Changeset 988 for vendor/current/source4/ldap_server

Timestamp:

Nov 24, 2016, 1:14:11 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.3

Location:

vendor/current/source4/ldap_server

Files:

• devdocs/draft-armijo-ldap-syntax-00.txt (added)
• devdocs/ldapext-ldapv3-vlv-04.txt (added)
• devdocs/rfc2307.txt (added)
• devdocs/rfc2696.txt (added)
• devdocs/rfc2849.txt (added)
• devdocs/rfc2891.txt (added)
• devdocs/rfc3296.txt (added)
• devdocs/rfc4510.txt (added)
• devdocs/rfc4511.txt (added)
• devdocs/rfc4512.txt (added)
• devdocs/rfc4513.txt (added)
• devdocs/rfc4514.txt (added)
• devdocs/rfc4515.txt (added)
• devdocs/rfc4516.txt (added)
• devdocs/rfc4517.txt (added)
• devdocs/rfc4518.txt (added)
• devdocs/rfc4519.txt (added)
• devdocs/rfc4520.txt (added)
• devdocs/rfc4521.txt (added)
• devdocs/rfc4522.txt (added)
• devdocs/rfc4523.txt (added)
• devdocs/rfc4524.txt (added)
• devdocs/rfc4525.txt (added)
• devdocs/rfc4526.txt (added)
• devdocs/rfc4527.txt (added)
• devdocs/rfc4528.txt (added)
• devdocs/rfc4529.txt (added)
• devdocs/rfc4530.txt (added)
• devdocs/rfc4531.txt (added)
• devdocs/rfc4532.txt (added)
• devdocs/rfc4533.txt (added)
• ldap_backend.c (modified) (18 diffs)
• ldap_bind.c (modified) (10 diffs)
• ldap_extended.c (modified) (2 diffs)
• ldap_server.c (modified) (17 diffs)
• ldap_server.h (modified) (2 diffs)
• wscript_build (modified) (1 diff)

vendor/current/source4/ldap_server/ldap_backend.c

@@ -24 +24 @@
 #include "auth/credentials/credentials.h"
 #include "auth/gensec/gensec.h"
+#include "auth/gensec/gensec_internal.h" /* TODO: remove this */
 #include "param/param.h"
 #include "smbd/service_stream.h"
@@ -170 +171 @@
 
         *errstring = talloc_asprintf(mem_ctx, "%08X: %s", W_ERROR_V(err),
-                ldb_strerror(ldb_err));
-        if (add_err_string != NULL) {
-                *errstring = talloc_asprintf(mem_ctx, "%s - %s", *errstring,
-                                             add_err_string);
-        }
-        
+                add_err_string != NULL ? add_err_string : ldb_strerror(ldb_err));
+
         /* result is 1:1 for now */
         return ldb_err;
@@ -196 +193 @@
         if (conn->server_credentials) {
                 char **sasl_mechs = NULL;
-                struct gensec_security_ops **backends = gensec_security_all();
-                struct gensec_security_ops **ops
+                const struct gensec_security_ops * const *backends = gensec_security_all();
+                const struct gensec_security_ops **ops
                         = gensec_use_kerberos_mechs(conn, backends, conn->server_credentials);
                 unsigned int i, j = 0;
@@ -230 +227 @@
         }
 
+        ldb_set_opaque(conn->ldb, "remoteAddress",
+                       conn->connection->remote_address);
+
         return NT_STATUS_OK;
 }
@@ -256 +256 @@
 void ldapsrv_queue_reply(struct ldapsrv_call *call, struct ldapsrv_reply *reply)
 {
-        DLIST_ADD_END(call->replies, reply, struct ldapsrv_reply *);
+        DLIST_ADD_END(call->replies, reply);
 }
 
@@ -286 +286 @@
                                      const struct ldb_message *message,
                                      struct ldb_control **controls,
-                                     void *context)
+                                     struct ldb_result *res)
 {
         struct ldb_context *ldb = call->conn->ldb;
@@ -300 +300 @@
                                         message,
                                         controls,
-                                        context,
+                                        res,
                                         ldb_modify_default_callback,
                                         NULL);
 
         if (ret != LDB_SUCCESS) return ret;
+
+        if (call->conn->global_catalog) {
+                return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM, "modify forbidden on global catalog port");
+        }
+        ldb_request_add_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
 
