Changeset 740 for vendor/current/source4/lib/ldb-samba

Timestamp:

Nov 14, 2012, 12:59:34 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to 3.6.0

Location:

vendor/current/source4/lib/ldb-samba

Files:

• config.mk (deleted)
• ldb_ildap.c (added)
• ldb_wrap.c (added)
• ldb_wrap.h (added)
• ldif_handlers.c (modified) (56 diffs)
• ldif_handlers.h (modified) (2 diffs)
• pyldb.c (added)
• samba_extensions.c (added)
• wscript_build (added)

vendor/current/source4/lib/ldb-samba/ldif_handlers.c

@@ -3 +3 @@
 
    Copyright (C) Andrew Tridgell 2005
-   Copyright (C) Andrew Bartlett 2006-2007
+   Copyright (C) Andrew Bartlett 2006-2009
    Copyright (C) Matthias Dieter Wallnöfer 2009
      ** NOTE! The following LGPL license applies to the ldb
@@ -24 +24 @@
 
 #include "includes.h"
-#include "lib/ldb/include/ldb.h"
-#include "lib/ldb/include/ldb_module.h"
+#include <ldb.h>
+#include <ldb_module.h>
 #include "ldb_handlers.h"
 #include "dsdb/samdb/samdb.h"
@@ -31 +31 @@
 #include "librpc/gen_ndr/ndr_misc.h"
 #include "librpc/gen_ndr/ndr_drsblobs.h"
+#include "librpc/gen_ndr/ndr_dnsp.h"
 #include "librpc/ndr/libndr.h"
 #include "libcli/security/security.h"
 #include "param/param.h"
+#include "../lib/util/asn1.h"
 
 /*
   use ndr_print_* to convert a NDR formatted blob to a ldif formatted blob
+
+  If mask_errors is true, then function succeeds but out data
+  is set to "<Unable to decode binary data>" message
+
+  \return 0 on success; -1 on error
 */
 static int ldif_write_NDR(struct ldb_context *ldb, void *mem_ctx,
@@ -42 +49 @@
                           size_t struct_size,
                           ndr_pull_flags_fn_t pull_fn,
-                          ndr_print_fn_t print_fn)
+                          ndr_print_fn_t print_fn,
+                          bool mask_errors)
 {
         uint8_t *p;
@@ -51 +59 @@
         p = talloc_size(mem_ctx, struct_size);
         err = ndr_pull_struct_blob(in, mem_ctx, 
-                                   lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")), 
                                    p, pull_fn);
         if (err != NDR_ERR_SUCCESS) {
+                /* fail in not in mask_error mode */
+                if (!mask_errors) {
+                        return -1;
+                }
                 talloc_free(p);
                 out->data = (uint8_t *)talloc_strdup(mem_ctx, "<Unable to decode binary data>");
@@ -80 +91 @@
                 return -1;
         }
-        ndr_err = ndr_push_struct_blob(out, mem_ctx, NULL, sid,
+        ndr_err = ndr_push_struct_blob(out, mem_ctx, sid,
                                        (ndr_push_flags_fn_t)ndr_push_dom_sid);
         talloc_free(sid);
@@ -92 +103 @@
   convert a NDR formatted blob to a ldif formatted objectSid
 */
-static int ldif_write_objectSid(struct ldb_context *ldb, void *mem_ctx,
+int ldif_write_objectSid(struct ldb_context *ldb, void *mem_ctx,
                                 const struct ldb_val *in, struct ldb_val *out)
 {
@@ -102 +113 @@
                 return -1;
         }
-        ndr_err = ndr_pull_struct_blob_all(in, sid, NULL, sid,
+        ndr_err = ndr_pull_struct_blob_all(in, sid, sid,
                                            (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -116 +127 @@
 }
 
-static bool ldif_comparision_objectSid_isString(const struct ldb_val *v)
+bool ldif_comparision_objectSid_isString(const struct ldb_val *v)
 {
         if (v->length < 3) {
@@ -199 +210 @@
 
         /* Check it looks like a SID */
-        ndr_err = ndr_pull_struct_blob_all(out, mem_ctx, NULL, &sid,
+        ndr_err = ndr_pull_struct_blob_all(out, mem_ctx, &sid,
                                            (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -215 +226 @@
         struct GUID guid;
         NTSTATUS status;
-        enum ndr_err_code ndr_err;
 
         status = GUID_from_data_blob(in, &guid);
@@ -222 +232 @@
         }
 
-        ndr_err = ndr_push_struct_blob(out, mem_ctx, NULL, &guid,
-                                       (ndr_push_flags_fn_t)ndr_push_GUID);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+        status = GUID_to_ndr_blob(&guid, mem_ctx, out);
+        if (!NT_STATUS_IS_OK(status)) {
                 return -1;
         }
@@ -237 +246 @@
 {
         struct GUID guid;
-        enum ndr_err_code ndr_err;
-        ndr_err = ndr_pull_struct_blob_all(in, mem_ctx, NULL, &guid,
-                                           (ndr_pull_flags_fn_t)ndr_pull_GUID);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+        NTSTATUS status;
+
+        status = GUID_from_ndr_blob(in, &guid);
+        if (!NT_STATUS_IS_OK(status)) {
                 return -1;
         }
@@ -263 +272 @@
 {
         struct GUID guid;
-        enum ndr_err_code ndr_err;
+        NTSTATUS status;
+
         if (in->length == 36 && ldif_read_objectGUID(ldb, mem_ctx, in, out) == 0) {
                 return 0;
@@ -283 +293 @@
         
         /* Check it looks like a GUID */
-        ndr_err = ndr_pull_struct_blob_all(out, mem_ctx, NULL, &guid,
-                                           (ndr_pull_flags_fn_t)ndr_pull_GUID);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+        status = GUID_from_ndr_blob(out, &guid);
+        if (!NT_STATUS_IS_OK(status)) {
+                data_blob_free(out);
                 return -1;
         }
@@ -356 +366 @@
         }
 
