1/* 2 Unix SMB/CIFS mplementation. 3 LDAP protocol helper functions for SAMBA 4 5 Copyright (C) Andrew Tridgell 2004 6 Copyright (C) Volker Lendecke 2004 7 Copyright (C) Stefan Metzmacher 2004 8 Copyright (C) Simo Sorce 2004 9 10 This program is free software; you can redistribute it and/or modify 11 it under the terms of the GNU General Public License as published by 12 the Free Software Foundation; either version 3 of the License, or 13 (at your option) any later version. 14 15 This program is distributed in the hope that it will be useful, 16 but WITHOUT ANY WARRANTY; without even the implied warranty of 17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18 GNU General Public License for more details. 19 20 You should have received a copy of the GNU General Public License 21 along with this program. If not, see <http://www.gnu.org/licenses/>. 22 23*/ 24 25#include "includes.h" 26#include "../lib/util/asn1.h" 27#include "../libcli/ldap/ldap_message.h" 28 29_PUBLIC_ struct ldap_message *new_ldap_message(TALLOC_CTX *mem_ctx) 30{ 31 return talloc_zero(mem_ctx, struct ldap_message); 32} 33 34 35static bool add_value_to_attrib(TALLOC_CTX *mem_ctx, struct ldb_val *value, 36 struct ldb_message_element *attrib) 37{ 38 attrib->values = talloc_realloc(mem_ctx, 39 attrib->values, 40 DATA_BLOB, 41 attrib->num_values+1); 42 if (attrib->values == NULL) 43 return false; 44 45 attrib->values[attrib->num_values].data = talloc_steal(attrib->values, 46 value->data); 47 attrib->values[attrib->num_values].length = value->length; 48 attrib->num_values += 1; 49 return true; 50} 51 52static bool add_attrib_to_array_talloc(TALLOC_CTX *mem_ctx, 53 const struct ldb_message_element *attrib, 54 struct ldb_message_element **attribs, 55 int *num_attribs) 56{ 57 *attribs = talloc_realloc(mem_ctx, 58 *attribs, 59 struct ldb_message_element, 60 *num_attribs+1); 61 62 if (*attribs == NULL) 63 return false; 64 65 (*attribs)[*num_attribs] = *attrib; 66 talloc_steal(*attribs, attrib->values); 67 talloc_steal(*attribs, attrib->name); 68 *num_attribs += 1; 69 return true; 70} 71 72static bool add_mod_to_array_talloc(TALLOC_CTX *mem_ctx, 73 struct ldap_mod *mod, 74 struct ldap_mod **mods, 75 int *num_mods) 76{ 77 *mods = talloc_realloc(mem_ctx, *mods, struct ldap_mod, (*num_mods)+1); 78 79 if (*mods == NULL) 80 return false; 81 82 (*mods)[*num_mods] = *mod; 83 *num_mods += 1; 84 return true; 85} 86 87static bool ldap_decode_control_value(void *mem_ctx, DATA_BLOB value, 88 const struct ldap_control_handler *handlers, 89 struct ldb_control *ctrl) 90{ 91 int i; 92 93 if (!handlers) { 94 return true; 95 } 96 97 for (i = 0; handlers[i].oid != NULL; i++) { 98 if (strcmp(handlers[i].oid, ctrl->oid) == 0) { 99 if (!handlers[i].decode || !handlers[i].decode(mem_ctx, value, &ctrl->data)) { 100 return false; 101 } 102 break; 103 } 104 } 105 if (handlers[i].oid == NULL) { 106 return false; 107 } 108 109 return true; 110} 111 112static bool ldap_decode_control_wrapper(void *mem_ctx, struct asn1_data *data, 113 struct ldb_control *ctrl, DATA_BLOB *value) 114{ 115 DATA_BLOB oid; 116 117 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) { 118 return false; 119 } 120 121 if (!asn1_read_OctetString(data, mem_ctx, &oid)) { 122 return false; 123 } 124 ctrl->oid = talloc_strndup(mem_ctx, (char *)oid.data, oid.length); 125 if (!ctrl->oid) { 126 return false; 127 } 128 129 if (asn1_peek_tag(data, ASN1_BOOLEAN)) { 130 bool critical; 131 if (!asn1_read_BOOLEAN(data, &critical)) { 132 return false; 133 } 134 ctrl->critical = critical; 135 } else { 136 ctrl->critical = false; 137 } 138 139 ctrl->data = NULL; 140 141 if (!asn1_peek_tag(data, ASN1_OCTET_STRING)) { 142 *value = data_blob(NULL, 0); 143 goto end_tag; 144 } 145 146 if (!asn1_read_OctetString(data, mem_ctx, value)) { 147 return false; 148 } 149 150end_tag: 151 if (!asn1_end_tag(data)) { 152 return false; 153 } 154 155 return true; 156} 157 158static bool ldap_encode_control(void *mem_ctx, struct asn1_data *data, 159 const struct ldap_control_handler *handlers, 160 struct ldb_control *ctrl) 161{ 162 DATA_BLOB value; 163 int i; 164 165 if (!handlers) { 166 return false; 167 } 168 169 for (i = 0; handlers[i].oid != NULL; i++) { 170 if (strcmp(handlers[i].oid, ctrl->oid) == 0) { 171 if (!handlers[i].encode) { 172 if (ctrl->critical) { 173 return false; 174 } else { 175 /* not encoding this control */ 176 return true; 177 } 178 } 179 if (!handlers[i].encode(mem_ctx, ctrl->data, &value)) { 180 return false; 181 } 182 break; 183 } 184 } 185 if (handlers[i].oid == NULL) { 186 return false; 187 } 188 189 if (!asn1_push_tag(data, ASN1_SEQUENCE(0))) { 190 return false; 191 } 192 193 if (!asn1_write_OctetString(data, ctrl->oid, strlen(ctrl->oid))) { 194 return false; 195 } 196 197 if (ctrl->critical) { 198 if (!asn1_write_BOOLEAN(data, ctrl->critical)) { 199 return false; 200 } 201 } 202 203 if (!ctrl->data) { 204 goto pop_tag; 205 } 206 207 if (!asn1_write_OctetString(data, value.data, value.length)) { 208 return false; 209 } 210 211pop_tag: 212 if (!asn1_pop_tag(data)) { 213 return false; 214 } 215 216 return true; 217} 218 219static bool ldap_push_filter(struct asn1_data *data, struct ldb_parse_tree *tree) 220{ 221 int i; 222 223 switch (tree->operation) { 224 case LDB_OP_AND: 225 case LDB_OP_OR: 226 asn1_push_tag(data, ASN1_CONTEXT(tree->operation==LDB_OP_AND?0:1)); 227 for (i=0; i<tree->u.list.num_elements; i++) { 228 if (!ldap_push_filter(data, tree->u.list.elements[i])) { 229 return false; 230 } 231 } 232 asn1_pop_tag(data); 233 break; 234 235 case LDB_OP_NOT: 236 asn1_push_tag(data, ASN1_CONTEXT(2)); 237 if (!ldap_push_filter(data, tree->u.isnot.child)) { 238 