         ret = ldb_transaction_start(ldb);
@@ -337 +342 @@
                                      const struct ldb_message *message,
                                      struct ldb_control **controls,
-                                     void *context)
+                                     struct ldb_result *res)
 {
         struct ldb_context *ldb = call->conn->ldb;
@@ -351 +356 @@
                                         message,
                                         controls,
-                                        context,
+                                        res,
                                         ldb_modify_default_callback,
                                         NULL);
@@ -358 +363 @@
                 return ret;
         }
+
+        if (call->conn->global_catalog) {
+                return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM, "modify forbidden on global catalog port");
+        }
+        ldb_request_add_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
 
         ret = ldb_transaction_start(ldb);
@@ -390 +400 @@
                                      struct ldb_dn *dn,
                                      struct ldb_control **controls,
-                                     void *context)
+                                     struct ldb_result *res)
 {
         struct ldb_context *ldb = call->conn->ldb;
@@ -399 +409 @@
                                         dn,
                                         controls,
-                                        context,
+                                        res,
                                         ldb_modify_default_callback,
                                         NULL);
 
         if (ret != LDB_SUCCESS) return ret;
+
+        if (call->conn->global_catalog) {
+                return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM, "modify forbidden on global catalog port");
+        }
+        ldb_request_add_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
 
         ret = ldb_transaction_start(ldb);
@@ -436 +451 @@
                                         struct ldb_dn *newdn,
                                         struct ldb_control **controls,
-                                        void *context)
+                                        struct ldb_result *res)
 {
         struct ldb_context *ldb = call->conn->ldb;
@@ -445 +460 @@
                                         olddn,
                                         newdn,
-                                        NULL,
-                                        context,
+                                        controls,
+                                        res,
                                         ldb_modify_default_callback,
                                         NULL);
 
         if (ret != LDB_SUCCESS) return ret;
+
+        if (call->conn->global_catalog) {
+                return ldb_error(ldb, LDB_ERR_UNWILLING_TO_PERFORM, "modify forbidden on global catalog port");
+        }
+        ldb_request_add_control(req, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
 
         ret = ldb_transaction_start(ldb);
@@ -583 +603 @@
                         ldb_request_add_control(lreq, LDB_CONTROL_SEARCH_OPTIONS_OID, false, search_options);
                 }
+        } else {
+                ldb_request_add_control(lreq, DSDB_CONTROL_NO_GLOBAL_CATALOG, false, NULL);
         }
 
@@ -1145 +1167 @@
         unsigned int i;
         struct ldap_message *msg = call->request;
+        struct ldb_context *samdb = call->conn->ldb;
+        NTSTATUS status;
+        time_t *lastts;
         /* Check for undecoded critical extensions */
         for (i=0; msg->controls && msg->controls[i]; i++) {
@@ -1163 +1188 @@
                 return ldapsrv_SearchRequest(call);
         case LDAP_TAG_ModifyRequest:
-                return ldapsrv_ModifyRequest(call);
+                status = ldapsrv_ModifyRequest(call);
+                break;
         case LDAP_TAG_AddRequest:
-                return ldapsrv_AddRequest(call);
+                status = ldapsrv_AddRequest(call);
+                break;
         case LDAP_TAG_DelRequest:
                 return ldapsrv_DelRequest(call);
@@ -1179 +1206 @@
                 return ldapsrv_unwilling(call, LDAP_PROTOCOL_ERROR);
         }
-}
+
+        if (NT_STATUS_IS_OK(status)) {
+                lastts = (time_t *)ldb_get_opaque(samdb, DSDB_OPAQUE_LAST_SCHEMA_UPDATE_MSG_OPAQUE_NAME);
+                if (lastts && !*lastts) {
+                        DEBUG(10, ("Schema update now was requested, "
+                                "fullfilling the request ts = %d\n",
+                                (int)*lastts));
+                        /*
+                        * Just requesting the schema will do the trick
+                        * as the delay for reload is experied, we will have a reload
+                        * from the schema as expected as we are not yet in a transaction!
+                        */
+                        dsdb_get_schema(samdb, NULL);
+                        *lastts = time(NULL);
+                        ldb_set_opaque(samdb, DSDB_OPAQUE_LAST_SCHEMA_UPDATE_MSG_OPAQUE_NAME, lastts);
+                }
+        }
+        return status;
+}

vendor/current/source4/ldap_server/ldap_bind.c

@@ -46 +46 @@
         DEBUG(10, ("BindSimple dn: %s\n",req->dn));
 