-        ndr_err = ndr_pull_struct_blob(in, sd, NULL, sd,
+        ndr_err = ndr_pull_struct_blob(in, sd, sd,
                                        (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 /* If this does not parse, then it is probably SDDL, and we should try it that way */
-                
+
                 const struct dom_sid *sid = samdb_domain_sid(ldb);
                 talloc_free(sd);
@@ -369 +379 @@
         }
 
-        ndr_err = ndr_push_struct_blob(out, mem_ctx, NULL, sd,
+        ndr_err = ndr_push_struct_blob(out, mem_ctx, sd,
                                        (ndr_push_flags_fn_t)ndr_push_security_descriptor);
         talloc_free(sd);
@@ -392 +402 @@
                                       sizeof(struct security_descriptor),
                                       (ndr_pull_flags_fn_t)ndr_pull_security_descriptor,
-                                      (ndr_print_fn_t)ndr_print_security_descriptor);
+                                      (ndr_print_fn_t)ndr_print_security_descriptor,
+                                      true);
                                       
         }
@@ -401 +412 @@
         }
         /* We can't use ndr_pull_struct_blob_all because this contains relative pointers */
-        ndr_err = ndr_pull_struct_blob(in, sd, NULL, sd,
+        ndr_err = ndr_pull_struct_blob(in, sd, sd,
                                            (ndr_pull_flags_fn_t)ndr_pull_security_descriptor);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -407 +418 @@
                 return -1;
         }
-        out->data = (uint8_t *)sddl_encode(mem_ctx, sd, NULL);
+        out->data = (uint8_t *)sddl_encode(mem_ctx, sd, samdb_domain_sid_cache_only(ldb));
         talloc_free(sd);
         if (out->data == NULL) {
@@ -417 +428 @@
 
 /* 
-   canonicalise an objectCategory.  We use the short form as the cannoical form:
+   canonicalise an objectCategory.  We use the short form as the canonical form:
    cn=Person,cn=Schema,cn=Configuration,<basedn> becomes 'person'
 */
@@ -425 +436 @@
 {
         struct ldb_dn *dn1 = NULL;
-        const struct dsdb_schema *schema = dsdb_get_schema(ldb);
+        const struct dsdb_schema *schema = dsdb_get_schema(ldb, NULL);
         const struct dsdb_class *sclass;
         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
@@ -477 +488 @@
                                           const struct ldb_val *v2)
 {
-
-        int ret, ret1, ret2;
-        struct ldb_val v1_canon, v2_canon;
-        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
-
-        /* I could try and bail if tmp_ctx was NULL, but what return
-         * value would I use?
-         *
-         * It seems easier to continue on the NULL context 
-         */
-        ret1 = ldif_canonicalise_objectCategory(ldb, tmp_ctx, v1, &v1_canon);
-        ret2 = ldif_canonicalise_objectCategory(ldb, tmp_ctx, v2, &v2_canon);
-
-        if (ret1 == LDB_SUCCESS && ret2 == LDB_SUCCESS) {
-                ret = data_blob_cmp(&v1_canon, &v2_canon);
-        } else {
-                ret = data_blob_cmp(v1, v2);
-        }
-        talloc_free(tmp_ctx);
-        return ret;
+        return ldb_any_comparison(ldb, mem_ctx, ldif_canonicalise_objectCategory,
+                                  v1, v2);
+}
+
+/*
+  convert a NDR formatted blob to a ldif formatted schemaInfo
+*/
+static int ldif_write_schemaInfo(struct ldb_context *ldb, void *mem_ctx,
+                                 const struct ldb_val *in, struct ldb_val *out)
+{
+        return ldif_write_NDR(ldb, mem_ctx, in, out,
+                              sizeof(struct repsFromToBlob),
+                              (ndr_pull_flags_fn_t)ndr_pull_schemaInfoBlob,
+                              (ndr_print_fn_t)ndr_print_schemaInfoBlob,
+                              true);
 }
 
@@ -508 +514 @@
         enum ndr_err_code ndr_err;
         char *string, *line, *p, *oid;
+        DATA_BLOB oid_blob;
 
         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
@@ -517 +524 @@
         blob = talloc_zero(tmp_ctx, struct prefixMapBlob);
         if (blob == NULL) {
-                talloc_free(blob);
-                return -1;
-        }
-
+                talloc_free(tmp_ctx);
+                return -1;
+        }
+
+        /* use the switch value to detect if this is in the binary
+         * format
+         */
+        if (in->length >= 4 && IVAL(in->data, 0) == PREFIX_MAP_VERSION_DSDB) {
+                ndr_err = ndr_pull_struct_blob(in, tmp_ctx, blob,
+                                               (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob);
+                if (NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                        ndr_err = ndr_push_struct_blob(out, mem_ctx,
+                                                       blob,
+                                                       (ndr_push_flags_fn_t)ndr_push_prefixMapBlob);
+                        talloc_free(tmp_ctx);
+                        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                                return -1;
+                        }
+                        return 0;
+                }
+        }
+
+        /* If this does not parse, then it is probably the text version, and we should try it that way */
         blob->version = PREFIX_MAP_VERSION_DSDB;
         
@@ -540 +566 @@
                         }
                 }
-                /* allow a traling seperator */
+                /* allow a trailing separator */
                 if (line == p) {
                         break;
@@ -564 +590 @@
                 oid++;
 