return false; 239 } 240 asn1_pop_tag(data); 241 break; 242 243 case LDB_OP_EQUALITY: 244 /* equality test */ 245 asn1_push_tag(data, ASN1_CONTEXT(3)); 246 asn1_write_OctetString(data, tree->u.equality.attr, 247 strlen(tree->u.equality.attr)); 248 asn1_write_OctetString(data, tree->u.equality.value.data, 249 tree->u.equality.value.length); 250 asn1_pop_tag(data); 251 break; 252 253 case LDB_OP_SUBSTRING: 254 /* 255 SubstringFilter ::= SEQUENCE { 256 type AttributeDescription, 257 -- at least one must be present 258 substrings SEQUENCE OF CHOICE { 259 initial [0] LDAPString, 260 any [1] LDAPString, 261 final [2] LDAPString } } 262 */ 263 asn1_push_tag(data, ASN1_CONTEXT(4)); 264 asn1_write_OctetString(data, tree->u.substring.attr, strlen(tree->u.substring.attr)); 265 asn1_push_tag(data, ASN1_SEQUENCE(0)); 266 i = 0; 267 if ( ! tree->u.substring.start_with_wildcard) { 268 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0)); 269 asn1_write_DATA_BLOB_LDAPString(data, tree->u.substring.chunks[i]); 270 asn1_pop_tag(data); 271 i++; 272 } 273 while (tree->u.substring.chunks[i]) { 274 int ctx; 275 276 if (( ! tree->u.substring.chunks[i + 1]) && 277 (tree->u.substring.end_with_wildcard == 0)) { 278 ctx = 2; 279 } else { 280 ctx = 1; 281 } 282 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(ctx)); 283 asn1_write_DATA_BLOB_LDAPString(data, tree->u.substring.chunks[i]); 284 asn1_pop_tag(data); 285 i++; 286 } 287 asn1_pop_tag(data); 288 asn1_pop_tag(data); 289 break; 290 291 case LDB_OP_GREATER: 292 /* greaterOrEqual test */ 293 asn1_push_tag(data, ASN1_CONTEXT(5)); 294 asn1_write_OctetString(data, tree->u.comparison.attr, 295 strlen(tree->u.comparison.attr)); 296 asn1_write_OctetString(data, tree->u.comparison.value.data, 297 tree->u.comparison.value.length); 298 asn1_pop_tag(data); 299 break; 300 301 case LDB_OP_LESS: 302 /* lessOrEqual test */ 303 asn1_push_tag(data, ASN1_CONTEXT(6)); 304 asn1_write_OctetString(data, tree->u.comparison.attr, 305 strlen(tree->u.comparison.attr)); 306 asn1_write_OctetString(data, tree->u.comparison.value.data, 307 tree->u.comparison.value.length); 308 asn1_pop_tag(data); 309 break; 310 311 case LDB_OP_PRESENT: 312 /* present test */ 313 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(7)); 314 asn1_write_LDAPString(data, tree->u.present.attr); 315 asn1_pop_tag(data); 316 return !data->has_error; 317 318 case LDB_OP_APPROX: 319 /* approx test */ 320 asn1_push_tag(data, ASN1_CONTEXT(8)); 321 asn1_write_OctetString(data, tree->u.comparison.attr, 322 strlen(tree->u.comparison.attr)); 323 asn1_write_OctetString(data, tree->u.comparison.value.data, 324 tree->u.comparison.value.length); 325 asn1_pop_tag(data); 326 break; 327 328 case LDB_OP_EXTENDED: 329 /* 330 MatchingRuleAssertion ::= SEQUENCE { 331 matchingRule [1] MatchingRuleID OPTIONAL, 332 type [2] AttributeDescription OPTIONAL, 333 matchValue [3] AssertionValue, 334 dnAttributes [4] BOOLEAN DEFAULT FALSE 335 } 336 */ 337 asn1_push_tag(data, ASN1_CONTEXT(9)); 338 if (tree->u.extended.rule_id) { 339 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(1)); 340 asn1_write_LDAPString(data, tree->u.extended.rule_id); 341 asn1_pop_tag(data); 342 } 343 if (tree->u.extended.attr) { 344 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(2)); 345 asn1_write_LDAPString(data, tree->u.extended.attr); 346 asn1_pop_tag(data); 347 } 348 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(3)); 349 asn1_write_DATA_BLOB_LDAPString(data, &tree->u.extended.value); 350 asn1_pop_tag(data); 351 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(4)); 352 asn1_write_uint8(data, tree->u.extended.dnAttributes); 353 asn1_pop_tag(data); 354 asn1_pop_tag(data); 355 break; 356 357 default: 358 return false; 359 } 360 return !data->has_error; 361} 362 363static void ldap_encode_response(struct asn1_data *data, struct ldap_Result *result) 364{ 365 asn1_write_enumerated(data, result->resultcode); 366 asn1_write_OctetString(data, result->dn, 367 (result->dn) ? strlen(result->dn) : 0); 368 asn1_write_OctetString(data, result->errormessage, 369 (result->errormessage) ? 370 strlen(result->errormessage) : 0); 371 if (result->referral) { 372 asn1_push_tag(data, ASN1_CONTEXT(3)); 373 asn1_write_OctetString(data, result->referral, 374 strlen(result->referral)); 375 asn1_pop_tag(data); 376 } 377} 378 379_PUBLIC_ bool ldap_encode(struct ldap_message *msg, 380 const struct ldap_control_handler *control_handlers, 381 DATA_BLOB *result, TALLOC_CTX *mem_ctx) 382{ 383 struct asn1_data *data = asn1_init(mem_ctx); 384 int i, j; 385 386 if (!data) return false; 387 388 asn1_push_tag(data, ASN1_SEQUENCE(0)); 389 asn1_write_Integer(data, msg->messageid); 390 391 switch (msg->type) { 392 case LDAP_TAG_BindRequest: { 393 struct ldap_BindRequest *r = &msg->r.BindRequest; 394 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 395 asn1_write_Integer(data, r->version); 396 asn1_write_OctetString(data, r->dn, 397 (r->dn != NULL) ? strlen(r->dn) : 0); 398 399 switch (r->mechanism) { 400 case LDAP_AUTH_MECH_SIMPLE: 401 /* context, primitive */ 402 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0)); 403 asn1_write(data, r->creds.password, 404 strlen(r->creds.password)); 405 asn1_pop_tag(data); 406 break; 407 case LDAP_AUTH_MECH_SASL: 408 /* context, constructed */ 409 asn1_push_tag(data, ASN1_CONTEXT(3)); 410 asn1_write_OctetString(data, r->creds.SASL.mechanism, 411 strlen(r->creds.SASL.mechanism)); 412 if (r->creds.SASL.secblob) { 413 asn1_write_OctetString(data, r->creds.SASL.secblob->data, 414 r->creds.SASL.secblob->length); 415 } 416 asn1_pop_tag(data); 417 break; 418 default: 419 return false; 420 } 421 422 