+        reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
+        if (!reply) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (req->dn != NULL &&
+            strlen(req->dn) != 0 &&
+            call->conn->require_strong_auth > LDAP_SERVER_REQUIRE_STRONG_AUTH_NO &&
+            call->conn->sockets.active != call->conn->sockets.tls)
+        {
+                status = NT_STATUS_NETWORK_ACCESS_DENIED;
+                result = LDAP_STRONG_AUTH_REQUIRED;
+                errstr = talloc_asprintf(reply,
+                                         "BindSimple: Transport encryption required.");
+                goto do_reply;
+        }
+
         status = crack_auto_name_to_nt4_name(call, call->conn->connection->event.ctx, call->conn->lp_ctx, req->dn, &nt4_domain, &nt4_account);
         if (NT_STATUS_IS_OK(status)) {
@@ -59 +76 @@
         }
 
-        reply = ldapsrv_init_reply(call, LDAP_TAG_BindResponse);
-        if (!reply) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
         if (NT_STATUS_IS_OK(status)) {
                 result = LDAP_SUCCESS;
@@ -69 +81 @@
 
                 talloc_unlink(call->conn, call->conn->session_info);
-                call->conn->session_info = session_info;
-                talloc_steal(call->conn, session_info);
+                call->conn->session_info = talloc_steal(call->conn, session_info);
 
                 /* don't leak the old LDB */
@@ -88 +99 @@
         }
 
+do_reply:
         resp = &reply->msg->r.BindResponse;
         resp->response.resultcode = result;
@@ -183 +195 @@
                         gensec_want_feature(conn->gensec, GENSEC_FEATURE_SEAL);
                         gensec_want_feature(conn->gensec, GENSEC_FEATURE_ASYNC_REPLIES);
+                        gensec_want_feature(conn->gensec, GENSEC_FEATURE_LDAP_STYLE);
                         
                         status = gensec_start_mech_by_sasl_name(conn->gensec, req->creds.SASL.mechanism);
@@ -204 +217 @@
                 }
 
-                status = gensec_update(conn->gensec, reply,
-                                       input, &output);
+                status = gensec_update_ev(conn->gensec, reply, conn->connection->event.ctx,
+                                          input, &output);
 
                 /* Windows 2000 mmc doesn't like secblob == NULL and reports a decoding error */
@@ -219 +232 @@
                 errstr = NULL;
         } else if (NT_STATUS_IS_OK(status)) {
-                struct auth_session_info *old_session_info=NULL;
                 struct ldapsrv_sasl_postprocess_context *context = NULL;
 
@@ -264 +276 @@
                                 }
                         }
+                } else {
+                        switch (call->conn->require_strong_auth) {
+                        case LDAP_SERVER_REQUIRE_STRONG_AUTH_NO:
+                                break;
+                        case LDAP_SERVER_REQUIRE_STRONG_AUTH_ALLOW_SASL_OVER_TLS:
+                                if (call->conn->sockets.active == call->conn->sockets.tls) {
+                                        break;
+                                }
+                                status = NT_STATUS_NETWORK_ACCESS_DENIED;
+                                result = LDAP_STRONG_AUTH_REQUIRED;
+                                errstr = talloc_asprintf(reply,
+                                                "SASL:[%s]: not allowed if TLS is used.",
+                                                 req->creds.SASL.mechanism);
+                                break;
+                        case LDAP_SERVER_REQUIRE_STRONG_AUTH_YES:
+                                status = NT_STATUS_NETWORK_ACCESS_DENIED;
+                                result = LDAP_STRONG_AUTH_REQUIRED;
+                                errstr = talloc_asprintf(reply,
+                                                 "SASL:[%s]: Sign or Seal are required.",
+                                                 req->creds.SASL.mechanism);
+                                break;
+                        }
                 }
 
                 if (result != LDAP_SUCCESS) {
-                        conn->session_info = old_session_info;
                 } else if (!NT_STATUS_IS_OK(status)) {
-                        conn->session_info = old_session_info;
                         result = LDAP_OPERATIONS_ERROR;
                         errstr = talloc_asprintf(reply, 
@@ -275 +307 @@
                                                  req->creds.SASL.mechanism, nt_errstr(status));
                 } else {
+                        struct auth_session_info *old_session_info=NULL;
 