-                blob->ctr.dsdb.mappings[blob->ctr.dsdb.num_mappings].oid.oid
-                        = talloc_strdup(blob->ctr.dsdb.mappings, oid);
+                if (!ber_write_partial_OID_String(blob->ctr.dsdb.mappings, &oid_blob, oid)) {
+                        talloc_free(tmp_ctx);
+                        return -1;
+                }
+                blob->ctr.dsdb.mappings[blob->ctr.dsdb.num_mappings].oid.length = oid_blob.length;
+                blob->ctr.dsdb.mappings[blob->ctr.dsdb.num_mappings].oid.binary_oid = oid_blob.data;
 
                 blob->ctr.dsdb.num_mappings++;
@@ -578 +608 @@
 
         ndr_err = ndr_push_struct_blob(out, mem_ctx, 
-                                       lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")), 
                                        blob,
                                        (ndr_push_flags_fn_t)ndr_push_prefixMapBlob);
@@ -600 +629 @@
 
         if (ldb_get_flags(ldb) & LDB_FLG_SHOW_BINARY) {
-                return ldif_write_NDR(ldb, mem_ctx, in, out, 
-                                      sizeof(struct prefixMapBlob),
-                                      (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob,
-                                      (ndr_print_fn_t)ndr_print_prefixMapBlob);
-                                      
+                int err;
+                /* try to decode the blob as S4 prefixMap */
+                err = ldif_write_NDR(ldb, mem_ctx, in, out,
+                                     sizeof(struct prefixMapBlob),
+                                     (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob,
+                                     (ndr_print_fn_t)ndr_print_prefixMapBlob,
+                                     false);
+                if (0 == err) {
+                        return err;
+                }
+                /* try parsing it as Windows PrefixMap value */
+                return ldif_write_NDR(ldb, mem_ctx, in, out,
+                                      sizeof(struct drsuapi_MSPrefixMap_Ctr),
+                                      (ndr_pull_flags_fn_t)ndr_pull_drsuapi_MSPrefixMap_Ctr,
+                                      (ndr_print_fn_t)ndr_print_drsuapi_MSPrefixMap_Ctr,
+                                      true);
         }
 
@@ -612 +652 @@
         }
         ndr_err = ndr_pull_struct_blob_all(in, blob, 
-                                           lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")), 
                                            blob,
                                            (ndr_pull_flags_fn_t)ndr_pull_prefixMapBlob);
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                talloc_free(blob);
-                return -1;
+                goto failed;
         }
         if (blob->version != PREFIX_MAP_VERSION_DSDB) {
-                return -1;
+                goto failed;
         }
         string = talloc_strdup(mem_ctx, "");
         if (string == NULL) {
-                return -1;
+                goto failed;
         }
 
         for (i=0; i < blob->ctr.dsdb.num_mappings; i++) {
+                DATA_BLOB oid_blob;
+                char *partial_oid = NULL;
+
                 if (i > 0) {
                         string = talloc_asprintf_append(string, ";"); 
                 }
+
+                oid_blob = data_blob_const(blob->ctr.dsdb.mappings[i].oid.binary_oid,
+                                           blob->ctr.dsdb.mappings[i].oid.length);
+                if (!ber_read_partial_OID_String(blob, oid_blob, &partial_oid)) {
+                        DEBUG(0, ("ber_read_partial_OID failed on prefixMap item with id: 0x%X",
+                                  blob->ctr.dsdb.mappings[i].id_prefix));
+                        goto failed;
+                }
                 string = talloc_asprintf_append(string, "%u:%s", 
                                                    blob->ctr.dsdb.mappings[i].id_prefix,
-                                                   blob->ctr.dsdb.mappings[i].oid.oid);
+                                                   partial_oid);
+                talloc_free(discard_const(partial_oid));
                 if (string == NULL) {
-                        return -1;
+                        goto failed;
                 }
         }
@@ -642 +692 @@
         *out = data_blob_string_const(string);
         return 0;
+
+failed:
+        talloc_free(blob);
+        return -1;
 }
 
@@ -673 +727 @@
                                      const struct ldb_val *v2)
 {
-
-        int ret, ret1, ret2;
-        struct ldb_val v1_canon, v2_canon;
-        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
-
-        /* I could try and bail if tmp_ctx was NULL, but what return
-         * value would I use?
-         *
-         * It seems easier to continue on the NULL context 
-         */
-        ret1 = ldif_canonicalise_prefixMap(ldb, tmp_ctx, v1, &v1_canon);
-        ret2 = ldif_canonicalise_prefixMap(ldb, tmp_ctx, v2, &v2_canon);
-
-        if (ret1 == LDB_SUCCESS && ret2 == LDB_SUCCESS) {
-                ret = data_blob_cmp(&v1_canon, &v2_canon);
-        } else {
-                ret = data_blob_cmp(v1, v2);
-        }
-        talloc_free(tmp_ctx);
-        return ret;
+        return ldb_any_comparison(ldb, mem_ctx, ldif_canonicalise_prefixMap,
+                                  v1, v2);
+}
+
+/* length limited conversion of a ldb_val to a int32_t */
+static int val_to_int32(const struct ldb_val *in, int32_t *v)
+{
+        char *end;
+        char buf[64];
+
+        /* make sure we don't read past the end of the data */
+        if (in->length > sizeof(buf)-1) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+        strncpy(buf, (char *)in->data, in->length);
+        buf[in->length] = 0;
+
+        /* We've to use "strtoll" here to have the intended overflows.
+         * Otherwise we may get "LONG_MAX" and the conversion is wrong. */
+        *v = (int32_t) strtoll(buf, &end, 0);
+        if (*end != 0) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+        return LDB_SUCCESS;
+}
+
+/* length limited conversion of a ldb_val to a int64_t */
+static int val_to_int64(const struct ldb_val *in, int64_t *v)
+{
+        char *end;
+        char buf[64];
+
+        /* make sure we don't read past the end of the data */
+        if (in->length > sizeof(buf)-1) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+        strncpy(buf, (char *)in->data, in->length);
+        buf[in->length] = 0;
+
+        *v = (int64_t) strtoll(buf, &end, 0);
+        if (*end != 0) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+        return LDB_SUCCESS;
 }
 
