } else {
-                result = LDAP_OTHER;
-                map_ldb_error(local_ctx, LDB_ERR_OTHER, &errstr);
-                errstr = talloc_asprintf(local_ctx,
-                        "%s. No mods are not allowed", errstr);
-                goto reply;
         }
 
@@ -562 +784 @@
 
         if (result == LDAP_SUCCESS) {
-                ldb_ret = ldb_modify(samdb, msg);
-                result = map_ldb_error(local_ctx, ldb_ret, &errstr);
-        }
-
-        modify_result = &modify_reply->msg->r.AddResponse;
+                res = talloc_zero(local_ctx, struct ldb_result);
+                NT_STATUS_HAVE_NO_MEMORY(res);
+                ldb_ret = ldapsrv_mod_with_controls(call, msg, call->request->controls, res);
+                result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
+                                       &errstr);
+        }
+
+        modify_result = &modify_reply->msg->r.ModifyResponse;
         modify_result->dn = NULL;
-        modify_result->resultcode = result;
-        modify_result->errormessage = (errstr?talloc_strdup(modify_reply, errstr):NULL);
-        modify_result->referral = NULL;
-
+        if ((res != NULL) && (res->refs != NULL)) {
+                modify_result->resultcode = map_ldb_error(local_ctx,
+                                                          LDB_ERR_REFERRAL,
+                                                          NULL, &errstr);
+                modify_result->errormessage = (errstr?talloc_strdup(modify_reply, errstr):NULL);
+                modify_result->referral = talloc_strdup(call, *res->refs);
+        } else {
+                modify_result->resultcode = result;
+                modify_result->errormessage = (errstr?talloc_strdup(modify_reply, errstr):NULL);
+                modify_result->referral = NULL;
+        }
         talloc_free(local_ctx);
 
@@ -591 +823 @@
         int result = LDAP_SUCCESS;
         int ldb_ret;
-        int i,j;
+        unsigned int i,j;
+        struct ldb_result *res = NULL;
 
         DEBUG(10, ("AddRequest"));
-        DEBUGADD(10, (" dn: %s", req->dn));
+        DEBUGADD(10, (" dn: %s\n", req->dn));
 
         local_ctx = talloc_named(call, 0, "AddRequest local memory context");
@@ -600 +833 @@
 
         dn = ldb_dn_new(local_ctx, samdb, req->dn);
-        VALID_DN_SYNTAX(dn);
+        NT_STATUS_HAVE_NO_MEMORY(dn);
 
         DEBUG(10, ("AddRequest: dn: [%s]\n", req->dn));
@@ -629 +862 @@
 
                                 for (j=0; j < msg->elements[i].num_values; j++) {
-                                        if (!(req->attributes[i].values[j].length > 0)) {
-                                                result = LDAP_OTHER;
-                                                map_ldb_error(local_ctx,
-                                                        LDB_ERR_OTHER, &errstr);
-                                                errstr = talloc_asprintf(local_ctx,
-                                                        "%s. Empty attribute values not allowed", errstr);
-                                                goto reply;
-                                        }
                                         msg->elements[i].values[j].length = req->attributes[i].values[j].length;
                                         msg->elements[i].values[j].data = req->attributes[i].values[j].data;                    
                                 }
-                        } else {
-                                result = LDAP_OTHER;
-                                map_ldb_error(local_ctx, LDB_ERR_OTHER, &errstr);
-                                errstr = talloc_asprintf(local_ctx,
-                                        "%s. No attribute values are not allowed", errstr);
-                                goto reply;
                         }
                 }
-        } else {
-                result = LDAP_OTHER;
-                map_ldb_error(local_ctx, LDB_ERR_OTHER, &errstr);
-                errstr = talloc_asprintf(local_ctx, 
-                        "%s. No attributes are not allowed", errstr);
-                goto reply;
-        }
-
-reply:
+        }
+
         add_reply = ldapsrv_init_reply(call, LDAP_TAG_AddResponse);
         NT_STATUS_HAVE_NO_MEMORY(add_reply);
 
         if (result == LDAP_SUCCESS) {
-                ldb_ret = ldb_add(samdb, msg);
-                result = map_ldb_error(local_ctx, ldb_ret, &errstr);
+                res = talloc_zero(local_ctx, struct ldb_result);
+                NT_STATUS_HAVE_NO_MEMORY(res);
+                ldb_ret = ldapsrv_add_with_controls(call, msg, call->request->controls, res);
+                result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
+                                       &errstr);
         }
 
         add_result = &add_reply->msg->r.AddResponse;
         add_result->dn = NULL;
-        add_result->resultcode = result;
-        add_result->errormessage = (errstr?talloc_strdup(add_reply,errstr):NULL);
-        add_result->referral = NULL;
-
+        if ((res != NULL) && (res->refs != NULL)) {
+                add_result->resultcode =  map_ldb_error(local_ctx,
+                                                        LDB_ERR_REFERRAL, NULL,
+                                                        &errstr);
+                add_result->errormessage = (errstr?talloc_strdup(add_reply,errstr):NULL);
+                add_result->referral = talloc_strdup(call, *res->refs);
+        } else {
+                add_result->resultcode = result;
+                add_result->errormessage = (errstr?talloc_strdup(add_reply,errstr):NULL);
+                add_result->referral = NULL;
+        }
         talloc_free(local_ctx);
 
@@ -689 +911 @@
         int result = LDAP_SUCCESS;
         int ldb_ret;
+        struct ldb_result *res = NULL;
 
         DEBUG(10, ("DelRequest"));
-        DEBUGADD(10, (" dn: %s", req->dn));
+        DEBUGADD(10, (" dn: %s\n", req->dn));
 
         local_ctx = talloc_named(call, 0, "DelRequest local memory context");
@@ -697 +920 @@
 
         dn = ldb_dn_new(local_ctx, samdb, req->dn);
-        VALID_DN_SYNTAX(dn);
+        NT_STATUS_HAVE_NO_MEMORY(dn);
 
         DEBUG(10, ("DelRequest: dn: [%s]\n", req->dn));
 
-reply:
         del_reply = ldapsrv_init_reply(call, LDAP_TAG_DelResponse);
         NT_STATUS_HAVE_NO_MEMORY(del_reply);
 
         if (result == LDAP_SUCCESS) {
-                ldb_ret = ldb_delete(samdb, dn);
-                result = map_ldb_error(local_ctx, ldb_ret, &errstr);
+                res = talloc_zero(local_ctx, struct ldb_result);
+                NT_STATUS_HAVE_NO_MEMORY(res);
+                ldb_ret = ldapsrv_del_with_controls(call, dn, call->request->controls, res);
+                result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
+                                       &errstr);
         }
 
         del_result = &del_reply->msg->r.DelResponse;
         del_result->dn = NULL;
-        del_result->resultcode = result;
-        del_result->errormessage = (errstr?talloc_strdup(del_reply,errstr):NULL);
-        del_result->referral = NULL;
+        if ((res != NULL) && (res->refs != NULL)) {
+                del_result->resultcode = map_ldb_error(local_ctx,
+                                                       LDB_ERR_REFERRAL, NULL,
+                                                       &errstr);
+                del_result->errormessage = (errstr?talloc_strdup(del_reply,errstr):NULL);
+                del_result->referral = talloc_strdup(call, *res->refs);
+        } else {
+                del_result->resultcode = result;
+                del_result->errormessage = (errstr?talloc_strdup(del_reply,errstr):NULL);
+                del_result->referral = NULL;
+        }
 
         talloc_free(local_ctx);
@@ -734 +967 @@
         int result = LDAP_SUCCESS;
         int ldb_ret;
+        struct ldb_result *res = NULL;
 
         DEBUG(10, ("ModifyDNRequest"));
         DEBUGADD(10, (" dn: %s", req->dn));
-        DEBUGADD(10, (" newrdn: %s", req->newrdn));
+        DEBUGADD(10, (" newrdn: %s\n", req->newrdn));
 
         local_ctx = talloc_named(call, 0, "ModifyDNRequest local memory context");
@@ -743 +977 @@
 
         olddn = ldb_dn_new(local_ctx, samdb, req->dn);
-        VALID_DN_SYNTAX(olddn);
+        NT_STATUS_HAVE_NO_MEMORY(olddn);
 
         newrdn = ldb_dn_new(local_ctx, samdb, req->newrdn);
-        VALID_DN_SYNTAX(newrdn);
+        NT_STATUS_HAVE_NO_MEMORY(newrdn);
 