asn1_pop_tag(data); 423 break; 424 } 425 case LDAP_TAG_BindResponse: { 426 struct ldap_BindResponse *r = &msg->r.BindResponse; 427 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 428 ldap_encode_response(data, &r->response); 429 if (r->SASL.secblob) { 430 asn1_write_ContextSimple(data, 7, r->SASL.secblob); 431 } 432 asn1_pop_tag(data); 433 break; 434 } 435 case LDAP_TAG_UnbindRequest: { 436/* struct ldap_UnbindRequest *r = &msg->r.UnbindRequest; */ 437 break; 438 } 439 case LDAP_TAG_SearchRequest: { 440 struct ldap_SearchRequest *r = &msg->r.SearchRequest; 441 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 442 asn1_write_OctetString(data, r->basedn, strlen(r->basedn)); 443 asn1_write_enumerated(data, r->scope); 444 asn1_write_enumerated(data, r->deref); 445 asn1_write_Integer(data, r->sizelimit); 446 asn1_write_Integer(data, r->timelimit); 447 asn1_write_BOOLEAN(data, r->attributesonly); 448 449 if (!ldap_push_filter(data, r->tree)) { 450 return false; 451 } 452 453 asn1_push_tag(data, ASN1_SEQUENCE(0)); 454 for (i=0; i<r->num_attributes; i++) { 455 asn1_write_OctetString(data, r->attributes[i], 456 strlen(r->attributes[i])); 457 } 458 asn1_pop_tag(data); 459 asn1_pop_tag(data); 460 break; 461 } 462 case LDAP_TAG_SearchResultEntry: { 463 struct ldap_SearchResEntry *r = &msg->r.SearchResultEntry; 464 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 465 asn1_write_OctetString(data, r->dn, strlen(r->dn)); 466 asn1_push_tag(data, ASN1_SEQUENCE(0)); 467 for (i=0; i<r->num_attributes; i++) { 468 struct ldb_message_element *attr = &r->attributes[i]; 469 asn1_push_tag(data, ASN1_SEQUENCE(0)); 470 asn1_write_OctetString(data, attr->name, 471 strlen(attr->name)); 472 asn1_push_tag(data, ASN1_SEQUENCE(1)); 473 for (j=0; j<attr->num_values; j++) { 474 asn1_write_OctetString(data, 475 attr->values[j].data, 476 attr->values[j].length); 477 } 478 asn1_pop_tag(data); 479 asn1_pop_tag(data); 480 } 481 asn1_pop_tag(data); 482 asn1_pop_tag(data); 483 break; 484 } 485 case LDAP_TAG_SearchResultDone: { 486 struct ldap_Result *r = &msg->r.SearchResultDone; 487 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 488 ldap_encode_response(data, r); 489 asn1_pop_tag(data); 490 break; 491 } 492 case LDAP_TAG_ModifyRequest: { 493 struct ldap_ModifyRequest *r = &msg->r.ModifyRequest; 494 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 495 asn1_write_OctetString(data, r->dn, strlen(r->dn)); 496 asn1_push_tag(data, ASN1_SEQUENCE(0)); 497 498 for (i=0; i<r->num_mods; i++) { 499 struct ldb_message_element *attrib = &r->mods[i].attrib; 500 asn1_push_tag(data, ASN1_SEQUENCE(0)); 501 asn1_write_enumerated(data, r->mods[i].type); 502 asn1_push_tag(data, ASN1_SEQUENCE(0)); 503 asn1_write_OctetString(data, attrib->name, 504 strlen(attrib->name)); 505 asn1_push_tag(data, ASN1_SET); 506 for (j=0; j<attrib->num_values; j++) { 507 asn1_write_OctetString(data, 508 attrib->values[j].data, 509 attrib->values[j].length); 510 511 } 512 asn1_pop_tag(data); 513 asn1_pop_tag(data); 514 asn1_pop_tag(data); 515 } 516 517 asn1_pop_tag(data); 518 asn1_pop_tag(data); 519 break; 520 } 521 case LDAP_TAG_ModifyResponse: { 522 struct ldap_Result *r = &msg->r.ModifyResponse; 523 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 524 ldap_encode_response(data, r); 525 asn1_pop_tag(data); 526 break; 527 } 528 case LDAP_TAG_AddRequest: { 529 struct ldap_AddRequest *r = &msg->r.AddRequest; 530 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 531 asn1_write_OctetString(data, r->dn, strlen(r->dn)); 532 asn1_push_tag(data, ASN1_SEQUENCE(0)); 533 534 for (i=0; i<r->num_attributes; i++) { 535 struct ldb_message_element *attrib = &r->attributes[i]; 536 asn1_push_tag(data, ASN1_SEQUENCE(0)); 537 asn1_write_OctetString(data, attrib->name, 538 strlen(attrib->name)); 539 asn1_push_tag(data, ASN1_SET); 540 for (j=0; j<r->attributes[i].num_values; j++) { 541 asn1_write_OctetString(data, 542 attrib->values[j].data, 543 attrib->values[j].length); 544 } 545 asn1_pop_tag(data); 546 asn1_pop_tag(data); 547 } 548 asn1_pop_tag(data); 549 asn1_pop_tag(data); 550 break; 551 } 552 case LDAP_TAG_AddResponse: { 553 struct ldap_Result *r = &msg->r.AddResponse; 554 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 555 ldap_encode_response(data, r); 556 asn1_pop_tag(data); 557 break; 558 } 559 case LDAP_TAG_DelRequest: { 560 struct ldap_DelRequest *r = &msg->r.DelRequest; 561 asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type)); 562 asn1_write(data, r->dn, strlen(r->dn)); 563 asn1_pop_tag(data); 564 break; 565 } 566 case LDAP_TAG_DelResponse: { 567 struct ldap_Result *r = &msg->r.DelResponse; 568 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 569 ldap_encode_response(data, r); 570 asn1_pop_tag(data); 571 break; 572 } 573 case LDAP_TAG_ModifyDNRequest: { 574 struct ldap_ModifyDNRequest *r = &msg->r.ModifyDNRequest; 575 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 576 asn1_write_OctetString(data, r->dn, strlen(r->dn)); 577 asn1_write_OctetString(data, r->newrdn, strlen(r->newrdn)); 578 asn1_write_BOOLEAN(data, r->deleteolddn); 579 if (r->newsuperior) { 580 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0)); 581 asn1_write(data, r->newsuperior, 582 strlen(r->newsuperior)); 583 asn1_pop_tag(data); 584 } 585 asn1_pop_tag(data); 586 break; 587 } 588 case LDAP_TAG_ModifyDNResponse: { 589 struct ldap_Result *r = &msg->r.ModifyDNResponse; 590 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 591 ldap_encode_response(data, r); 592 asn1_pop_tag(data); 593 break; 594 } 595 case LDAP_TAG_CompareRequest: { 596 struct ldap_CompareRequest *r = &msg->r.CompareRequest; 597 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 