@@ -699 +777 @@
                         const struct ldb_val *in, struct ldb_val *out)
 {
-        char *end;
-        /* We've to use "strtoll" here to have the intended overflows.
-         * Otherwise we may get "LONG_MAX" and the conversion is wrong. */
-        int32_t i = (int32_t) strtoll((char *)in->data, &end, 0);
-        if (*end != 0) {
-                return -1;
+        int32_t i;
+        int ret;
+
+        ret = val_to_int32(in, &i);
+        if (ret != LDB_SUCCESS) {
+                return ret;
         }
         out->data = (uint8_t *) talloc_asprintf(mem_ctx, "%d", i);
         if (out->data == NULL) {
-                return -1;
+                ldb_oom(ldb);
+                return LDB_ERR_OPERATIONS_ERROR;
         }
         out->length = strlen((char *)out->data);
@@ -716 +795 @@
 /* Comparison of two 32-bit integers */
 static int ldif_comparison_int32(struct ldb_context *ldb, void *mem_ctx,
-                        const struct ldb_val *v1, const struct ldb_val *v2)
-{
-        /* We've to use "strtoll" here to have the intended overflows.
-         * Otherwise we may get "LONG_MAX" and the conversion is wrong. */
-        return (int32_t) strtoll((char *)v1->data, NULL, 0)
-         - (int32_t) strtoll((char *)v2->data, NULL, 0);
+                                 const struct ldb_val *v1, const struct ldb_val *v2)
+{
+        int32_t i1=0, i2=0;
+        val_to_int32(v1, &i1);
+        val_to_int32(v2, &i2);
+        if (i1 == i2) return 0;
+        return i1 > i2? 1 : -1;
+}
+
+/* Canonicalisation of two 64-bit integers */
+static int ldif_canonicalise_int64(struct ldb_context *ldb, void *mem_ctx,
+                                   const struct ldb_val *in, struct ldb_val *out)
+{
+        int64_t i;
+        int ret;
+
+        ret = val_to_int64(in, &i);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        out->data = (uint8_t *) talloc_asprintf(mem_ctx, "%lld", (long long)i);
+        if (out->data == NULL) {
+                ldb_oom(ldb);
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+        out->length = strlen((char *)out->data);
+        return 0;
+}
+
+/* Comparison of two 64-bit integers */
+static int ldif_comparison_int64(struct ldb_context *ldb, void *mem_ctx,
+                                 const struct ldb_val *v1, const struct ldb_val *v2)
+{
+        int64_t i1=0, i2=0;
+        val_to_int64(v1, &i1);
+        val_to_int64(v2, &i2);
+        if (i1 == i2) return 0;
+        return i1 > i2? 1 : -1;
 }
 
@@ -733 +844 @@
                               sizeof(struct repsFromToBlob),
                               (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob,
-                              (ndr_print_fn_t)ndr_print_repsFromToBlob);
+                              (ndr_print_fn_t)ndr_print_repsFromToBlob,
+                              true);
 }
 
@@ -745 +857 @@
                               sizeof(struct replPropertyMetaDataBlob),
                               (ndr_pull_flags_fn_t)ndr_pull_replPropertyMetaDataBlob,
-                              (ndr_print_fn_t)ndr_print_replPropertyMetaDataBlob);
+                              (ndr_print_fn_t)ndr_print_replPropertyMetaDataBlob,
+                              true);
 }
 
@@ -757 +870 @@
                               sizeof(struct replUpToDateVectorBlob),
                               (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob,
-                              (ndr_print_fn_t)ndr_print_replPropertyMetaDataBlob);
+                              (ndr_print_fn_t)ndr_print_replUpToDateVectorBlob,
+                              true);
+}
+
+
+/*
+  convert a NDR formatted blob to a ldif formatted dnsRecord
+*/
+static int ldif_write_dnsRecord(struct ldb_context *ldb, void *mem_ctx,
+                                const struct ldb_val *in, struct ldb_val *out)
+{
+        return ldif_write_NDR(ldb, mem_ctx, in, out,
+                              sizeof(struct dnsp_DnssrvRpcRecord),
+                              (ndr_pull_flags_fn_t)ndr_pull_dnsp_DnssrvRpcRecord,
+                              (ndr_print_fn_t)ndr_print_dnsp_DnssrvRpcRecord,
+                              true);
+}
+
+/*
+  convert a NDR formatted blob of a supplementalCredentials into text
+*/
+static int ldif_write_supplementalCredentialsBlob(struct ldb_context *ldb, void *mem_ctx,
+                                                  const struct ldb_val *in, struct ldb_val *out)
+{
+        return ldif_write_NDR(ldb, mem_ctx, in, out,
+                              sizeof(struct supplementalCredentialsBlob),
+                              (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob,
+                              (ndr_print_fn_t)ndr_print_supplementalCredentialsBlob,
+                              true);
 }
 