         DEBUG(10, ("ModifyDNRequest: olddn: [%s]\n", req->dn));
         DEBUG(10, ("ModifyDNRequest: newrdn: [%s]\n", req->newrdn));
+
+        if (ldb_dn_get_comp_num(newrdn) == 0) {
+                result = LDAP_PROTOCOL_ERROR;
+                map_ldb_error(local_ctx, LDB_ERR_PROTOCOL_ERROR, NULL,
+                              &errstr);
+                goto reply;
+        }
+
+        if (ldb_dn_get_comp_num(newrdn) > 1) {
+                result = LDAP_NAMING_VIOLATION;
+                map_ldb_error(local_ctx, LDB_ERR_NAMING_VIOLATION, NULL,
+                              &errstr);
+                goto reply;
+        }
 
         /* we can't handle the rename if we should not remove the old dn */
         if (!req->deleteolddn) {
                 result = LDAP_UNWILLING_TO_PERFORM;
-                map_ldb_error(local_ctx, LDB_ERR_UNWILLING_TO_PERFORM, &errstr);
+                map_ldb_error(local_ctx, LDB_ERR_UNWILLING_TO_PERFORM, NULL,
+                              &errstr);
                 errstr = talloc_asprintf(local_ctx,
                         "%s. Old RDN must be deleted", errstr);
@@ -761 +1010 @@
 
         if (req->newsuperior) {
+                DEBUG(10, ("ModifyDNRequest: newsuperior: [%s]\n", req->newsuperior));
                 parentdn = ldb_dn_new(local_ctx, samdb, req->newsuperior);
-                VALID_DN_SYNTAX(parentdn);
-                DEBUG(10, ("ModifyDNRequest: newsuperior: [%s]\n", req->newsuperior));
-                
-                if (ldb_dn_get_comp_num(parentdn) < 1) {
-                        result = LDAP_AFFECTS_MULTIPLE_DSAS;
-                        map_ldb_error(local_ctx, LDB_ERR_AFFECTS_MULTIPLE_DSAS,
-                                &errstr);
-                        errstr = talloc_asprintf(local_ctx,
-                                "%s. Error new Superior DN invalid", errstr);
-                        goto reply;
-                }
         }
 
         if (!parentdn) {
                 parentdn = ldb_dn_get_parent(local_ctx, olddn);
-                NT_STATUS_HAVE_NO_MEMORY(parentdn);
-        }
-
-        if ( ! ldb_dn_add_child_fmt(parentdn,
-                                "%s=%s",
-                                ldb_dn_get_rdn_name(newrdn),
-                                (char *)ldb_dn_get_rdn_val(newrdn)->data)) {
+        }
+        if (!parentdn) {
+                result = LDAP_NO_SUCH_OBJECT;
+                map_ldb_error(local_ctx, LDB_ERR_NO_SUCH_OBJECT, NULL, &errstr);
+                goto reply;
+        }
+
+        if ( ! ldb_dn_add_child(parentdn, newrdn)) {
                 result = LDAP_OTHER;
+                map_ldb_error(local_ctx, LDB_ERR_OTHER, NULL, &errstr);
                 goto reply;
         }
@@ -794 +1035 @@
 
         if (result == LDAP_SUCCESS) {
-                ldb_ret = ldb_rename(samdb, olddn, newdn);
-                result = map_ldb_error(local_ctx, ldb_ret, &errstr);
+                res = talloc_zero(local_ctx, struct ldb_result);
+                NT_STATUS_HAVE_NO_MEMORY(res);
+                ldb_ret = ldapsrv_rename_with_controls(call, olddn, newdn, call->request->controls, res);
+                result = map_ldb_error(local_ctx, ldb_ret, ldb_errstring(samdb),
+                                       &errstr);
         }
 
         modifydn = &modifydn_r->msg->r.ModifyDNResponse;
         modifydn->dn = NULL;
-        modifydn->resultcode = result;
-        modifydn->errormessage = (errstr?talloc_strdup(modifydn_r,errstr):NULL);
-        modifydn->referral = NULL;
+        if ((res != NULL) && (res->refs != NULL)) {
+                modifydn->resultcode = map_ldb_error(local_ctx,
+                                                     LDB_ERR_REFERRAL, NULL,
+                                                     &errstr);;
+                modifydn->errormessage = (errstr?talloc_strdup(modifydn_r,errstr):NULL);
+                modifydn->referral = talloc_strdup(call, *res->refs);
+        } else {
+                modifydn->resultcode = result;
+                modifydn->errormessage = (errstr?talloc_strdup(modifydn_r,errstr):NULL);
+                modifydn->referral = NULL;
+        }
 
         talloc_free(local_ctx);
@@ -826 +1078 @@
 
         DEBUG(10, ("CompareRequest"));
-        DEBUGADD(10, (" dn: %s", req->dn));
+        DEBUGADD(10, (" dn: %s\n", req->dn));
 
         local_ctx = talloc_named(call, 0, "CompareRequest local_memory_context");
@@ -832 +1084 @@
 
         dn = ldb_dn_new(local_ctx, samdb, req->dn);
-        VALID_DN_SYNTAX(dn);
+        NT_STATUS_HAVE_NO_MEMORY(dn);
 
         DEBUG(10, ("CompareRequest: dn: [%s]\n", req->dn));
@@ -843 +1095 @@
         attrs[0] = NULL;
 
-reply:
         compare_r = ldapsrv_init_reply(call, LDAP_TAG_CompareResponse);
         NT_STATUS_HAVE_NO_MEMORY(compare_r);
@@ -851 +1102 @@
                                      dn, LDB_SCOPE_BASE, attrs, "%s", filter);
                 if (ldb_ret != LDB_SUCCESS) {
-                        result = map_ldb_error(local_ctx, ldb_ret, &errstr);
+                        result = map_ldb_error(local_ctx, ldb_ret,
+                                               ldb_errstring(samdb), &errstr);
                         DEBUG(10,("CompareRequest: error: %s\n", errstr));
                 } else if (res->count == 0) {
@@ -863 +1115 @@
                 } else if (res->count > 1) {
                         result = LDAP_OTHER;
-                        map_ldb_error(local_ctx, LDB_ERR_OTHER, &errstr);
+                        map_ldb_error(local_ctx, LDB_ERR_OTHER, NULL, &errstr);
                         errstr = talloc_asprintf(local_ctx,
                                 "%s. Too many objects match!", errstr);
@@ -891 +1143 @@
 NTSTATUS ldapsrv_do_call(struct ldapsrv_call *call)
 {
-        int i;
+        unsigned int i;
         struct ldap_message *msg = call->request;
         /* Check for undecoded critical extensions */
@@ -925 +1177 @@
                 return ldapsrv_ExtendedRequest(call);
         default:
-                return ldapsrv_unwilling(call, 2);
-        }
-}
+                return ldapsrv_unwilling(call, LDAP_PROTOCOL_ERROR);
+        }
+}

vendor/current/source4/ldap_server/ldap_bind.c

@@ -21 +21 @@
 #include "ldap_server/ldap_server.h"
 #include "auth/auth.h"
-#include "libcli/ldap/ldap.h"
 #include "smbd/service.h"
-#include "lib/ldb/include/ldb.h"
-#include "lib/ldb/include/ldb_errors.h"
+#include <ldb.h>
+#include <ldb_errors.h>
 #include "dsdb/samdb/samdb.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_tstream.h"
 #include "param/param.h"
+#include "../lib/util/tevent_ntstatus.h"
 
 static NTSTATUS ldapsrv_BindSimple(struct ldapsrv_call *call)
@@ -53 +54 @@
                                                   nt4_domain, nt4_account, 
                                                   req->creds.password,
+                                                  MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT |
+                                                  MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT,
                                                   &session_info);
         }
@@ -65 +68 @@
                 errstr = NULL;
 
-                talloc_free(call->conn->session_info);
+                talloc_unlink(call->conn, call->conn->session_info);
                 call->conn->session_info = session_info;
                 talloc_steal(call->conn, session_info);
 