                         old_session_info = conn->session_info;
                         conn->session_info = NULL;
-                        status = gensec_session_info(conn->gensec, &conn->session_info);
+                        status = gensec_session_info(conn->gensec, conn, &conn->session_info);
                         if (!NT_STATUS_IS_OK(status)) {
                                 conn->session_info = old_session_info;
@@ -287 +320 @@
                         } else {
                                 talloc_unlink(conn, old_session_info);
-                                talloc_steal(conn, conn->session_info);
                                 
                                 /* don't leak the old LDB */

vendor/current/source4/ldap_server/ldap_extended.c

@@ -83 +83 @@
         TALLOC_FREE(subreq);
         if (ret == -1) {
-                NTSTATUS status = map_nt_error_from_unix(sys_errno);
+                NTSTATUS status = map_nt_error_from_unix_common(sys_errno);
 
                 DEBUG(1,("ldapsrv_starttls_postprocess_done: accept_tls_loop: "
@@ -186 +186 @@
                  */
                 status = extended_ops[i].fn(call, reply, &error_str);
-                NT_STATUS_IS_OK_RETURN(status);
+                if (NT_STATUS_IS_OK(status)) {
+                        return status;
+                }
  
                 if (NT_STATUS_IS_LDAP(status)) {

vendor/current/source4/ldap_server/ldap_server.c

@@ -47 +47 @@
 #include "../lib/util/tevent_ntstatus.h"
 #include "../libcli/util/tstream.h"
+#include "libds/common/roles.h"
 
 static void ldapsrv_terminate_connection_done(struct tevent_req *subreq);
@@ -100 +101 @@
                 tevent_req_callback_data(subreq,
                 struct ldapsrv_connection);
-        int ret;
         int sys_errno;
 
-        ret = tstream_disconnect_recv(subreq, &sys_errno);
+        tstream_disconnect_recv(subreq, &sys_errno);
         TALLOC_FREE(subreq);
 
@@ -219 +219 @@
 
                 s = sscanf((const char *)el->values[i].data, "%255[^=]=%d", policy_name, &policy_value);
-                if (ret != 2 || policy_value == 0)
+                if (s != 2 || policy_value == 0)
                         continue;
-
                 if (strcasecmp("InitRecvTimeout", policy_name) == 0) {
                         conn->limits.initial_timeout = policy_value;
@@ -335 +334 @@
         conn->session_info = session_info;
 
+        conn->sockets.active = conn->sockets.raw;
+
+        if (conn->is_privileged) {
+                conn->require_strong_auth = LDAP_SERVER_REQUIRE_STRONG_AUTH_NO;
+        } else {
+                conn->require_strong_auth = lpcfg_ldap_server_require_strong_auth(conn->lp_ctx);
+        }
+
         if (!NT_STATUS_IS_OK(ldapsrv_backend_Init(conn))) {
                 ldapsrv_terminate_connection(conn, "backend Init failed");
@@ -345 +352 @@
         /* register the server */       
         irpc_add_name(c->msg_ctx, "ldap_server");
-
-        conn->sockets.active = conn->sockets.raw;
 
         if (port != 636 && port != 3269) {
@@ -709 +714 @@
                               ldapsrv_process_call_trigger, NULL);
         if (!ok) {
-                tevent_req_nomem(NULL, req);
+                tevent_req_oom(req);
                 return tevent_req_post(req, ev);
         }
@@ -816 +821 @@
         status = stream_setup_socket(task, task->event_ctx, lp_ctx,
                                      model_ops, &ldap_stream_nonpriv_ops,
-                                     "ipv4", address, &port, 
+                                     "ip", address, &port,
                                      lpcfg_socket_options(lp_ctx),
                                      ldap_service);
@@ -831 +836 @@
                                              model_ops,
                                              &ldap_stream_nonpriv_ops,
-                                             "ipv4", address, &port, 
+                                             "ip", address, &port,
                                              lpcfg_socket_options(lp_ctx),
                                              ldap_service);
@@ -853 +858 @@
                                              model_ops,
                                              &ldap_stream_nonpriv_ops,
-                                             "ipv4", address, &port, 
+                                             "ip", address, &port,
                                              lpcfg_socket_options(lp_ctx),
                                              ldap_service);
@@ -867 +872 @@
                                                      model_ops,
                                                      &ldap_stream_nonpriv_ops,
-                                                     "ipv4", address, &port,
+                                                     "ip", address, &port,
                                                      lpcfg_socket_options(lp_ctx),
                                                      ldap_service);
@@ -908 +913 @@
                                       false);
                 return;
-        case ROLE_DOMAIN_CONTROLLER:
+        case ROLE_ACTIVE_DIRECTORY_DC:
                 /* Yes, we want an LDAP server */
                 break;
@@ -937 +942 @@
                                            lpcfg_tls_crlfile(ldap_service, task->lp_ctx),
                                            lpcfg_tls_dhpfile(ldap_service, task->lp_ctx),
+                                           lpcfg_tls_priority(task->lp_ctx),
                                            &ldap_service->tls_params);
         if (!NT_STATUS_IS_OK(status)) {
-                DEBUG(0,("ldapsrv failed tstream_tls_patams_server - %s\n",
+                DEBUG(0,("ldapsrv failed tstream_tls_params_server - %s\n",
                          nt_errstr(status)));
                 goto failed;
@@ -952 +958 @@
                 int i;
 