@@ -764 +905 @@
                                  const struct ldb_val *in, struct ldb_val *out)
 {
-        *out = data_blob_string_const(data_blob_hex_string(mem_ctx, in));
+        *out = data_blob_string_const(data_blob_hex_string_lower(mem_ctx, in));
         if (!out->data) {
                 return -1;
@@ -770 +911 @@
         return 0;
 }
+
+/*
+  compare two dns
+*/
+static int samba_ldb_dn_link_comparison(struct ldb_context *ldb, void *mem_ctx,
+                                        const struct ldb_val *v1, const struct ldb_val *v2)
+{
+        struct ldb_dn *dn1 = NULL, *dn2 = NULL;
+        int ret;
+
+        if (dsdb_dn_is_deleted_val(v1)) {
+                /* If the DN is deleted, then we can't search for it */
+                return -1;
+        }
+
+        if (dsdb_dn_is_deleted_val(v2)) {
+                /* If the DN is deleted, then we can't search for it */
+                return -1;
+        }
+
+        dn1 = ldb_dn_from_ldb_val(mem_ctx, ldb, v1);
+        if ( ! ldb_dn_validate(dn1)) return -1;
+
+        dn2 = ldb_dn_from_ldb_val(mem_ctx, ldb, v2);
+        if ( ! ldb_dn_validate(dn2)) {
+                talloc_free(dn1);
+                return -1;
+        }
+
+        ret = ldb_dn_compare(dn1, dn2);
+
+        talloc_free(dn1);
+        talloc_free(dn2);
+        return ret;
+}
+
+static int samba_ldb_dn_link_canonicalise(struct ldb_context *ldb, void *mem_ctx,
+                                          const struct ldb_val *in, struct ldb_val *out)
+{
+        struct ldb_dn *dn;
+        int ret = -1;
+
+        out->length = 0;
+        out->data = NULL;
+
+        dn = ldb_dn_from_ldb_val(mem_ctx, ldb, in);
+        if ( ! ldb_dn_validate(dn)) {
+                return LDB_ERR_INVALID_DN_SYNTAX;
+        }
+
+        /* By including the RMD_FLAGS of a deleted DN, we ensure it
+         * does not casually match a not deleted DN */
+        if (dsdb_dn_is_deleted_val(in)) {
+                out->data = (uint8_t *)talloc_asprintf(mem_ctx,
+                                                       "<RMD_FLAGS=%u>%s",
+                                                       dsdb_dn_val_rmd_flags(in),
+                                                       ldb_dn_get_casefold(dn));
+        } else {
+                out->data = (uint8_t *)ldb_dn_alloc_casefold(mem_ctx, dn);
+        }
+
+        if (out->data == NULL) {
+                goto done;
+        }
+        out->length = strlen((char *)out->data);
+
+        ret = 0;
+
+done:
+        talloc_free(dn);
+
+        return ret;
+}
+
+
+/*
+  write a 64 bit 2-part range
+*/
+static int ldif_write_range64(struct ldb_context *ldb, void *mem_ctx,
+                              const struct ldb_val *in, struct ldb_val *out)
+{
+        int64_t v;
+        int ret;
+        ret = val_to_int64(in, &v);
+        if (ret != LDB_SUCCESS) {
+                return ret;
+        }
+        out->data = (uint8_t *)talloc_asprintf(mem_ctx, "%lu-%lu",
+                                               (unsigned long)(v&0xFFFFFFFF),
+                                               (unsigned long)(v>>32));
+        if (out->data == NULL) {
+                ldb_oom(ldb);
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+        out->length = strlen((char *)out->data);
+        return LDB_SUCCESS;
+}
+
+/*
+  read a 64 bit 2-part range
+*/
+static int ldif_read_range64(struct ldb_context *ldb, void *mem_ctx,
+                              const struct ldb_val *in, struct ldb_val *out)
+{
+        unsigned long high, low;
+        char buf[64];
+
+        if (memchr(in->data, '-', in->length) == NULL) {
+                return ldb_handler_copy(ldb, mem_ctx, in, out);
+        }
+
+        if (in->length > sizeof(buf)-1) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+        strncpy(buf, (const char *)in->data, in->length);
+        buf[in->length] = 0;
+
+        if (sscanf(buf, "%lu-%lu", &low, &high) != 2) {
+                return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
+        }
+
+        out->data = (uint8_t *)talloc_asprintf(mem_ctx, "%llu",
+                                               (unsigned long long)(((uint64_t)high)<<32) | (low));
+
+        if (out->data == NULL) {
+                ldb_oom(ldb);
+                return LDB_ERR_OPERATIONS_ERROR;
+        }
+        out->length = strlen((char *)out->data);
+        return LDB_SUCCESS;
+}
+
+/*
+  when this operator_fn is set for a syntax, the backend calls is in
+  preference to the comparison function. We are told the exact
+  comparison operation that is needed, and we can return errors
+ */
+static int samba_syntax_operator_fn(struct ldb_context *ldb, enum ldb_parse_op operation,
+                                    const struct ldb_schema_attribute *a,
+                                    const struct ldb_val *v1, const struct ldb_val *v2, bool *matched)
+{
+        switch (operation) {
+        case LDB_OP_AND:
+        case LDB_OP_OR:
+        case LDB_OP_NOT:
+        case LDB_OP_SUBSTRING:
+        case LDB_OP_APPROX:
+        case LDB_OP_EXTENDED:
+                /* handled in the backends */
+                return LDB_ERR_INAPPROPRIATE_MATCHING;
+
+        case LDB_OP_GREATER:
+        case LDB_OP_LESS:
+        case LDB_OP_EQUALITY:
+        {
+                TALLOC_CTX *tmp_ctx = talloc_new(ldb);
+                int ret;
+                if (tmp_ctx == NULL) {
+                        return ldb_oom(ldb);
+                }
+                ret = a->syntax->comparison_fn(ldb, tmp_ctx, v1, v2);
+                talloc_free(tmp_ctx);
+                if (operation == LDB_OP_GREATER) {
+                        *matched = (ret > 0);
+                } else if (operation == LDB_OP_LESS) {
+                        *matched = (ret < 0);
+                } else {
+                        *matched = (ret == 0);
+                }
+                return LDB_SUCCESS;
+        }
+
+        case LDB_OP_PRESENT:
+                *matched = true;
+                return LDB_SUCCESS;
+        }
+
+        /* we shouldn't get here */
+        return LDB_ERR_INAPPROPRIATE_MATCHING;
+}
+
+/*
+  special operation for DNs, to take account of the RMD_FLAGS deleted bit
+ */
+static int samba_syntax_operator_dn(struct ldb_context *ldb, enum ldb_parse_op operation,
+                                    const struct ldb_schema_attribute *a,
+                                    const struct ldb_val *v1, const struct ldb_val *v2, bool *matched)
+{
+        if (operation == LDB_OP_PRESENT && dsdb_dn_is_deleted_val(v1)) {
+                /* If the DN is deleted, then we can't search for it */
+                *matched = false;
+                return LDB_SUCCESS;
+        }
+        return samba_syntax_operator_fn(ldb, operation, a, v1, v2, matched);
+}
+
 