598 asn1_write_OctetString(data, r->dn, strlen(r->dn)); 599 asn1_push_tag(data, ASN1_SEQUENCE(0)); 600 asn1_write_OctetString(data, r->attribute, 601 strlen(r->attribute)); 602 asn1_write_OctetString(data, r->value.data, 603 r->value.length); 604 asn1_pop_tag(data); 605 asn1_pop_tag(data); 606 break; 607 } 608 case LDAP_TAG_CompareResponse: { 609 struct ldap_Result *r = &msg->r.ModifyDNResponse; 610 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 611 ldap_encode_response(data, r); 612 asn1_pop_tag(data); 613 break; 614 } 615 case LDAP_TAG_AbandonRequest: { 616 struct ldap_AbandonRequest *r = &msg->r.AbandonRequest; 617 asn1_push_tag(data, ASN1_APPLICATION_SIMPLE(msg->type)); 618 asn1_write_implicit_Integer(data, r->messageid); 619 asn1_pop_tag(data); 620 break; 621 } 622 case LDAP_TAG_SearchResultReference: { 623 struct ldap_SearchResRef *r = &msg->r.SearchResultReference; 624 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 625 asn1_write_OctetString(data, r->referral, strlen(r->referral)); 626 asn1_pop_tag(data); 627 break; 628 } 629 case LDAP_TAG_ExtendedRequest: { 630 struct ldap_ExtendedRequest *r = &msg->r.ExtendedRequest; 631 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 632 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(0)); 633 asn1_write(data, r->oid, strlen(r->oid)); 634 asn1_pop_tag(data); 635 if (r->value) { 636 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(1)); 637 asn1_write(data, r->value->data, r->value->length); 638 asn1_pop_tag(data); 639 } 640 asn1_pop_tag(data); 641 break; 642 } 643 case LDAP_TAG_ExtendedResponse: { 644 struct ldap_ExtendedResponse *r = &msg->r.ExtendedResponse; 645 asn1_push_tag(data, ASN1_APPLICATION(msg->type)); 646 ldap_encode_response(data, &r->response); 647 if (r->oid) { 648 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(10)); 649 asn1_write(data, r->oid, strlen(r->oid)); 650 asn1_pop_tag(data); 651 } 652 if (r->value) { 653 asn1_push_tag(data, ASN1_CONTEXT_SIMPLE(11)); 654 asn1_write(data, r->value->data, r->value->length); 655 asn1_pop_tag(data); 656 } 657 asn1_pop_tag(data); 658 break; 659 } 660 default: 661 return false; 662 } 663 664 if (msg->controls != NULL) { 665 asn1_push_tag(data, ASN1_CONTEXT(0)); 666 667 for (i = 0; msg->controls[i] != NULL; i++) { 668 if (!ldap_encode_control(mem_ctx, data, 669 control_handlers, 670 msg->controls[i])) { 671 return false; 672 } 673 } 674 675 asn1_pop_tag(data); 676 } 677 678 asn1_pop_tag(data); 679 680 if (data->has_error) { 681 asn1_free(data); 682 return false; 683 } 684 685 *result = data_blob_talloc(mem_ctx, data->data, data->length); 686 asn1_free(data); 687 return true; 688} 689 690static const char *blob2string_talloc(TALLOC_CTX *mem_ctx, 691 DATA_BLOB blob) 692{ 693 char *result = talloc_array(mem_ctx, char, blob.length+1); 694 memcpy(result, blob.data, blob.length); 695 result[blob.length] = '\0'; 696 return result; 697} 698 699bool asn1_read_OctetString_talloc(TALLOC_CTX *mem_ctx, 700 struct asn1_data *data, 701 const char **result) 702{ 703 DATA_BLOB string; 704 if (!asn1_read_OctetString(data, mem_ctx, &string)) 705 return false; 706 *result = blob2string_talloc(mem_ctx, string); 707 data_blob_free(&string); 708 return true; 709} 710 711static void ldap_decode_response(TALLOC_CTX *mem_ctx, 712 struct asn1_data *data, 713 struct ldap_Result *result) 714{ 715 asn1_read_enumerated(data, &result->resultcode); 716 asn1_read_OctetString_talloc(mem_ctx, data, &result->dn); 717 asn1_read_OctetString_talloc(mem_ctx, data, &result->errormessage); 718 if (asn1_peek_tag(data, ASN1_CONTEXT(3))) { 719 asn1_start_tag(data, ASN1_CONTEXT(3)); 720 asn1_read_OctetString_talloc(mem_ctx, data, &result->referral); 721 asn1_end_tag(data); 722 } else { 723 result->referral = NULL; 724 } 725} 726 727static struct ldb_val **ldap_decode_substring(TALLOC_CTX *mem_ctx, struct ldb_val **chunks, int chunk_num, char *value) 728{ 729 730 chunks = talloc_realloc(mem_ctx, chunks, struct ldb_val *, chunk_num + 2); 731 if (chunks == NULL) { 732 return NULL; 733 } 734 735 chunks[chunk_num] = talloc(mem_ctx, struct ldb_val); 736 if (chunks[chunk_num] == NULL) { 737 return NULL; 738 } 739 740 chunks[chunk_num]->data = (uint8_t *)talloc_strdup(mem_ctx, value); 741 if (chunks[chunk_num]->data == NULL) { 742 return NULL; 743 } 744 chunks[chunk_num]->length = strlen(value); 745 746 chunks[chunk_num + 1] = '\0'; 747 748 return chunks; 749} 750 751 752/* 753 parse the ASN.1 formatted search string into a ldb_parse_tree 754*/ 755static struct ldb_parse_tree *ldap_decode_filter_tree(TALLOC_CTX *mem_ctx, 756 struct asn1_data *data) 757{ 758 uint8_t filter_tag; 759 struct ldb_parse_tree *ret; 760 761 if (!asn1_peek_uint8(data, &filter_tag)) { 762 return NULL; 763 } 764 765 filter_tag &= 0x1f; /* strip off the asn1 stuff */ 766 767 ret = talloc(mem_ctx, struct ldb_parse_tree); 768 if (ret == NULL) return NULL; 769 770 switch(filter_tag) { 771 case 0: 772 case 1: 773 /* AND or OR of one or more filters */ 774 ret->operation = (filter_tag == 0)?LDB_OP_AND:LDB_OP_OR; 775 ret->u.list.num_elements = 0; 776 ret->u.list.elements = NULL; 777 778 if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) { 779 goto failed; 780 } 781 782 while (asn1_tag_remaining(data) > 0) { 783 struct ldb_parse_tree *subtree; 784 subtree = ldap_decode_filter_tree(ret, data); 785 if (subtree == NULL) { 786 goto failed; 787 } 788 ret->u.list.elements = 789 talloc_realloc(ret, ret->u.list.elements, 790 struct ldb_parse_tree *, 791 ret->u.list.num_elements+1); 792 if (ret->u.list.elements == NULL) { 793 goto failed; 794 } 795 talloc_steal(ret->u.list.elements, subtree); 796 