                 /* don't leak the old LDB */
-                talloc_free(call->conn->ldb);
+                talloc_unlink(call->conn, call->conn->ldb);
 
                 status = ldapsrv_backend_Init(call->conn);              
@@ -79 +82 @@
                 }
         } else {
-                status = auth_nt_status_squash(status);
+                status = nt_status_squash(status);
 
                 result = LDAP_INVALID_CREDENTIALS;
@@ -96 +99 @@
 }
 
-struct ldapsrv_sasl_context {
+struct ldapsrv_sasl_postprocess_context {
         struct ldapsrv_connection *conn;
-        struct socket_context *sasl_socket;
+        struct tstream_context *sasl;
 };
 
-static void ldapsrv_set_sasl(void *private_data)
-{
-        struct ldapsrv_sasl_context *ctx = talloc_get_type(private_data, struct ldapsrv_sasl_context);
-        talloc_steal(ctx->conn->connection, ctx->sasl_socket);
-        talloc_unlink(ctx->conn->connection, ctx->conn->connection->socket);
-
-        ctx->conn->sockets.sasl = ctx->sasl_socket;
-        ctx->conn->connection->socket = ctx->sasl_socket;
-        packet_set_socket(ctx->conn->packet, ctx->conn->connection->socket);
+struct ldapsrv_sasl_postprocess_state {
+        uint8_t dummy;
+};
+
+static struct tevent_req *ldapsrv_sasl_postprocess_send(TALLOC_CTX *mem_ctx,
+                                                struct tevent_context *ev,
+                                                void *private_data)
+{
+        struct ldapsrv_sasl_postprocess_context *context =
+                talloc_get_type_abort(private_data,
+                struct ldapsrv_sasl_postprocess_context);
+        struct tevent_req *req;
+        struct ldapsrv_sasl_postprocess_state *state;
+
+        req = tevent_req_create(mem_ctx, &state,
+                                struct ldapsrv_sasl_postprocess_state);
+        if (req == NULL) {
+                return NULL;
+        }
+
+        TALLOC_FREE(context->conn->sockets.sasl);
+        context->conn->sockets.sasl = talloc_move(context->conn, &context->sasl);
+        context->conn->sockets.active = context->conn->sockets.sasl;
+
+        tevent_req_done(req);
+        return tevent_req_post(req, ev);
+}
+
+static NTSTATUS ldapsrv_sasl_postprocess_recv(struct tevent_req *req)
+{
+        return tevent_req_simple_recv_ntstatus(req);
 }
 
@@ -154 +179 @@
                                                  nt_errstr(status));
                 } else {
-                
+
                         gensec_want_feature(conn->gensec, GENSEC_FEATURE_SIGN);
                         gensec_want_feature(conn->gensec, GENSEC_FEATURE_SEAL);
@@ -195 +220 @@
         } else if (NT_STATUS_IS_OK(status)) {
                 struct auth_session_info *old_session_info=NULL;
-                struct ldapsrv_sasl_context *ctx;
+                struct ldapsrv_sasl_postprocess_context *context = NULL;
 
                 result = LDAP_SUCCESS;
                 errstr = NULL;
 
-                ctx = talloc(call, struct ldapsrv_sasl_context); 
-
-                if (!ctx) {
-                        status = NT_STATUS_NO_MEMORY;
-                } else {
-                        ctx->conn = conn;
-                        status = gensec_socket_init(conn->gensec, 
-                                                    conn->connection,
-                                                    conn->connection->socket,
-                                                    conn->connection->event.ctx, 
-                                                    stream_io_handler_callback,
-                                                    conn->connection,
-                                                    &ctx->sasl_socket);
-                } 
-
-                if (!ctx || !NT_STATUS_IS_OK(status)) {
+                if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) ||
+                    gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
+
+                        context = talloc(call, struct ldapsrv_sasl_postprocess_context);
+
+                        if (!context) {
+                                status = NT_STATUS_NO_MEMORY;
+                        }
+                }
+
+                if (context && conn->sockets.tls) {
+                        TALLOC_FREE(context);
+                        status = NT_STATUS_NOT_SUPPORTED;
+                        result = LDAP_UNWILLING_TO_PERFORM;
+                        errstr = talloc_asprintf(reply,
+                                                 "SASL:[%s]: Sign or Seal are not allowed if TLS is used",
+                                                 req->creds.SASL.mechanism);
+                }
+
+                if (context && conn->sockets.sasl) {
+                        TALLOC_FREE(context);
+                        status = NT_STATUS_NOT_SUPPORTED;
+                        result = LDAP_UNWILLING_TO_PERFORM;
+                        errstr = talloc_asprintf(reply,
+                                                 "SASL:[%s]: Sign or Seal are not allowed if SASL encryption has already been set up",
+                                                 req->creds.SASL.mechanism);
+                }
+
+                if (context) {
+                        context->conn = conn;
+                        status = gensec_create_tstream(context,
+                                                       context->conn->gensec,
+                                                       context->conn->sockets.raw,
+                                                       &context->sasl);
+                        if (NT_STATUS_IS_OK(status)) {
+                                if (!talloc_reference(context->sasl, conn->gensec)) {
+                                        status = NT_STATUS_NO_MEMORY;
+                                }
+                        }
+                }
+
+                if (result != LDAP_SUCCESS) {
+                        conn->session_info = old_session_info;
+                } else if (!NT_STATUS_IS_OK(status)) {
                         conn->session_info = old_session_info;
                         result = LDAP_OPERATIONS_ERROR;
@@ -223 +276 @@
                 } else {
 
-                        call->send_callback = ldapsrv_set_sasl;
-                        call->send_private = ctx;
-                
                         old_session_info = conn->session_info;
                         conn->session_info = NULL;
@@ -236 +286 @@
                                                          req->creds.SASL.mechanism, nt_errstr(status));
                         } else {
-                                talloc_free(old_session_info);
+                                talloc_unlink(conn, old_session_info);
                                 talloc_steal(conn, conn->session_info);
                                 
                                 /* don't leak the old LDB */
-                                talloc_free(conn->ldb);
+                                talloc_unlink(conn, conn->ldb);
                                 
                                 status = ldapsrv_backend_Init(conn);            
@@ -253 +303 @@
                         }
                 }
+
+                if (NT_STATUS_IS_OK(status) && context) {
+                        call->postprocess_send = ldapsrv_sasl_postprocess_send;
+                        call->postprocess_recv = ldapsrv_sasl_postprocess_recv;
+                        call->postprocess_private = context;
+                }
+                talloc_unlink(conn, conn->gensec);
+                conn->gensec = NULL;
         } else {
-                status = auth_nt_status_squash(status);
+                status = nt_status_squash(status);
                 if (result == 0) {
                         result = LDAP_INVALID_CREDENTIALS;
                         errstr = talloc_asprintf(reply, "SASL:[%s]: %s", req->creds.SASL.mechanism, nt_errstr(status));
                 }
+                talloc_unlink(conn, conn->gensec);
+                conn->gensec = NULL;
         }
 