 static const struct ldb_schema_syntax samba_syntaxes[] = {
@@ -777 +1114 @@
                 .ldif_write_fn    = ldif_write_objectSid,
                 .canonicalise_fn  = ldif_canonicalise_objectSid,
-                .comparison_fn    = ldif_comparison_objectSid
+                .comparison_fn    = ldif_comparison_objectSid,
+                .operator_fn      = samba_syntax_operator_fn
         },{
                 .name             = LDB_SYNTAX_SAMBA_SECURITY_DESCRIPTOR,
@@ -783 +1121 @@
                 .ldif_write_fn    = ldif_write_ntSecurityDescriptor,
                 .canonicalise_fn  = ldb_handler_copy,
-                .comparison_fn    = ldb_comparison_binary
+                .comparison_fn    = ldb_comparison_binary,
+                .operator_fn      = samba_syntax_operator_fn
         },{
                 .name             = LDB_SYNTAX_SAMBA_GUID,
@@ -789 +1128 @@
                 .ldif_write_fn    = ldif_write_objectGUID,
                 .canonicalise_fn  = ldif_canonicalise_objectGUID,
-                .comparison_fn    = ldif_comparison_objectGUID
+                .comparison_fn    = ldif_comparison_objectGUID,
+                .operator_fn      = samba_syntax_operator_fn
         },{
                 .name             = LDB_SYNTAX_SAMBA_OBJECT_CATEGORY,
@@ -795 +1135 @@
                 .ldif_write_fn    = ldb_handler_copy,
                 .canonicalise_fn  = ldif_canonicalise_objectCategory,
-                .comparison_fn    = ldif_comparison_objectCategory
+                .comparison_fn    = ldif_comparison_objectCategory,
+                .operator_fn      = samba_syntax_operator_fn
+        },{
+                .name             = LDB_SYNTAX_SAMBA_SCHEMAINFO,
+                .ldif_read_fn     = ldb_handler_copy,
+                .ldif_write_fn    = ldif_write_schemaInfo,
+                .canonicalise_fn  = ldb_handler_copy,
+                .comparison_fn    = ldb_comparison_binary,
+                .operator_fn      = samba_syntax_operator_fn
         },{
                 .name             = LDB_SYNTAX_SAMBA_PREFIX_MAP,
@@ -801 +1149 @@
                 .ldif_write_fn    = ldif_write_prefixMap,
                 .canonicalise_fn  = ldif_canonicalise_prefixMap,
-                .comparison_fn    = ldif_comparison_prefixMap
+                .comparison_fn    = ldif_comparison_prefixMap,
+                .operator_fn      = samba_syntax_operator_fn
         },{
                 .name             = LDB_SYNTAX_SAMBA_INT32,
@@ -807 +1156 @@
                 .ldif_write_fn    = ldb_handler_copy,
                 .canonicalise_fn  = ldif_canonicalise_int32,
-                .comparison_fn    = ldif_comparison_int32
+                .comparison_fn    = ldif_comparison_int32,
+                .operator_fn      = samba_syntax_operator_fn
         },{
                 .name             = LDB_SYNTAX_SAMBA_REPSFROMTO,
@@ -813 +1163 @@
                 .ldif_write_fn    = ldif_write_repsFromTo,
                 .canonicalise_fn  = ldb_handler_copy,
-                .comparison_fn    = ldb_comparison_binary
+                .comparison_fn    = ldb_comparison_binary,
+                .operator_fn      = samba_syntax_operator_fn
         },{
                 .name             = LDB_SYNTAX_SAMBA_REPLPROPERTYMETADATA,
@@ -819 +1170 @@
                 .ldif_write_fn    = ldif_write_replPropertyMetaData,
                 .canonicalise_fn  = ldb_handler_copy,
-                .comparison_fn    = ldb_comparison_binary
+                .comparison_fn    = ldb_comparison_binary,
+                .operator_fn      = samba_syntax_operator_fn
         },{
                 .name             = LDB_SYNTAX_SAMBA_REPLUPTODATEVECTOR,
@@ -825 +1177 @@
                 .ldif_write_fn    = ldif_write_replUpToDateVector,
                 .canonicalise_fn  = ldb_handler_copy,
-                .comparison_fn    = ldb_comparison_binary
-        },
+                .comparison_fn    = ldb_comparison_binary,
+                .operator_fn      = samba_syntax_operator_fn
+        },{
+                .name             = DSDB_SYNTAX_BINARY_DN,
+                .ldif_read_fn     = ldb_handler_copy,
+                .ldif_write_fn    = ldb_handler_copy,
+                .canonicalise_fn  = dsdb_dn_binary_canonicalise,
+                .comparison_fn    = dsdb_dn_binary_comparison,
+                .operator_fn      = samba_syntax_operator_fn
+        },{
+                .name             = DSDB_SYNTAX_STRING_DN,
+                .ldif_read_fn     = ldb_handler_copy,
+                .ldif_write_fn    = ldb_handler_copy,
+                .canonicalise_fn  = dsdb_dn_string_canonicalise,
+                .comparison_fn    = dsdb_dn_string_comparison,
+                .operator_fn      = samba_syntax_operator_fn
+        },{
+                .name             = LDB_SYNTAX_DN,
+                .ldif_read_fn     = ldb_handler_copy,
+                .ldif_write_fn    = ldb_handler_copy,
+                .canonicalise_fn  = samba_ldb_dn_link_canonicalise,
+                .comparison_fn    = samba_ldb_dn_link_comparison,
+                .operator_fn      = samba_syntax_operator_dn
+        },{
+                .name             = LDB_SYNTAX_SAMBA_RANGE64,
+                .ldif_read_fn     = ldif_read_range64,
+                .ldif_write_fn    = ldif_write_range64,
+                .canonicalise_fn  = ldif_canonicalise_int64,
+                .comparison_fn    = ldif_comparison_int64,
+                .operator_fn      = samba_syntax_operator_fn
+        },{
+                .name             = LDB_SYNTAX_SAMBA_DNSRECORD,
+                .ldif_read_fn     = ldb_handler_copy,
+                .ldif_write_fn    = ldif_write_dnsRecord,
+                .canonicalise_fn  = ldb_handler_copy,
+                .comparison_fn    = ldb_comparison_binary,
+                .operator_fn      = samba_syntax_operator_fn
+        },{
+                .name             = LDB_SYNTAX_SAMBA_SUPPLEMENTALCREDENTIALS,
+                .ldif_read_fn     = ldb_handler_copy,
+                .ldif_write_fn    = ldif_write_supplementalCredentialsBlob,
+                .canonicalise_fn  = ldb_handler_copy,
+                .comparison_fn    = ldb_comparison_binary,
+                .operator_fn      = samba_syntax_operator_fn
+        }
 };
 