ret->u.list.elements[ret->u.list.num_elements] = subtree; 797 ret->u.list.num_elements++; 798 } 799 if (!asn1_end_tag(data)) { 800 goto failed; 801 } 802 break; 803 804 case 2: 805 /* 'not' operation */ 806 if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) { 807 goto failed; 808 } 809 810 ret->operation = LDB_OP_NOT; 811 ret->u.isnot.child = ldap_decode_filter_tree(ret, data); 812 if (ret->u.isnot.child == NULL) { 813 goto failed; 814 } 815 if (!asn1_end_tag(data)) { 816 goto failed; 817 } 818 break; 819 820 case 3: { 821 /* equalityMatch */ 822 const char *attrib; 823 DATA_BLOB value; 824 825 asn1_start_tag(data, ASN1_CONTEXT(filter_tag)); 826 asn1_read_OctetString_talloc(mem_ctx, data, &attrib); 827 asn1_read_OctetString(data, mem_ctx, &value); 828 asn1_end_tag(data); 829 if ((data->has_error) || (attrib == NULL) || (value.data == NULL)) { 830 goto failed; 831 } 832 833 ret->operation = LDB_OP_EQUALITY; 834 ret->u.equality.attr = talloc_steal(ret, attrib); 835 ret->u.equality.value.data = talloc_steal(ret, value.data); 836 ret->u.equality.value.length = value.length; 837 break; 838 } 839 case 4: { 840 /* substrings */ 841 DATA_BLOB attr; 842 uint8_t subs_tag; 843 char *value; 844 int chunk_num = 0; 845 846 if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) { 847 goto failed; 848 } 849 if (!asn1_read_OctetString(data, mem_ctx, &attr)) { 850 goto failed; 851 } 852 853 ret->operation = LDB_OP_SUBSTRING; 854 ret->u.substring.attr = talloc_strndup(ret, (char *)attr.data, attr.length); 855 ret->u.substring.chunks = NULL; 856 ret->u.substring.start_with_wildcard = 1; 857 ret->u.substring.end_with_wildcard = 1; 858 859 if (!asn1_start_tag(data, ASN1_SEQUENCE(0))) { 860 goto failed; 861 } 862 863 while (asn1_tag_remaining(data)) { 864 asn1_peek_uint8(data, &subs_tag); 865 subs_tag &= 0x1f; /* strip off the asn1 stuff */ 866 if (subs_tag > 2) goto failed; 867 868 asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(subs_tag)); 869 asn1_read_LDAPString(data, mem_ctx, &value); 870 asn1_end_tag(data); 871 872 switch (subs_tag) { 873 case 0: 874 if (ret->u.substring.chunks != NULL) { 875 /* initial value found in the middle */ 876 goto failed; 877 } 878 879 ret->u.substring.chunks = ldap_decode_substring(ret, NULL, 0, value); 880 if (ret->u.substring.chunks == NULL) { 881 goto failed; 882 } 883 884 ret->u.substring.start_with_wildcard = 0; 885 chunk_num = 1; 886 break; 887 888 case 1: 889 if (ret->u.substring.end_with_wildcard == 0) { 890 /* "any" value found after a "final" value */ 891 goto failed; 892 } 893 894 ret->u.substring.chunks = ldap_decode_substring(ret, 895 ret->u.substring.chunks, 896 chunk_num, 897 value); 898 if (ret->u.substring.chunks == NULL) { 899 goto failed; 900 } 901 902 chunk_num++; 903 break; 904 905 case 2: 906 ret->u.substring.chunks = ldap_decode_substring(ret, 907 ret->u.substring.chunks, 908 chunk_num, 909 value); 910 if (ret->u.substring.chunks == NULL) { 911 goto failed; 912 } 913 914 ret->u.substring.end_with_wildcard = 0; 915 break; 916 917 default: 918 goto failed; 919 } 920 921 } 922 923 if (!asn1_end_tag(data)) { /* SEQUENCE */ 924 goto failed; 925 } 926 927 if (!asn1_end_tag(data)) { 928 goto failed; 929 } 930 break; 931 } 932 case 5: { 933 /* greaterOrEqual */ 934 const char *attrib; 935 DATA_BLOB value; 936 937 asn1_start_tag(data, ASN1_CONTEXT(filter_tag)); 938 asn1_read_OctetString_talloc(mem_ctx, data, &attrib); 939 asn1_read_OctetString(data, mem_ctx, &value); 940 asn1_end_tag(data); 941 if ((data->has_error) || (attrib == NULL) || (value.data == NULL)) { 942 goto failed; 943 } 944 945 ret->operation = LDB_OP_GREATER; 946 ret->u.comparison.attr = talloc_steal(ret, attrib); 947 ret->u.comparison.value.data = talloc_steal(ret, value.data); 948 ret->u.comparison.value.length = value.length; 949 break; 950 } 951 case 6: { 952 /* lessOrEqual */ 953 const char *attrib; 954 DATA_BLOB value; 955 956 asn1_start_tag(data, ASN1_CONTEXT(filter_tag)); 957 asn1_read_OctetString_talloc(mem_ctx, data, &attrib); 958 asn1_read_OctetString(data, mem_ctx, &value); 959 asn1_end_tag(data); 960 if ((data->has_error) || (attrib == NULL) || (value.data == NULL)) { 961 goto failed; 962 } 963 964 ret->operation = LDB_OP_LESS; 965 ret->u.comparison.attr = talloc_steal(ret, attrib); 966 ret->u.comparison.value.data = talloc_steal(ret, value.data); 967 ret->u.comparison.value.length = value.length; 968 break; 969 } 970 case 7: { 971 /* Normal presence, "attribute=*" */ 972 char *attr; 973 974 if (!asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(filter_tag))) { 975 goto failed; 976 } 977 if (!asn1_read_LDAPString(data, ret, &attr)) { 978 goto failed; 979 } 980 981 ret->operation = LDB_OP_PRESENT; 982 ret->u.present.attr = talloc_steal(ret, attr); 983 984 if (!asn1_end_tag(data)) { 985 goto failed; 986 } 987 break; 988 } 989 case 8: { 990 /* approx */ 991 const char *attrib; 992 DATA_BLOB value; 993 994 asn1_start_tag(data, ASN1_CONTEXT(filter_tag)); 995 asn1_read_OctetString_talloc(mem_ctx, data, &attrib); 996 asn1_read_OctetString(data, mem_ctx, &value); 997 asn1_end_tag(data); 998 if ((data->has_error) || (attrib == NULL) || (value.data == NULL)) { 999 goto failed; 1000 } 1001 1002 ret->operation = LDB_OP_APPROX; 1003 ret->u.comparison.attr = talloc_steal(ret, attrib); 1004 ret->u.comparison.value.data = talloc_steal(ret, value.data); 1005 ret->u.comparison.value.length = value.length; 1006 break; 1007 } 1008 case 9: { 1009 char *oid = NULL, *attr = NULL, *value; 1010 uint8_t dnAttributes; 1011 /* an extended search */ 1012 if (!asn1_start_tag(data, ASN1_CONTEXT(filter_tag))) { 1013 goto failed; 1014 } 1015 1016 /* FIXME: read carefully