vendor/current/source4/ldap_server/ldap_extended.c

@@ -21 +21 @@
 #include "ldap_server/ldap_server.h"
 #include "../lib/util/dlinklist.h"
-#include "libcli/ldap/ldap.h"
 #include "lib/tls/tls.h"
 #include "smbd/service_stream.h"
-
-struct ldapsrv_starttls_context {
+#include "../lib/util/tevent_ntstatus.h"
+
+struct ldapsrv_starttls_postprocess_context {
         struct ldapsrv_connection *conn;
-        struct socket_context *tls_socket;
-};
-
-static void ldapsrv_start_tls(void *private_data)
-{
-        struct ldapsrv_starttls_context *ctx = talloc_get_type(private_data, struct ldapsrv_starttls_context);
-        talloc_steal(ctx->conn->connection, ctx->tls_socket);
-
-        ctx->conn->sockets.tls = ctx->tls_socket;
-        ctx->conn->connection->socket = ctx->tls_socket;
-        packet_set_socket(ctx->conn->packet, ctx->conn->connection->socket);
-        packet_set_unreliable_select(ctx->conn->packet);
+};
+
+struct ldapsrv_starttls_postprocess_state {
+        struct ldapsrv_connection *conn;
+};
+
+static void ldapsrv_starttls_postprocess_done(struct tevent_req *subreq);
+
+static struct tevent_req *ldapsrv_starttls_postprocess_send(TALLOC_CTX *mem_ctx,
+                                                struct tevent_context *ev,
+                                                void *private_data)
+{
+        struct ldapsrv_starttls_postprocess_context *context =
+                talloc_get_type_abort(private_data,
+                struct ldapsrv_starttls_postprocess_context);
+        struct ldapsrv_connection *conn = context->conn;
+        struct tevent_req *req;
+        struct ldapsrv_starttls_postprocess_state *state;
+        struct tevent_req *subreq;
+
+        req = tevent_req_create(mem_ctx, &state,
+                                struct ldapsrv_starttls_postprocess_state);
+        if (req == NULL) {
+                return NULL;
+        }
+
+        state->conn = conn;
+
+        subreq = tstream_tls_accept_send(conn,
+                                         conn->connection->event.ctx,
+                                         conn->sockets.raw,
+                                         conn->service->tls_params);
+        if (tevent_req_nomem(subreq, req)) {
+                return tevent_req_post(req, ev);
+        }
+        tevent_req_set_callback(subreq, ldapsrv_starttls_postprocess_done, req);
+
+        return req;
+}
+
+static void ldapsrv_starttls_postprocess_done(struct tevent_req *subreq)
+{
+        struct tevent_req *req =
+                tevent_req_callback_data(subreq,
+                struct tevent_req);
+        struct ldapsrv_starttls_postprocess_state *state =
+                tevent_req_data(req,
+                struct ldapsrv_starttls_postprocess_state);
+        struct ldapsrv_connection *conn = state->conn;
+        int ret;
+        int sys_errno;
+
+        ret = tstream_tls_accept_recv(subreq, &sys_errno,
+                                      conn, &conn->sockets.tls);
+        TALLOC_FREE(subreq);
+        if (ret == -1) {
+                NTSTATUS status = map_nt_error_from_unix(sys_errno);
+
+                DEBUG(1,("ldapsrv_starttls_postprocess_done: accept_tls_loop: "
+                         "tstream_tls_accept_recv() - %d:%s => %s",
+                         sys_errno, strerror(sys_errno), nt_errstr(status)));
+
+                tevent_req_nterror(req, status);
+                return;
+        }
+
+        conn->sockets.active = conn->sockets.tls;
+
+        tevent_req_done(req);
+}
+
+static NTSTATUS ldapsrv_starttls_postprocess_recv(struct tevent_req *req)
+{
+        return tevent_req_simple_recv_ntstatus(req);
 }
 
@@ -45 +107 @@
                                  const char **errstr)
 {
-        struct ldapsrv_starttls_context *ctx;
+        struct ldapsrv_starttls_postprocess_context *context;
 
         (*errstr) = NULL;
@@ -60 +122 @@
         }
 
-        ctx = talloc(call, struct ldapsrv_starttls_context);
-        NT_STATUS_HAVE_NO_MEMORY(ctx);
-
-        ctx->conn = call->conn;
-        ctx->tls_socket = tls_init_server(call->conn->service->tls_params,
-                                          call->conn->connection->socket,
-                                          call->conn->connection->event.fde, 
-                                          NULL);
-        if (!ctx->tls_socket) {
-                (*errstr) = talloc_asprintf(reply, "START-TLS: Failed to setup TLS socket");
+        if (call->conn->sockets.sasl) {
+                (*errstr) = talloc_asprintf(reply, "START-TLS: SASL is already enabled on this LDAP session");
                 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR);
         }
 
-        call->send_callback = ldapsrv_start_tls;
-        call->send_private  = ctx;
+        context = talloc(call, struct ldapsrv_starttls_postprocess_context);
+        NT_STATUS_HAVE_NO_MEMORY(context);
+
+        context->conn = call->conn;
+
+        call->postprocess_send = ldapsrv_starttls_postprocess_send;
+        call->postprocess_recv = ldapsrv_starttls_postprocess_recv;
+        call->postprocess_private = context;
 
         reply->msg->r.ExtendedResponse.response.resultcode = LDAP_SUCCESS;
@@ -105 +165 @@
         const char *error_str = NULL;
         NTSTATUS status = NT_STATUS_OK;
-        uint32_t i;
+        unsigned int i;
 
         DEBUG(10, ("Extended\n"));

vendor/current/source4/ldap_server/ldap_server.c

@@ -23 +23 @@
 
 #include "includes.h"
+#include "system/network.h"
 #include "lib/events/events.h"
 #include "auth/auth.h"
@@ -36 +37 @@
 #include "lib/tls/tls.h"
 #include "lib/messaging/irpc.h"
-#include "lib/ldb/include/ldb.h"
-#include "lib/ldb/include/ldb_errors.h"
-#include "libcli/ldap/ldap.h"
+#include <ldb.h>
+#include <ldb_errors.h>
 #include "libcli/ldap/ldap_proto.h"
 #include "system/network.h"
@@ -44 +44 @@
 #include "dsdb/samdb/samdb.h"
 #include "param/param.h"
+#include "../lib/tsocket/tsocket.h"
+#include "../lib/util/tevent_ntstatus.h"
+#include "../libcli/util/tstream.h"
+
+static void ldapsrv_terminate_connection_done(struct tevent_req *subreq);
+
 /*
   close the socket and shutdown a server_context
 */
-void ldapsrv_terminate_connection(struct ldapsrv_connection *conn, 
+static void ldapsrv_terminate_connection(struct ldapsrv_connection *conn,
                                          const char *reason)
 {
-        packet_recv_disable(conn->packet);
-        TALLOC_FREE(conn->packet);
+        struct tevent_req *subreq;
+
+        if (conn->limits.reason) {
+                return;
+        }
+
+        conn->limits.endtime = timeval_current_ofs(0, 500);
+
+        tevent_queue_stop(conn->sockets.send_queue);
+        if (conn->active_call) {
+                tevent_req_cancel(conn->active_call);
+                conn->active_call = NULL;
+        }
+
+        conn->limits.reason = talloc_strdup(conn, reason);
+        if (conn->limits.reason == NULL) {
+                TALLOC_FREE(conn->sockets.tls);
+                TALLOC_FREE(conn->sockets.sasl);
+                TALLOC_FREE(conn->sockets.raw);
+                stream_terminate_connection(conn->connection, reason);
+                return;
+        }
+
+        subreq = tstream_disconnect_send(conn,
+                                         conn->connection->event.ctx,
+                                         conn->sockets.active);
+        if (subreq == NULL) {
+                TALLOC_FREE(conn->sockets.tls);
+                TALLOC_FREE(conn->sockets.sasl);
+                TALLOC_FREE(conn->sockets.raw);
+                stream_terminate_connection(conn->connection, reason);
+                return;
+        }
+        tevent_req_set_endtime(subreq,
+                               conn->connection->event.ctx,
+                               conn->limits.endtime);
+        tevent_req_set_callback(subreq, ldapsrv_terminate_connection_done, conn);
+}
+
+static void ldapsrv_terminate_connection_done(struct tevent_req *subreq)
+{
+        struct ldapsrv_connection *conn =
+                tevent_req_callback_data(subreq,
+                struct ldapsrv_connection);
+        int ret;
+        int sys_errno;
+
+        ret = tstream_disconnect_recv(subreq, &sys_errno);
+        TALLOC_FREE(subreq);
+
+        if (conn->sockets.active == conn->sockets.raw) {
+                TALLOC_FREE(conn->sockets.tls);
+                TALLOC_FREE(conn->sockets.sasl);
+                TALLOC_FREE(conn->sockets.raw);
+                stream_terminate_connection(conn->connection,
+                                            conn->limits.reason);
+                return;
+        }
+
         TALLOC_FREE(conn->sockets.tls);
-        stream_terminate_connection(conn->connection, reason);
-}
-
-/*
-  handle packet errors
-*/
-static void ldapsrv_error_handler(void *private_data, NTSTATUS status)
-{
-        struct ldapsrv_connection *conn = talloc_get_type(private_data,
-                                                          struct ldapsrv_connection);
-        ldapsrv_terminate_connection(conn, nt_errstr(status));
-}
-
-/*
-  process a decoded ldap message
-*/
-static void ldapsrv_process_message(struct ldapsrv_connection *conn,
-                                    struct ldap_message *msg)
-{
-        struct ldapsrv_call *call;
-        NTSTATUS status;
-        DATA_BLOB blob;
-
-        call = talloc(conn, struct ldapsrv_call);
-        if (!call) {
-                ldapsrv_terminate_connection(conn, "no memory");
-                return;         
-        }
-
-        call->request = talloc_steal(call, msg);
-        call->conn = conn;
-        call->replies = NULL;
-        call->send_callback = NULL;
-        call->send_private = NULL;
-
-        /* make the call */
-        status = ldapsrv_do_call(call);
-        if (!NT_STATUS_IS_OK(status)) {
-                talloc_free(call);
-                return;
-        }
-
-        blob = data_blob(NULL, 0);
-
-        if (call->replies == NULL) {
-                talloc_free(call);
-                return;
-        }
-
-        /* build all the replies into a single blob */
-        while (call->replies) {
-                DATA_BLOB b;
-                bool ret;
-
-                msg = call->replies->msg;
-                if (!ldap_encode(msg, samba_ldap_control_handlers(), &b, call)) {
-                        DEBUG(0,("Failed to encode ldap reply of type %d\n", msg->type));
-                        talloc_free(call);
-                        return;
-                }
-
-                ret = data_blob_append(call, &blob, b.data, b.length);
-                data_blob_free(&b);
-
-                talloc_set_name_const(blob.data, "Outgoing, encoded LDAP packet");
-
-                if (!ret) {
-                        talloc_free(call);
-                        return;
-                }
-
-                DLIST_REMOVE(call->replies, call->replies);
-        }
-
-        packet_send_callback(conn->packet, blob, 
-                             call->send_callback, call->send_private);
-        talloc_free(call);
-        return;
-}
-
-/*
-  decode/process data
-*/
-static NTSTATUS ldapsrv_decode(void *private_data, DATA_BLOB blob)
-{
-        NTSTATUS status;
-        struct ldapsrv_connection *conn = talloc_get_type(private_data,
-                                                          struct ldapsrv_connection);
-        struct asn1_data *asn1 = asn1_init(conn);
-        struct ldap_message *msg = talloc(conn, struct ldap_message);
-
-        if (asn1 == NULL || msg == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!asn1_load(asn1, blob)) {
-                talloc_free(msg);
-                talloc_free(asn1);
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        status = ldap_decode(asn1, samba_ldap_control_handlers(), msg);
-        if (!NT_STATUS_IS_OK(status)) {
-                asn1_free(asn1);
-                return status;
-        }
-
-        data_blob_free(&blob);
-        talloc_steal(conn, msg);
-        asn1_free(asn1);
-
-        ldapsrv_process_message(conn, msg);
-        return NT_STATUS_OK;
-}
-
-/*
- Idle timeout handler
-*/
-static void ldapsrv_conn_idle_timeout(struct tevent_context *ev,
-                                      struct tevent_timer *te,
-                                      struct timeval t,
-                                      void *private_data)
-{
-        struct ldapsrv_connection *conn = talloc_get_type(private_data, struct ldapsrv_connection);
-
-        ldapsrv_terminate_connection(conn, "Timeout. No requests after bind");
+        TALLOC_FREE(conn->sockets.sasl);
+        conn->sockets.active = conn->sockets.raw;
+
+        subreq = tstream_disconnect_send(conn,
+                                         conn->connection->event.ctx,
+                                         conn->sockets.active);
+        if (subreq == NULL) {
+                TALLOC_FREE(conn->sockets.raw);
+                stream_terminate_connection(conn->connection,
+                                            conn->limits.reason);
+                return;
+        }
+        tevent_req_set_endtime(subreq,
+                               conn->connection->event.ctx,
+                               conn->limits.endtime);
+        tevent_req_set_callback(subreq, ldapsrv_terminate_connection_done, conn);
 }
 