-                load_interfaces(task, lpcfg_interfaces(task->lp_ctx), &ifaces);
-                num_interfaces = iface_count(ifaces);
+                load_interface_list(task, task->lp_ctx, &ifaces);
+                num_interfaces = iface_list_count(ifaces);
 
                 /* We have been given an interfaces line, and been 
@@ -960 +966 @@
                 */
                 for(i = 0; i < num_interfaces; i++) {
-                        const char *address = iface_n_ip(ifaces, i);
+                        const char *address = iface_list_n_ip(ifaces, i);
                         status = add_socket(task, task->lp_ctx, model_ops, address, ldap_service);
                         if (!NT_STATUS_IS_OK(status)) goto failed;
                 }
         } else {
-                status = add_socket(task, task->lp_ctx, model_ops,
-                                    lpcfg_socket_address(task->lp_ctx), ldap_service);
-                if (!NT_STATUS_IS_OK(status)) goto failed;
-        }
-
-        ldapi_path = private_path(ldap_service, task->lp_ctx, "ldapi");
+                char **wcard;
+                int i;
+                int num_binds = 0;
+                wcard = iface_list_wildcard(task);
+                if (wcard == NULL) {
+                        DEBUG(0,("No wildcard addresses available\n"));
+                        goto failed;
+                }
+                for (i=0; wcard[i]; i++) {
+                        status = add_socket(task, task->lp_ctx, model_ops, wcard[i], ldap_service);
+                        if (NT_STATUS_IS_OK(status)) {
+                                num_binds++;
+                        }
+                }
+                talloc_free(wcard);
+                if (num_binds == 0) {
+                        goto failed;
+                }
+        }
+
+        ldapi_path = lpcfg_private_path(ldap_service, task->lp_ctx, "ldapi");
         if (!ldapi_path) {
                 goto failed;
@@ -987 +1008 @@
 
 #ifdef WITH_LDAPI_PRIV_SOCKET
-        priv_dir = private_path(ldap_service, task->lp_ctx, "ldap_priv");
+        priv_dir = lpcfg_private_path(ldap_service, task->lp_ctx, "ldap_priv");
         if (priv_dir == NULL) {
                 goto failed;
@@ -995 +1016 @@
          * is of the correct permissions
          */
-        if (!directory_create_or_exist(priv_dir, geteuid(), 0750)) {
+        if (!directory_create_or_exist(priv_dir, 0750)) {
                 task_server_terminate(task, "Cannot create ldap "
                                       "privileged ldapi directory", true);
@@ -1018 +1039 @@
 
 #endif
+
+        /* register the server */
+        irpc_add_name(task->msg_ctx, "ldap_server");
         return;
 

vendor/current/source4/ldap_server/ldap_server.h

@@ -23 +23 @@
 #include "lib/stream/packet.h"
 #include "system/network.h"
+#include "lib/param/loadparm.h"
 
 struct ldapsrv_connection {
@@ -43 +44 @@
         bool global_catalog;
         bool is_privileged;
+        enum ldap_server_require_strong_auth require_strong_auth;
 
         struct {

vendor/current/source4/ldap_server/wscript_build

@@ -7 +7 @@
         subsystem='service',
         init_function='server_service_ldap_init',
-        deps='credentials cli-ldap samdb process_model gensec samba-hostconfig samba_server_gensec',
+        deps='samba-credentials cli-ldap samdb process_model gensec samba-hostconfig samba_server_gensec',
         internal_module=False,
+        enabled=bld.AD_DC_BUILD_IS_ENABLED()
         )