@@ -842 +1237 @@
         },{
                 .name             = "WKGUID",
+                .read_fn          = ldb_handler_copy,
+                .write_clear_fn   = ldb_handler_copy,
+                .write_hex_fn     = ldb_handler_copy
+        },{
+                .name             = "RMD_INVOCID",
+                .read_fn          = extended_dn_read_GUID,
+                .write_clear_fn   = ldif_write_objectGUID,
+                .write_hex_fn     = extended_dn_write_hex
+        },{
+                .name             = "RMD_FLAGS",
+                .read_fn          = ldb_handler_copy,
+                .write_clear_fn   = ldb_handler_copy,
+                .write_hex_fn     = ldb_handler_copy
+        },{
+                .name             = "RMD_ADDTIME",
+                .read_fn          = ldb_handler_copy,
+                .write_clear_fn   = ldb_handler_copy,
+                .write_hex_fn     = ldb_handler_copy
+        },{
+                .name             = "RMD_CHANGETIME",
+                .read_fn          = ldb_handler_copy,
+                .write_clear_fn   = ldb_handler_copy,
+                .write_hex_fn     = ldb_handler_copy
+        },{
+                .name             = "RMD_LOCAL_USN",
+                .read_fn          = ldb_handler_copy,
+                .write_clear_fn   = ldb_handler_copy,
+                .write_hex_fn     = ldb_handler_copy
+        },{
+                .name             = "RMD_ORIGINATING_USN",
+                .read_fn          = ldb_handler_copy,
+                .write_clear_fn   = ldb_handler_copy,
+                .write_hex_fn     = ldb_handler_copy
+        },{
+                .name             = "RMD_VERSION",
                 .read_fn          = ldb_handler_copy,
                 .write_clear_fn   = ldb_handler_copy,
@@ -855 +1285 @@
         { "objectSid",                  LDB_SYNTAX_SAMBA_SID },
         { "securityIdentifier",         LDB_SYNTAX_SAMBA_SID },
+        { "tokenGroups",                LDB_SYNTAX_SAMBA_SID },
         { "ntSecurityDescriptor",       LDB_SYNTAX_SAMBA_SECURITY_DESCRIPTOR },
-        { "objectGUID",                 LDB_SYNTAX_SAMBA_GUID },
-        { "invocationId",               LDB_SYNTAX_SAMBA_GUID },
-        { "schemaIDGUID",               LDB_SYNTAX_SAMBA_GUID },
-        { "attributeSecurityGUID",      LDB_SYNTAX_SAMBA_GUID },
-        { "parentGUID",                 LDB_SYNTAX_SAMBA_GUID },
-        { "siteGUID",                   LDB_SYNTAX_SAMBA_GUID },
-        { "pKTGUID",                    LDB_SYNTAX_SAMBA_GUID },
-        { "fRSVersionGUID",             LDB_SYNTAX_SAMBA_GUID },
-        { "fRSReplicaSetGUID",          LDB_SYNTAX_SAMBA_GUID },
-        { "netbootGUID",                LDB_SYNTAX_SAMBA_GUID },
+        { "oMSyntax",                   LDB_SYNTAX_SAMBA_INT32 },
         { "objectCategory",             LDB_SYNTAX_SAMBA_OBJECT_CATEGORY },
+        { "schemaInfo",                 LDB_SYNTAX_SAMBA_SCHEMAINFO },
         { "prefixMap",                  LDB_SYNTAX_SAMBA_PREFIX_MAP },
         { "repsFrom",                   LDB_SYNTAX_SAMBA_REPSFROMTO },
@@ -872 +1295 @@
         { "replPropertyMetaData",       LDB_SYNTAX_SAMBA_REPLPROPERTYMETADATA },
         { "replUpToDateVector",         LDB_SYNTAX_SAMBA_REPLUPTODATEVECTOR },
+        { "rIDAllocationPool",          LDB_SYNTAX_SAMBA_RANGE64 },
+        { "rIDPreviousAllocationPool",  LDB_SYNTAX_SAMBA_RANGE64 },
+        { "rIDAvailablePool",           LDB_SYNTAX_SAMBA_RANGE64 },
+
+        /*
+         * these are extracted by searching
+         * (&(attributeSyntax=2.5.5.10)(rangeLower=16)(rangeUpper=16)(omSyntax=4))
+         */
+        { "attributeSecurityGUID",              LDB_SYNTAX_SAMBA_GUID },
+        { "categoryId",                         LDB_SYNTAX_SAMBA_GUID },
+        { "controlAccessRights",                LDB_SYNTAX_SAMBA_GUID },
+        { "currMachineId",                      LDB_SYNTAX_SAMBA_GUID },
+        { "fRSReplicaSetGUID",                  LDB_SYNTAX_SAMBA_GUID },
+        { "fRSVersionGUID",                     LDB_SYNTAX_SAMBA_GUID },
+        { "implementedCategories",              LDB_SYNTAX_SAMBA_GUID },
+        { "msDS-AzObjectGuid",                  LDB_SYNTAX_SAMBA_GUID },
+        { "msDFSR-ContentSetGuid",              LDB_SYNTAX_SAMBA_GUID },
+        { "msDFSR-ReplicationGroupGuid",        LDB_SYNTAX_SAMBA_GUID },
+        { "mSMQDigests",                        LDB_SYNTAX_SAMBA_GUID },
+        { "mSMQOwnerID",                        LDB_SYNTAX_SAMBA_GUID },
+        { "mSMQQMID",                           LDB_SYNTAX_SAMBA_GUID },
+        { "mSMQQueueType",                      LDB_SYNTAX_SAMBA_GUID },
+        { "mSMQSites",                          LDB_SYNTAX_SAMBA_GUID },
+        { "netbootGUID",                        LDB_SYNTAX_SAMBA_GUID },
+        { "objectGUID",                         LDB_SYNTAX_SAMBA_GUID },
+        { "pKTGuid",                            LDB_SYNTAX_SAMBA_GUID },
+        { "requiredCategories",                 LDB_SYNTAX_SAMBA_GUID },
+        { "schemaIDGUID",                       LDB_SYNTAX_SAMBA_GUID },
+        { "siteGUID",                           LDB_SYNTAX_SAMBA_GUID },
+        { "msDFS-GenerationGUIDv2",             LDB_SYNTAX_SAMBA_GUID },
+        { "msDFS-LinkIdentityGUIDv2",           LDB_SYNTAX_SAMBA_GUID },
+        { "msDFS-NamespaceIdentityGUIDv2",      LDB_SYNTAX_SAMBA_GUID },
+
+        /*
+         * these are known to be GUIDs
+         */
+        { "invocationId",                       LDB_SYNTAX_SAMBA_GUID },
+        { "parentGUID",                         LDB_SYNTAX_SAMBA_GUID },
+        { "msDS-OptionalFeatureGUID",           LDB_SYNTAX_SAMBA_GUID },
+
+        /* These NDR encoded things we want to be able to read with --show-binary */
+        { "dnsRecord",                          LDB_SYNTAX_SAMBA_DNSRECORD },
+        { "supplementalCredentials",            LDB_SYNTAX_SAMBA_SUPPLEMENTALCREDENTIALS}
 };
 