rfc2251.txt there are a number of 'MUST's 1017 we need to check we properly implement --SSS */ 1018 /* either oid or type must be defined */ 1019 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(1))) { /* optional */ 1020 asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(1)); 1021 asn1_read_LDAPString(data, ret, &oid); 1022 asn1_end_tag(data); 1023 } 1024 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(2))) { /* optional */ 1025 asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(2)); 1026 asn1_read_LDAPString(data, ret, &attr); 1027 asn1_end_tag(data); 1028 } 1029 asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(3)); 1030 asn1_read_LDAPString(data, ret, &value); 1031 asn1_end_tag(data); 1032 /* dnAttributes is marked as BOOLEAN DEFAULT FALSE 1033 it is not marked as OPTIONAL but openldap tools 1034 do not set this unless it is to be set as TRUE 1035 NOTE: openldap tools do not work with AD as it 1036 seems that AD always requires the dnAttributes 1037 boolean value to be set */ 1038 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(4))) { 1039 asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(4)); 1040 asn1_read_uint8(data, &dnAttributes); 1041 asn1_end_tag(data); 1042 } else { 1043 dnAttributes = 0; 1044 } 1045 if ((oid == NULL && attr == NULL) || (value == NULL)) { 1046 goto failed; 1047 } 1048 1049 if (oid) { 1050 ret->operation = LDB_OP_EXTENDED; 1051 1052 /* From the RFC2251: If the type field is 1053 absent and matchingRule is present, the matchValue is compared 1054 against all attributes in an entry which support that matchingRule 1055 */ 1056 if (attr) { 1057 ret->u.extended.attr = talloc_steal(ret, attr); 1058 } else { 1059 ret->u.extended.attr = talloc_strdup(ret, "*"); 1060 } 1061 ret->u.extended.rule_id = talloc_steal(ret, oid); 1062 ret->u.extended.value.data = (uint8_t *)talloc_steal(ret, value); 1063 ret->u.extended.value.length = strlen(value); 1064 ret->u.extended.dnAttributes = dnAttributes; 1065 } else { 1066 ret->operation = LDB_OP_EQUALITY; 1067 ret->u.equality.attr = talloc_steal(ret, attr); 1068 ret->u.equality.value.data = (uint8_t *)talloc_steal(ret, value); 1069 ret->u.equality.value.length = strlen(value); 1070 } 1071 if (!asn1_end_tag(data)) { 1072 goto failed; 1073 } 1074 break; 1075 } 1076 1077 default: 1078 goto failed; 1079 } 1080 1081 return ret; 1082 1083failed: 1084 talloc_free(ret); 1085 return NULL; 1086} 1087 1088/* Decode a single LDAP attribute, possibly containing multiple values */ 1089static void ldap_decode_attrib(TALLOC_CTX *mem_ctx, struct asn1_data *data, 1090 struct ldb_message_element *attrib) 1091{ 1092 asn1_start_tag(data, ASN1_SEQUENCE(0)); 1093 asn1_read_OctetString_talloc(mem_ctx, data, &attrib->name); 1094 asn1_start_tag(data, ASN1_SET); 1095 while (asn1_peek_tag(data, ASN1_OCTET_STRING)) { 1096 DATA_BLOB blob; 1097 asn1_read_OctetString(data, mem_ctx, &blob); 1098 add_value_to_attrib(mem_ctx, &blob, attrib); 1099 } 1100 asn1_end_tag(data); 1101 asn1_end_tag(data); 1102 1103} 1104 1105/* Decode a set of LDAP attributes, as found in the dereference control */ 1106void ldap_decode_attribs_bare(TALLOC_CTX *mem_ctx, struct asn1_data *data, 1107 struct ldb_message_element **attributes, 1108 int *num_attributes) 1109{ 1110 while (asn1_peek_tag(data, ASN1_SEQUENCE(0))) { 1111 struct ldb_message_element attrib; 1112 ZERO_STRUCT(attrib); 1113 ldap_decode_attrib(mem_ctx, data, &attrib); 1114 add_attrib_to_array_talloc(mem_ctx, &attrib, 1115 attributes, num_attributes); 1116 } 1117} 1118 1119/* Decode a set of LDAP attributes, as found in a search entry */ 1120static void ldap_decode_attribs(TALLOC_CTX *mem_ctx, struct asn1_data *data, 1121 struct ldb_message_element **attributes, 1122 int *num_attributes) 1123{ 1124 asn1_start_tag(data, ASN1_SEQUENCE(0)); 1125 ldap_decode_attribs_bare(mem_ctx, data, 1126 attributes, num_attributes); 1127 asn1_end_tag(data); 1128} 1129 1130/* This routine returns LDAP status codes */ 1131 1132_PUBLIC_ NTSTATUS ldap_decode(struct asn1_data *data, 1133 const struct ldap_control_handler *control_handlers, 1134 struct ldap_message *msg) 1135{ 1136 uint8_t tag; 1137 1138 asn1_start_tag(data, ASN1_SEQUENCE(0)); 1139 asn1_read_Integer(data, &msg->messageid); 1140 1141 if (!asn1_peek_uint8(data, &tag)) 1142 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR); 1143 1144 switch(tag) { 1145 1146 case ASN1_APPLICATION(LDAP_TAG_BindRequest): { 1147 struct ldap_BindRequest *r = &msg->r.BindRequest; 1148 msg->type = LDAP_TAG_BindRequest; 1149 asn1_start_tag(data, tag); 1150 asn1_read_Integer(data, &r->version); 1151 asn1_read_OctetString_talloc(msg, data, &r->dn); 1152 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(0))) { 1153 int pwlen; 1154 r->creds.password = ""; 1155 r->mechanism = LDAP_AUTH_MECH_SIMPLE; 1156 asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(0)); 1157 pwlen = asn1_tag_remaining(data); 1158 if (pwlen == -1) { 1159 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR); 1160 } 1161 if (pwlen != 0) { 1162 char *pw = talloc_array(msg, char, pwlen+1); 1163 if (!pw) { 1164 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); 1165 } 1166 asn1_read(data, pw, pwlen); 1167 pw[pwlen] = '\0'; 1168 r->creds.password = pw; 1169 } 1170 asn1_end_tag(data); 1171 } else if (asn1_peek_tag(data, ASN1_CONTEXT(3))){ 1172 asn1_start_tag(data, ASN1_CONTEXT(3)); 1173 r->mechanism = LDAP_AUTH_MECH_SASL; 1174 asn1_read_OctetString_talloc(msg, data, &r->creds.SASL.mechanism); 1175 if (asn1_peek_tag(data, ASN1_OCTET_STRING)) { /* optional */ 1176 DATA_BLOB tmp_blob = data_blob(NULL, 0); 1177 asn1_read_OctetString(data, msg, &tmp_blob); 1178 