@@ -186 +139 @@
 void ldapsrv_recv(struct stream_connection *c, uint16_t flags)
 {
-        struct ldapsrv_connection *conn = 
-                talloc_get_type(c->private_data, struct ldapsrv_connection);
-
-        if (conn->limits.ite) { /* clean initial timeout if any */
-                talloc_free(conn->limits.ite);
-                conn->limits.ite = NULL;
-        }
-
-        if (conn->limits.te) { /* clean idle timeout if any */
-                talloc_free(conn->limits.te);
-                conn->limits.te = NULL;
-        }
-
-        packet_recv(conn->packet);
-
-        /* set idle timeout */
-        conn->limits.te = event_add_timed(c->event.ctx, conn, 
-                                           timeval_current_ofs(conn->limits.conn_idle_time, 0),
-                                           ldapsrv_conn_idle_timeout, conn);
+        smb_panic(__location__);
 }
 
@@ -212 +147 @@
 static void ldapsrv_send(struct stream_connection *c, uint16_t flags)
 {
-        struct ldapsrv_connection *conn = 
-                talloc_get_type(c->private_data, struct ldapsrv_connection);
-
-        packet_queue_run(conn->packet);
-}
-
-static void ldapsrv_conn_init_timeout(struct tevent_context *ev,
-                                      struct tevent_timer *te,
-                                      struct timeval t,
-                                      void *private_data)
-{
-        struct ldapsrv_connection *conn = talloc_get_type(private_data, struct ldapsrv_connection);
-
-        ldapsrv_terminate_connection(conn, "Timeout. No requests after initial connection");
+        smb_panic(__location__);
 }
 
@@ -238 +160 @@
         struct ldb_dn *conf_dn;
         struct ldb_dn *policy_dn;
-        int i,ret;
+        unsigned int i;
+        int ret;
 
         /* set defaults limits in case of failure */
@@ -253 +176 @@
 
         basedn = ldb_dn_new(tmp_ctx, conn->ldb, NULL);
-        if ( ! ldb_dn_validate(basedn)) {
+        if (basedn == NULL) {
                 goto failed;
         }
@@ -324 +247 @@
         return -1;
 }
+
+static struct tevent_req *ldapsrv_process_call_send(TALLOC_CTX *mem_ctx,
+                                                    struct tevent_context *ev,
+                                                    struct tevent_queue *call_queue,
+                                                    struct ldapsrv_call *call);
+static NTSTATUS ldapsrv_process_call_recv(struct tevent_req *req);
+
+static bool ldapsrv_call_read_next(struct ldapsrv_connection *conn);
+static void ldapsrv_accept_tls_done(struct tevent_req *subreq);
 
 /*
@@ -330 +262 @@
 */
 static void ldapsrv_accept(struct stream_connection *c,
-                           struct auth_session_info *session_info)
+                           struct auth_session_info *session_info,
+                           bool is_privileged)
 {
         struct ldapsrv_service *ldapsrv_service = 
@@ -339 +272 @@
         NTSTATUS status;
         int port;
+        int ret;
+        struct tevent_req *subreq;
+        struct timeval endtime;
 
         conn = talloc_zero(c, struct ldapsrv_connection);
@@ -345 +281 @@
                 return;
         }
-
-        conn->packet      = NULL;
+        conn->is_privileged = is_privileged;
+
+        conn->sockets.send_queue = tevent_queue_create(conn, "ldapsev send queue");
+        if (conn->sockets.send_queue == NULL) {
+                stream_terminate_connection(c,
+                                            "ldapsrv_accept: tevent_queue_create failed");
+                return;
+        }
+
+        TALLOC_FREE(c->event.fde);
+
+        ret = tstream_bsd_existing_socket(conn,
+                                          socket_get_fd(c->socket),
+                                          &conn->sockets.raw);
+        if (ret == -1) {
+                stream_terminate_connection(c,
+                                            "ldapsrv_accept: out of memory");
+                return;
+        }
+        socket_set_flags(c->socket, SOCKET_FLAG_NOCLOSE);
+
         conn->connection  = c;
         conn->service     = ldapsrv_service;
-        conn->sockets.raw = c->socket;
         conn->lp_ctx      = ldapsrv_service->task->lp_ctx;
 
@@ -361 +315 @@
         port = socket_address->port;
         talloc_free(socket_address);
-
-        if (port == 636) {
-                struct socket_context *tls_socket = tls_init_server(ldapsrv_service->tls_params, c->socket, 
-                                                                    c->event.fde, NULL);
-                if (!tls_socket) {
-                        ldapsrv_terminate_connection(conn, "ldapsrv_accept: tls_init_server() failed");
-                        return;
-                }
-                talloc_steal(c, tls_socket);
-                c->socket = tls_socket;
-                conn->sockets.tls = tls_socket;
-
-        } else if (port == 3268) /* Global catalog */ {
+        if (port == 3268 || port == 3269) /* Global catalog */ {
                 conn->global_catalog = true;
         }
-        conn->packet = packet_init(conn);
-        if (conn->packet == NULL) {
-                ldapsrv_terminate_connection(conn, "out of memory");
-                return;
-        }
-
-        packet_set_private(conn->packet, conn);
-        packet_set_socket(conn->packet, c->socket);
-        packet_set_callback(conn->packet, ldapsrv_decode);
-        packet_set_full_request(conn->packet, ldap_full_packet);
-        packet_set_error_handler(conn->packet, ldapsrv_error_handler);
-        packet_set_event_context(conn->packet, c->event.ctx);
-        packet_set_fde(conn->packet, c->event.fde);
-        packet_set_serialise(conn->packet);
-
-        if (conn->sockets.tls) {
-                packet_set_unreliable_select(conn->packet);
-        }
-
-        /* Ensure we don't get packets until the database is ready below */
-        packet_recv_disable(conn->packet);
 
         server_credentials = cli_credentials_init(conn);
@@ -412 +333 @@
         conn->server_credentials = server_credentials;
 