 const struct ldb_schema_syntax *ldb_samba_syntax_by_name(struct ldb_context *ldb, const char *name)
 {
-        uint32_t j;
+        unsigned int j;
         const struct ldb_schema_syntax *s = NULL;
         
@@ -890 +1356 @@
 const struct ldb_schema_syntax *ldb_samba_syntax_by_lDAPDisplayName(struct ldb_context *ldb, const char *name)
 {
-        uint32_t j;
+        unsigned int j;
         const struct ldb_schema_syntax *s = NULL;
 
@@ -908 +1374 @@
 int ldb_register_samba_handlers(struct ldb_context *ldb)
 {
-        uint32_t i;
+        unsigned int i;
+        int ret;
+
+        if (ldb_get_opaque(ldb, "SAMBA_HANDLERS_REGISTERED") != NULL) {
+                return LDB_SUCCESS;
+        }
 
         for (i=0; i < ARRAY_SIZE(samba_attributes); i++) {
-                int ret;
                 const struct ldb_schema_syntax *s = NULL;
 
@@ -921 +1391 @@
 
                 if (!s) {
-                        return -1;
+                        return LDB_ERR_OPERATIONS_ERROR;
                 }
 
@@ -931 +1401 @@
 
         for (i=0; i < ARRAY_SIZE(samba_dn_syntax); i++) {
-                int ret;
                 ret = ldb_dn_extended_add_syntax(ldb, LDB_ATTR_FLAG_FIXED, &samba_dn_syntax[i]);
                 if (ret != LDB_SUCCESS) {
@@ -937 +1406 @@
                 }
 
-                
+        }
+
+        ret = ldb_set_opaque(ldb, "SAMBA_HANDLERS_REGISTERED", (void*)1);
+        if (ret != LDB_SUCCESS) {
+                return ret;
         }
 

vendor/current/source4/lib/ldb-samba/ldif_handlers.h

@@ -6 +6 @@
 #define LDB_SYNTAX_SAMBA_GUID                   "LDB_SYNTAX_SAMBA_GUID"
 #define LDB_SYNTAX_SAMBA_OBJECT_CATEGORY        "LDB_SYNTAX_SAMBA_OBJECT_CATEGORY"
+#define LDB_SYNTAX_SAMBA_SCHEMAINFO             "LDB_SYNTAX_SAMBA_SCHEMAINFO"
 #define LDB_SYNTAX_SAMBA_PREFIX_MAP             "LDB_SYNTAX_SAMBA_PREFIX_MAP"
 #define LDB_SYNTAX_SAMBA_INT32                  "LDB_SYNTAX_SAMBA_INT32"
@@ -11 +12 @@
 #define LDB_SYNTAX_SAMBA_REPLPROPERTYMETADATA   "LDB_SYNTAX_SAMBA_REPLPROPERTYMETADATA"
 #define LDB_SYNTAX_SAMBA_REPLUPTODATEVECTOR     "LDB_SYNTAX_SAMBA_REPLUPTODATEVECTOR"
-
+#define LDB_SYNTAX_SAMBA_RANGE64                "LDB_SYNTAX_SAMBA_RANGE64"
+#define LDB_SYNTAX_SAMBA_DNSRECORD              "LDB_SYNTAX_SAMBA_DNSRECORD"
+#define LDB_SYNTAX_SAMBA_SUPPLEMENTALCREDENTIALS "LDB_SYNTAX_SAMBA_SUPPLEMENTALCREDENTIALS"
 #include "lib/ldb-samba/ldif_handlers_proto.h"