r->creds.SASL.secblob = talloc(msg, DATA_BLOB); 1179 if (!r->creds.SASL.secblob) { 1180 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); 1181 } 1182 *r->creds.SASL.secblob = data_blob_talloc(r->creds.SASL.secblob, 1183 tmp_blob.data, tmp_blob.length); 1184 data_blob_free(&tmp_blob); 1185 } else { 1186 r->creds.SASL.secblob = NULL; 1187 } 1188 asn1_end_tag(data); 1189 } else { 1190 /* Neither Simple nor SASL bind */ 1191 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR); 1192 } 1193 asn1_end_tag(data); 1194 break; 1195 } 1196 1197 case ASN1_APPLICATION(LDAP_TAG_BindResponse): { 1198 struct ldap_BindResponse *r = &msg->r.BindResponse; 1199 msg->type = LDAP_TAG_BindResponse; 1200 asn1_start_tag(data, tag); 1201 ldap_decode_response(msg, data, &r->response); 1202 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(7))) { 1203 DATA_BLOB tmp_blob = data_blob(NULL, 0); 1204 asn1_read_ContextSimple(data, 7, &tmp_blob); 1205 r->SASL.secblob = talloc(msg, DATA_BLOB); 1206 if (!r->SASL.secblob) { 1207 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); 1208 } 1209 *r->SASL.secblob = data_blob_talloc(r->SASL.secblob, 1210 tmp_blob.data, tmp_blob.length); 1211 data_blob_free(&tmp_blob); 1212 } else { 1213 r->SASL.secblob = NULL; 1214 } 1215 asn1_end_tag(data); 1216 break; 1217 } 1218 1219 case ASN1_APPLICATION_SIMPLE(LDAP_TAG_UnbindRequest): { 1220 msg->type = LDAP_TAG_UnbindRequest; 1221 asn1_start_tag(data, tag); 1222 asn1_end_tag(data); 1223 break; 1224 } 1225 1226 case ASN1_APPLICATION(LDAP_TAG_SearchRequest): { 1227 struct ldap_SearchRequest *r = &msg->r.SearchRequest; 1228 int sizelimit, timelimit; 1229 const char **attrs = NULL; 1230 msg->type = LDAP_TAG_SearchRequest; 1231 asn1_start_tag(data, tag); 1232 asn1_read_OctetString_talloc(msg, data, &r->basedn); 1233 asn1_read_enumerated(data, (int *)(void *)&(r->scope)); 1234 asn1_read_enumerated(data, (int *)(void *)&(r->deref)); 1235 asn1_read_Integer(data, &sizelimit); 1236 r->sizelimit = sizelimit; 1237 asn1_read_Integer(data, &timelimit); 1238 r->timelimit = timelimit; 1239 asn1_read_BOOLEAN(data, &r->attributesonly); 1240 1241 r->tree = ldap_decode_filter_tree(msg, data); 1242 if (r->tree == NULL) { 1243 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR); 1244 } 1245 1246 asn1_start_tag(data, ASN1_SEQUENCE(0)); 1247 1248 r->num_attributes = 0; 1249 r->attributes = NULL; 1250 1251 while (asn1_tag_remaining(data) > 0) { 1252 1253 const char *attr; 1254 if (!asn1_read_OctetString_talloc(msg, data, 1255 &attr)) 1256 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR); 1257 if (!add_string_to_array(msg, attr, 1258 &attrs, 1259 &r->num_attributes)) 1260 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR); 1261 } 1262 r->attributes = attrs; 1263 1264 asn1_end_tag(data); 1265 asn1_end_tag(data); 1266 break; 1267 } 1268 1269 case ASN1_APPLICATION(LDAP_TAG_SearchResultEntry): { 1270 struct ldap_SearchResEntry *r = &msg->r.SearchResultEntry; 1271 msg->type = LDAP_TAG_SearchResultEntry; 1272 r->attributes = NULL; 1273 r->num_attributes = 0; 1274 asn1_start_tag(data, tag); 1275 asn1_read_OctetString_talloc(msg, data, &r->dn); 1276 ldap_decode_attribs(msg, data, &r->attributes, 1277 &r->num_attributes); 1278 asn1_end_tag(data); 1279 break; 1280 } 1281 1282 case ASN1_APPLICATION(LDAP_TAG_SearchResultDone): { 1283 struct ldap_Result *r = &msg->r.SearchResultDone; 1284 msg->type = LDAP_TAG_SearchResultDone; 1285 asn1_start_tag(data, tag); 1286 ldap_decode_response(msg, data, r); 1287 asn1_end_tag(data); 1288 break; 1289 } 1290 1291 case ASN1_APPLICATION(LDAP_TAG_SearchResultReference): { 1292 struct ldap_SearchResRef *r = &msg->r.SearchResultReference; 1293 msg->type = LDAP_TAG_SearchResultReference; 1294 asn1_start_tag(data, tag); 1295 asn1_read_OctetString_talloc(msg, data, &r->referral); 1296 asn1_end_tag(data); 1297 break; 1298 } 1299 1300 case ASN1_APPLICATION(LDAP_TAG_ModifyRequest): { 1301 struct ldap_ModifyRequest *r = &msg->r.ModifyRequest; 1302 msg->type = LDAP_TAG_ModifyRequest; 1303 asn1_start_tag(data, ASN1_APPLICATION(LDAP_TAG_ModifyRequest)); 1304 asn1_read_OctetString_talloc(msg, data, &r->dn); 1305 asn1_start_tag(data, ASN1_SEQUENCE(0)); 1306 1307 r->num_mods = 0; 1308 r->mods = NULL; 1309 1310 while (asn1_tag_remaining(data) > 0) { 1311 struct ldap_mod mod; 1312 int v; 1313 ZERO_STRUCT(mod); 1314 asn1_start_tag(data, ASN1_SEQUENCE(0)); 1315 asn1_read_enumerated(data, &v); 1316 mod.type = v; 1317 ldap_decode_attrib(msg, data, &mod.attrib); 1318 asn1_end_tag(data); 1319 if (!add_mod_to_array_talloc(msg, &mod, 1320 &r->mods, &r->num_mods)) { 1321 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); 1322 } 1323 } 1324 1325 asn1_end_tag(data); 1326 asn1_end_tag(data); 1327 break; 1328 } 1329 1330 case ASN1_APPLICATION(LDAP_TAG_ModifyResponse): { 1331 struct ldap_Result *r = &msg->r.ModifyResponse; 1332 msg->type = LDAP_TAG_ModifyResponse; 1333 asn1_start_tag(data, tag); 1334 ldap_decode_response(msg, data, r); 1335 asn1_end_tag(data); 1336 break; 1337 } 1338 1339 case ASN1_APPLICATION(LDAP_TAG_AddRequest): { 1340 struct ldap_AddRequest *r = &msg->r.AddRequest; 1341 msg->type = LDAP_TAG_AddRequest; 1342 asn1_start_tag(data, tag); 1343 asn1_read_OctetString_talloc(msg, data, &r->dn); 1344 1345 r->attributes = NULL; 1346 r->num_attributes = 0; 1347 ldap_decode_attribs(msg, data, &r->attributes, 1348 &r->num_attributes); 1349 1350 asn1_end_tag(data); 1351 break; 1352 } 1353 1354 case ASN1_APPLICATION(LDAP_TAG_AddResponse): { 1355 struct ldap_Result *r = &msg->r.AddResponse; 1356 msg->type = LDAP_TAG_AddResponse; 1357 asn1_start_tag(data, tag); 1358 ldap_decode_response(msg, data, r); 1359 