-        conn->session_info = talloc_move(conn, &session_info);
+        conn->session_info = session_info;
 
         if (!NT_STATUS_IS_OK(ldapsrv_backend_Init(conn))) {
@@ -425 +346 @@
         irpc_add_name(c->msg_ctx, "ldap_server");
 
-        /* set connections limits */
-        conn->limits.ite = event_add_timed(c->event.ctx, conn, 
-                                           timeval_current_ofs(conn->limits.initial_timeout, 0),
-                                           ldapsrv_conn_init_timeout, conn);
-
-        packet_recv_enable(conn->packet);
-
+        conn->sockets.active = conn->sockets.raw;
+
+        if (port != 636 && port != 3269) {
+                ldapsrv_call_read_next(conn);
+                return;
+        }
+
+        endtime = timeval_current_ofs(conn->limits.conn_idle_time, 0);
+
+        subreq = tstream_tls_accept_send(conn,
+                                         conn->connection->event.ctx,
+                                         conn->sockets.raw,
+                                         conn->service->tls_params);
+        if (subreq == NULL) {
+                ldapsrv_terminate_connection(conn, "ldapsrv_accept: "
+                                "no memory for tstream_tls_accept_send");
+                return;
+        }
+        tevent_req_set_endtime(subreq,
+                               conn->connection->event.ctx,
+                               endtime);
+        tevent_req_set_callback(subreq, ldapsrv_accept_tls_done, conn);
+}
+
+static void ldapsrv_accept_tls_done(struct tevent_req *subreq)
+{
+        struct ldapsrv_connection *conn =
+                tevent_req_callback_data(subreq,
+                struct ldapsrv_connection);
+        int ret;
+        int sys_errno;
+
+        ret = tstream_tls_accept_recv(subreq, &sys_errno,
+                                      conn, &conn->sockets.tls);
+        TALLOC_FREE(subreq);
+        if (ret == -1) {
+                const char *reason;
+
+                reason = talloc_asprintf(conn, "ldapsrv_accept_tls_loop: "
+                                         "tstream_tls_accept_recv() - %d:%s",
+                                         sys_errno, strerror(sys_errno));
+                if (!reason) {
+                        reason = "ldapsrv_accept_tls_loop: "
+                                 "tstream_tls_accept_recv() - failed";
+                }
+
+                ldapsrv_terminate_connection(conn, reason);
+                return;
+        }
+
+        conn->sockets.active = conn->sockets.tls;
+        ldapsrv_call_read_next(conn);
+}
+
+static void ldapsrv_call_read_done(struct tevent_req *subreq);
+
+static bool ldapsrv_call_read_next(struct ldapsrv_connection *conn)
+{
+        struct tevent_req *subreq;
+
+        if (timeval_is_zero(&conn->limits.endtime)) {
+                conn->limits.endtime =
+                        timeval_current_ofs(conn->limits.initial_timeout, 0);
+        } else {
+                conn->limits.endtime =
+                        timeval_current_ofs(conn->limits.conn_idle_time, 0);
+        }
+
+        /*
+         * The minimun size of a LDAP pdu is 7 bytes
+         *
+         * dumpasn1 -hh ldap-unbind-min.dat
+         *
+         *     <30 05 02 01 09 42 00>
+         *    0    5: SEQUENCE {
+         *     <02 01 09>
+         *    2    1:   INTEGER 9
+         *     <42 00>
+         *    5    0:   [APPLICATION 2]
+         *          :     Error: Object has zero length.
+         *          :   }
+         *
+         * dumpasn1 -hh ldap-unbind-windows.dat
+         *
+         *     <30 84 00 00 00 05 02 01 09 42 00>
+         *    0    5: SEQUENCE {
+         *     <02 01 09>
+         *    6    1:   INTEGER 9
+         *     <42 00>
+         *    9    0:   [APPLICATION 2]
+         *          :     Error: Object has zero length.
+         *          :   }
+         *
+         * This means using an initial read size
+         * of 7 is ok.
+         */
+        subreq = tstream_read_pdu_blob_send(conn,
+                                            conn->connection->event.ctx,
+                                            conn->sockets.active,
+                                            7, /* initial_read_size */
+                                            ldap_full_packet,
+                                            conn);
+        if (subreq == NULL) {
+                ldapsrv_terminate_connection(conn, "ldapsrv_call_read_next: "
+                                "no memory for tstream_read_pdu_blob_send");
+                return false;
+        }
+        tevent_req_set_endtime(subreq,
+                               conn->connection->event.ctx,
+                               conn->limits.endtime);
+        tevent_req_set_callback(subreq, ldapsrv_call_read_done, conn);
+        return true;
+}
+
+static void ldapsrv_call_process_done(struct tevent_req *subreq);
+
+static void ldapsrv_call_read_done(struct tevent_req *subreq)
+{
+        struct ldapsrv_connection *conn =
+                tevent_req_callback_data(subreq,
+                struct ldapsrv_connection);
+        NTSTATUS status;
+        struct ldapsrv_call *call;
+        struct asn1_data *asn1;
+        DATA_BLOB blob;
+
+        call = talloc_zero(conn, struct ldapsrv_call);
+        if (!call) {
+                ldapsrv_terminate_connection(conn, "no memory");
+                return;
+        }
+
+        call->conn = conn;
+
+        status = tstream_read_pdu_blob_recv(subreq,
+                                            call,
+                                            &blob);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) {
+                const char *reason;
+
+                reason = talloc_asprintf(call, "ldapsrv_call_loop: "
+                                         "tstream_read_pdu_blob_recv() - %s",
+                                         nt_errstr(status));
+                if (!reason) {
+                        reason = nt_errstr(status);
+                }
+
+                ldapsrv_terminate_connection(conn, reason);
+                return;
+        }
+
+        asn1 = asn1_init(call);
+        if (asn1 == NULL) {
+                ldapsrv_terminate_connection(conn, "no memory");
+                return;
+        }
+
+        call->request = talloc(call, struct ldap_message);
+        if (call->request == NULL) {
+                ldapsrv_terminate_connection(conn, "no memory");
+                return;
+        }
+
+        if (!asn1_load(asn1, blob)) {
+                ldapsrv_terminate_connection(conn, "asn1_load failed");
+                return;
+        }
+
+        status = ldap_decode(asn1, samba_ldap_control_handlers(),
+                             call->request);
+        if (!NT_STATUS_IS_OK(status)) {
+                ldapsrv_terminate_connection(conn, nt_errstr(status));
+                return;
+        }
+
+        data_blob_free(&blob);
+
+
+        /* queue the call in the global queue */
+        subreq = ldapsrv_process_call_send(call,
+                                           conn->connection->event.ctx,
+                                           conn->service->call_queue,
+                                           call);
+        if (subreq == NULL) {
+                ldapsrv_terminate_connection(conn, "ldapsrv_process_call_send failed");
+                return;
+        }
+        tevent_req_set_callback(subreq, ldapsrv_call_process_done, call);
+        conn->active_call = subreq;
+}
+
+static void ldapsrv_call_writev_done(struct tevent_req *subreq);
+
+static void ldapsrv_call_process_done(struct tevent_req *subreq)
+{
+        struct ldapsrv_call *call =
+                tevent_req_callback_data(subreq,
+                struct ldapsrv_call);
+        struct ldapsrv_connection *conn = call->conn;
+        NTSTATUS status;
+        DATA_BLOB blob = data_blob_null;
+
+        conn->active_call = NULL;
+
+        status = ldapsrv_process_call_recv(subreq);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) {
+                ldapsrv_terminate_connection(conn, nt_errstr(status));
+                return;
+        }
+
+        /* build all the replies into a single blob */
+        while (call->replies) {
+                DATA_BLOB b;
+                bool ret;
+
+                if (!ldap_encode(call->replies->msg, samba_ldap_control_handlers(), &b, call)) {
+                        DEBUG(0,("Failed to encode ldap reply of type %d\n",
+                                 call->replies->msg->type));
+                        ldapsrv_terminate_connection(conn, "ldap_encode failed");
+                        return;
+                }
+
+                ret = data_blob_append(call, &blob, b.data, b.length);
+                data_blob_free(&b);
+
+                talloc_set_name_const(blob.data, "Outgoing, encoded LDAP packet");
+
+                if (!ret) {
+                        ldapsrv_terminate_connection(conn, "data_blob_append failed");
+                        return;
+                }
+
+                DLIST_REMOVE(call->replies, call->replies);
+        }
+
+        if (blob.length == 0) {
+                TALLOC_FREE(call);
+
+                ldapsrv_call_read_next(conn);
+                return;
+        }
+
+        call->out_iov.iov_base = blob.data;
+        call->out_iov.iov_len = blob.length;
+
+        subreq = tstream_writev_queue_send(call,
+                                           conn->connection->event.ctx,
+                                           conn->sockets.active,
+                                           conn->sockets.send_queue,
+                                           &call->out_iov, 1);
+        if (subreq == NULL) {
+                ldapsrv_terminate_connection(conn, "stream_writev_queue_send failed");
+                return;
+        }
+        tevent_req_set_callback(subreq, ldapsrv_call_writev_done, call);
+}
+
+static void ldapsrv_call_postprocess_done(struct tevent_req *subreq);
+
+static void ldapsrv_call_writev_done(struct tevent_req *subreq)
+{
+        struct ldapsrv_call *call =
+                tevent_req_callback_data(subreq,
+                struct ldapsrv_call);
+        struct ldapsrv_connection *conn = call->conn;
+        int sys_errno;
+        int rc;
+
+        rc = tstream_writev_queue_recv(subreq, &sys_errno);
+        TALLOC_FREE(subreq);
+        if (rc == -1) {
+                const char *reason;
+
+                reason = talloc_asprintf(call, "ldapsrv_call_writev_done: "
+                                         "tstream_writev_queue_recv() - %d:%s",
+                                         sys_errno, strerror(sys_errno));
+                if (reason == NULL) {
+                        reason = "ldapsrv_call_writev_done: "
+                                 "tstream_writev_queue_recv() failed";
+                }
+
+                ldapsrv_terminate_connection(conn, reason);
+                return;
+        }
+
+        if (call->postprocess_send) {
+                subreq = call->postprocess_send(call,
+                                                conn->connection->event.ctx,
+                                                call->postprocess_private);
+                if (subreq == NULL) {
+                        ldapsrv_terminate_connection(conn, "ldapsrv_call_writev_done: "
+                                        "call->postprocess_send - no memory");
+                        return;
+                }
+                tevent_req_set_callback(subreq,
+                                        ldapsrv_call_postprocess_done,
+                                        call);
+                return;
+        }
+
+        TALLOC_FREE(call);
+
+        ldapsrv_call_read_next(conn);
+}
+
+static void ldapsrv_call_postprocess_done(struct tevent_req *subreq)
+{
+        struct ldapsrv_call *call =
+                tevent_req_callback_data(subreq,
+                struct ldapsrv_call);
+        struct ldapsrv_connection *conn = call->conn;
+        NTSTATUS status;
+
+        status = call->postprocess_recv(subreq);
+        TALLOC_FREE(subreq);
+        if (!NT_STATUS_IS_OK(status)) {
+                const char *reason;
+
+                reason = talloc_asprintf(call, "ldapsrv_call_postprocess_done: "
+                                         "call->postprocess_recv() - %s",
+                                         nt_errstr(status));
+                if (reason == NULL) {
+                        reason = nt_errstr(status);
+                }
+
+                ldapsrv_terminate_connection(conn, reason);
+                return;
+        }
+
+        TALLOC_FREE(call);
+
+        ldapsrv_call_read_next(conn);
+}
+
+struct ldapsrv_process_call_state {
+        struct ldapsrv_call *call;
+};
+
+static void ldapsrv_process_call_trigger(struct tevent_req *req,
+                                         void *private_data);
+
+static struct tevent_req *ldapsrv_process_call_send(TALLOC_CTX *mem_ctx,
+                                                    struct tevent_context *ev,
+                                                    struct tevent_queue *call_queue,
+                                                    struct ldapsrv_call *call)
+{
+        struct tevent_req *req;
+        struct ldapsrv_process_call_state *state;
+        bool ok;
+
+        req = tevent_req_create(mem_ctx, &state,
+                                struct ldapsrv_process_call_state);
+        if (req == NULL) {
+                return req;
+        }
+
+        state->call = call;
+
+        ok = tevent_queue_add(call_queue, ev, req,
+                              ldapsrv_process_call_trigger, NULL);
+        if (!ok) {
+                tevent_req_nomem(NULL, req);
+                return tevent_req_post(req, ev);
+        }
+
+        return req;
+}
+
+static void ldapsrv_process_call_trigger(struct tevent_req *req,
+                                         void *private_data)
+{
+        struct ldapsrv_process_call_state *state =
+                tevent_req_data(req,
+                struct ldapsrv_process_call_state);
+        NTSTATUS status;
+
+        /* make the call */
+        status = ldapsrv_do_call(state->call);
+        if (!NT_STATUS_IS_OK(status)) {
+                tevent_req_nterror(req, status);
+                return;
+        }
+
+        tevent_req_done(req);
+}
+
+static NTSTATUS ldapsrv_process_call_recv(struct tevent_req *req)
+{
+        NTSTATUS status;
+
+        if (tevent_req_is_nterror(req, &status)) {
+                tevent_req_received(req);
+                return status;
+        }
+
+        tevent_req_received(req);
+        return NT_STATUS_OK;
 }
 
@@ -442 +755 @@
 
         status = auth_anonymous_session_info(
-                c, c->event.ctx, ldapsrv_service->task->lp_ctx, &session_info);
+                c, ldapsrv_service->task->lp_ctx, &session_info);
         if (!NT_STATUS_IS_OK(status)) {
                 stream_terminate_connection(c, "failed to setup anonymous "
@@ -448 +761 @@
                 return;
         }
-        ldapsrv_accept(c, session_info);
+        ldapsrv_accept(c, session_info, false);
 }
 
@@ -469 +782 @@
                 c->private_data, struct ldapsrv_service);
         struct auth_session_info *session_info;
-        NTSTATUS status;
-
-        status = auth_system_session_info(
-                c, ldapsrv_service->task->lp_ctx, &session_info);
-        if (!NT_STATUS_IS_OK(status)) {
+
+        session_info = system_session(ldapsrv_service->task->lp_ctx);
+        if (!session_info) {
                 stream_terminate_connection(c, "failed to setup system "
                                             "session info");
                 return;
         }
-        ldapsrv_accept(c, session_info);
+        ldapsrv_accept(c, session_info, true);
 }
 
@@ -489 +800 @@
 
 #endif
+
+
 /*
   add a socket address to the list of events, one event per port
 */
-static NTSTATUS add_socket(struct tevent_context *event_context,
-                           struct loadparm_context *lp_ctx, 
+static NTSTATUS add_socket(struct task_server *task,
+                           struct loadparm_context *lp_ctx,
                            const struct model_ops *model_ops,
                            const char *address, struct ldapsrv_service *ldap_service)
@@ -501 +814 @@
         struct ldb_context *ldb;
 
-        status = stream_setup_socket(event_context, lp_ctx,
+        status = stream_setup_socket(task, task->event_ctx, lp_ctx,
                                      model_ops, &ldap_stream_nonpriv_ops,
                                      "ipv4", address, &port, 
-                                     lp_socket_options(lp_ctx), 
+                                     lpcfg_socket_options(lp_ctx),
                                      ldap_service);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
                          address, port, nt_errstr(status)));
-        }
-
-        if (tls_support(ldap_service->tls_params)) {
+                return status;
+        }
+
+        if (tstream_tls_params_enabled(ldap_service->tls_params)) {
                 /* add ldaps server */
                 port = 636;
-                status = stream_setup_socket(event_context, lp_ctx, 
+                status = stream_setup_socket(task, task->event_ctx, lp_ctx,
                                              model_ops,
                                              &ldap_stream_nonpriv_ops,
                                              "ipv4", address, &port, 
-                                             lp_socket_options(lp_ctx), 
+                                             lpcfg_socket_options(lp_ctx),
                                              ldap_service);
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
                                  address, port, nt_errstr(status)));
+                        return status;
                 }
         }
@@ -528 +843 @@
         /* Load LDAP database, but only to read our settings */
         ldb = samdb_connect(ldap_service, ldap_service->task->event_ctx, 
-                            lp_ctx, system_session(ldap_service, lp_ctx));
+                            lp_ctx, system_session(lp_ctx), 0);
         if (!ldb) {
                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -535 +850 @@
         if (samdb_is_gc(ldb)) {
                 port = 3268;
-                status = stream_setup_socket(event_context, lp_ctx,
+                status = stream_setup_socket(task, task->event_ctx, lp_ctx,
                                              model_ops,
                                              &ldap_stream_nonpriv_ops,
                                              "ipv4", address, &port, 
-                                             lp_socket_options(lp_ctx), 
+                                             lpcfg_socket_options(lp_ctx),
                                              ldap_service);
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
                                  address, port, nt_errstr(status)));
-                }
-        }
-
-        /* And once we are bound, free the tempoary ldb, it will
+                        return status;
+                }
+                if (tstream_tls_params_enabled(ldap_service->tls_params)) {
+                        /* add ldaps server for the global catalog */
+                        port = 3269;
+                        status = stream_setup_socket(task, task->event_ctx, lp_ctx,
+                                                     model_ops,
+                                                     &ldap_stream_nonpriv_ops,
+                                                     "ipv4", address, &port,
+                                                     lpcfg_socket_options(lp_ctx),
+                                                     ldap_service);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                DEBUG(0,("ldapsrv failed to bind to %s:%u - %s\n",
+                                         address, port, nt_errstr(status)));
+                                return status;
+                        }
+                }
+        }
+
+        /* And once we are bound, free the temporary ldb, it will
          * connect again on each incoming LDAP connection */
-        talloc_free(ldb);
-
-        return status;
+        talloc_unlink(ldap_service, ldb);
+
+        return NT_STATUS_OK;
 }
 
@@ -563 +894 @@
         char *priv_dir;
 #endif
+        const char *dns_host_name;
         struct ldapsrv_service *ldap_service;
         NTSTATUS status;
         const struct model_ops *model_ops;
 
-        switch (lp_server_role(task->lp_ctx)) {
+        switch (lpcfg_server_role(task->lp_ctx)) {
         case ROLE_STANDALONE:
                 task_server_terminate(task, "ldap_server: no LDAP server required in standalone configuration", 
@@ -584 +916 @@
 
         /* run the ldap server as a single process */
-        model_ops = process_model_startup(task->event_ctx, "single");
+        model_ops = process_model_startup("single");
         if (!model_ops) goto failed;
 
@@ -592 +924 @@
         ldap_service->task = task;
 
-        ldap_service->tls_params = tls_initialise(ldap_service, task->lp_ctx);
-        if (ldap_service->tls_params == NULL) goto failed;
-
-        if (lp_interfaces(task->lp_ctx) && lp_bind_interfaces_only(task->lp_ctx)) {
+        dns_host_name = talloc_asprintf(ldap_service, "%s.%s",
+                                        lpcfg_netbios_name(task->lp_ctx),
+                                        lpcfg_dnsdomain(task->lp_ctx));
+        if (dns_host_name == NULL) goto failed;
+
+        status = tstream_tls_params_server(ldap_service,
+                                           dns_host_name,
+                                           lpcfg_tls_enabled(task->lp_ctx),
+                                           lpcfg_tls_keyfile(ldap_service, task->lp_ctx),
+                                           lpcfg_tls_certfile(ldap_service, task->lp_ctx),
+                                           lpcfg_tls_cafile(ldap_service, task->lp_ctx),
+                                           lpcfg_tls_crlfile(ldap_service, task->lp_ctx),
+                                           lpcfg_tls_dhpfile(ldap_service, task->lp_ctx),
+                                           &ldap_service->tls_params);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("ldapsrv failed tstream_tls_patams_server - %s\n",
+                         nt_errstr(status)));
+                goto failed;
+        }
+
+        ldap_service->call_queue = tevent_queue_create(ldap_service, "ldapsrv_call_queue");
+        if (ldap_service->call_queue == NULL) goto failed;
+
+        if (lpcfg_interfaces(task->lp_ctx) && lpcfg_bind_interfaces_only(task->lp_ctx)) {
                 struct interface *ifaces;
                 int num_interfaces;
                 int i;
 
-                load_interfaces(task, lp_interfaces(task->lp_ctx), &ifaces);
+                load_interfaces(task, lpcfg_interfaces(task->lp_ctx), &ifaces);
                 num_interfaces = iface_count(ifaces);
 
@@ -609 +961 @@
                 for(i = 0; i < num_interfaces; i++) {
                         const char *address = iface_n_ip(ifaces, i);
-                        status = add_socket(task->event_ctx, task->lp_ctx, model_ops, address, ldap_service);
+                        status = add_socket(task, task->lp_ctx, model_ops, address, ldap_service);
                         if (!NT_STATUS_IS_OK(status)) goto failed;
                 }
         } else {
-                status = add_socket(task->event_ctx, task->lp_ctx, model_ops, 
-                                    lp_socket_address(task->lp_ctx), ldap_service);
+                status = add_socket(task, task->lp_ctx, model_ops,
+                                    lpcfg_socket_address(task->lp_ctx), ldap_service);
                 if (!NT_STATUS_IS_OK(status)) goto failed;
         }
@@ -623 +975 @@
         }
 
-        status = stream_setup_socket(task->event_ctx, task->lp_ctx,
+        status = stream_setup_socket(task, task->event_ctx, task->lp_ctx,
                                      model_ops, &ldap_stream_nonpriv_ops,
                                      "unix", ldapi_path, NULL, 
-                                     lp_socket_options(task->lp_ctx), 
+                                     lpcfg_socket_options(task->lp_ctx),
                                      ldap_service);
         talloc_free(ldapi_path);
@@ -654 +1006 @@
         }
 
-        status = stream_setup_socket(task->event_ctx, task->lp_ctx,
+        status = stream_setup_socket(task, task->event_ctx, task->lp_ctx,
                                      model_ops, &ldap_stream_priv_ops,
                                      "unix", ldapi_path, NULL,
-                                     lp_socket_options(task->lp_ctx),
+                                     lpcfg_socket_options(task->lp_ctx),
                                      ldap_service);
         talloc_free(ldapi_path);

vendor/current/source4/ldap_server/ldap_server.h

@@ -19 +19 @@
 */
 
-#include "libcli/ldap/ldap.h"
+#include "libcli/ldap/libcli_ldap.h"
 #include "lib/socket/socket.h"
 #include "lib/stream/packet.h"
+#include "system/network.h"
 
 struct ldapsrv_connection {
@@ -33 +34 @@
 
         struct {
-                struct socket_context *raw;
-                struct socket_context *tls;
-                struct socket_context *sasl;
+                struct tevent_queue *send_queue;
+                struct tstream_context *raw;
+                struct tstream_context *tls;
+                struct tstream_context *sasl;
+                struct tstream_context *active;
         } sockets;
 
         bool global_catalog;
-
-        struct packet_context *packet;
+        bool is_privileged;
 
         struct {
@@ -47 +49 @@
                 int max_page_size;
                 int search_timeout;
-                
-                struct tevent_timer *ite;
-                struct tevent_timer *te;
+                struct timeval endtime;
+                const char *reason;
         } limits;
+
+        struct tevent_req *active_call;
 };
 
@@ -60 +63 @@
                 struct ldap_message *msg;
         } *replies;
-        packet_send_callback_fn_t send_callback;
-        void *send_private;
+        struct iovec out_iov;
+
+        struct tevent_req *(*postprocess_send)(TALLOC_CTX *mem_ctx,
+                                               struct tevent_context *ev,
+                                               void *private_data);
+        NTSTATUS (*postprocess_recv)(struct tevent_req *req);
+        void *postprocess_private;
 };
 
 struct ldapsrv_service {
-        struct tls_params *tls_params;
+        struct tstream_tls_params *tls_params;
         struct task_server *task;
+        struct tevent_queue *call_queue;
 };