asn1_end_tag(data); 1360 break; 1361 } 1362 1363 case ASN1_APPLICATION_SIMPLE(LDAP_TAG_DelRequest): { 1364 struct ldap_DelRequest *r = &msg->r.DelRequest; 1365 int len; 1366 char *dn; 1367 msg->type = LDAP_TAG_DelRequest; 1368 asn1_start_tag(data, 1369 ASN1_APPLICATION_SIMPLE(LDAP_TAG_DelRequest)); 1370 len = asn1_tag_remaining(data); 1371 if (len == -1) { 1372 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR); 1373 } 1374 dn = talloc_array(msg, char, len+1); 1375 if (dn == NULL) 1376 break; 1377 asn1_read(data, dn, len); 1378 dn[len] = '\0'; 1379 r->dn = dn; 1380 asn1_end_tag(data); 1381 break; 1382 } 1383 1384 case ASN1_APPLICATION(LDAP_TAG_DelResponse): { 1385 struct ldap_Result *r = &msg->r.DelResponse; 1386 msg->type = LDAP_TAG_DelResponse; 1387 asn1_start_tag(data, tag); 1388 ldap_decode_response(msg, data, r); 1389 asn1_end_tag(data); 1390 break; 1391 } 1392 1393 case ASN1_APPLICATION(LDAP_TAG_ModifyDNRequest): { 1394 struct ldap_ModifyDNRequest *r = &msg->r.ModifyDNRequest; 1395 msg->type = LDAP_TAG_ModifyDNRequest; 1396 asn1_start_tag(data, 1397 ASN1_APPLICATION(LDAP_TAG_ModifyDNRequest)); 1398 asn1_read_OctetString_talloc(msg, data, &r->dn); 1399 asn1_read_OctetString_talloc(msg, data, &r->newrdn); 1400 asn1_read_BOOLEAN(data, &r->deleteolddn); 1401 r->newsuperior = NULL; 1402 if (asn1_tag_remaining(data) > 0) { 1403 int len; 1404 char *newsup; 1405 asn1_start_tag(data, ASN1_CONTEXT_SIMPLE(0)); 1406 len = asn1_tag_remaining(data); 1407 if (len == -1) { 1408 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR); 1409 } 1410 newsup = talloc_array(msg, char, len+1); 1411 if (newsup == NULL) { 1412 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); 1413 } 1414 asn1_read(data, newsup, len); 1415 newsup[len] = '\0'; 1416 r->newsuperior = newsup; 1417 asn1_end_tag(data); 1418 } 1419 asn1_end_tag(data); 1420 break; 1421 } 1422 1423 case ASN1_APPLICATION(LDAP_TAG_ModifyDNResponse): { 1424 struct ldap_Result *r = &msg->r.ModifyDNResponse; 1425 msg->type = LDAP_TAG_ModifyDNResponse; 1426 asn1_start_tag(data, tag); 1427 ldap_decode_response(msg, data, r); 1428 asn1_end_tag(data); 1429 break; 1430 } 1431 1432 case ASN1_APPLICATION(LDAP_TAG_CompareRequest): { 1433 struct ldap_CompareRequest *r = &msg->r.CompareRequest; 1434 msg->type = LDAP_TAG_CompareRequest; 1435 asn1_start_tag(data, 1436 ASN1_APPLICATION(LDAP_TAG_CompareRequest)); 1437 asn1_read_OctetString_talloc(msg, data, &r->dn); 1438 asn1_start_tag(data, ASN1_SEQUENCE(0)); 1439 asn1_read_OctetString_talloc(msg, data, &r->attribute); 1440 asn1_read_OctetString(data, msg, &r->value); 1441 if (r->value.data) { 1442 talloc_steal(msg, r->value.data); 1443 } 1444 asn1_end_tag(data); 1445 asn1_end_tag(data); 1446 break; 1447 } 1448 1449 case ASN1_APPLICATION(LDAP_TAG_CompareResponse): { 1450 struct ldap_Result *r = &msg->r.CompareResponse; 1451 msg->type = LDAP_TAG_CompareResponse; 1452 asn1_start_tag(data, tag); 1453 ldap_decode_response(msg, data, r); 1454 asn1_end_tag(data); 1455 break; 1456 } 1457 1458 case ASN1_APPLICATION_SIMPLE(LDAP_TAG_AbandonRequest): { 1459 struct ldap_AbandonRequest *r = &msg->r.AbandonRequest; 1460 msg->type = LDAP_TAG_AbandonRequest; 1461 asn1_start_tag(data, tag); 1462 asn1_read_implicit_Integer(data, &r->messageid); 1463 asn1_end_tag(data); 1464 break; 1465 } 1466 1467 case ASN1_APPLICATION(LDAP_TAG_ExtendedRequest): { 1468 struct ldap_ExtendedRequest *r = &msg->r.ExtendedRequest; 1469 DATA_BLOB tmp_blob = data_blob(NULL, 0); 1470 1471 msg->type = LDAP_TAG_ExtendedRequest; 1472 asn1_start_tag(data,tag); 1473 if (!asn1_read_ContextSimple(data, 0, &tmp_blob)) { 1474 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR); 1475 } 1476 r->oid = blob2string_talloc(msg, tmp_blob); 1477 data_blob_free(&tmp_blob); 1478 if (!r->oid) { 1479 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); 1480 } 1481 1482 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(1))) { 1483 asn1_read_ContextSimple(data, 1, &tmp_blob); 1484 r->value = talloc(msg, DATA_BLOB); 1485 if (!r->value) { 1486 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); 1487 } 1488 *r->value = data_blob_talloc(r->value, tmp_blob.data, tmp_blob.length); 1489 data_blob_free(&tmp_blob); 1490 } else { 1491 r->value = NULL; 1492 } 1493 1494 asn1_end_tag(data); 1495 break; 1496 } 1497 1498 case ASN1_APPLICATION(LDAP_TAG_ExtendedResponse): { 1499 struct ldap_ExtendedResponse *r = &msg->r.ExtendedResponse; 1500 DATA_BLOB tmp_blob = data_blob(NULL, 0); 1501 1502 msg->type = LDAP_TAG_ExtendedResponse; 1503 asn1_start_tag(data, tag); 1504 ldap_decode_response(msg, data, &r->response); 1505 1506 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(10))) { 1507 asn1_read_ContextSimple(data, 1, &tmp_blob); 1508 r->oid = blob2string_talloc(msg, tmp_blob); 1509 data_blob_free(&tmp_blob); 1510 if (!r->oid) { 1511 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); 1512 } 1513 } else { 1514 r->oid = NULL; 1515 } 1516 1517 if (asn1_peek_tag(data, ASN1_CONTEXT_SIMPLE(11))) { 1518 asn1_read_ContextSimple(data, 1, &tmp_blob); 1519 r->value = talloc(msg, DATA_BLOB); 1520 if (!r->value) { 1521 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); 1522 } 1523 *r->value = data_blob_talloc(r->value, tmp_blob.data, tmp_blob.length); 1524 data_blob_free(&tmp_blob); 1525 } else { 1526 r->value = NULL; 1527 } 1528 1529 asn1_end_tag(data); 1530 break; 1531 } 1532 default: 1533 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR); 1534 } 1535 1536 msg->controls = NULL; 1537 msg->controls_decoded = NULL; 1538 1539 if (asn1_peek_tag(data, ASN1_CONTEXT(0))) { 1540 int i = 0; 1541 struct ldb_control **ctrl = NULL; 1542 bool *decoded = NULL; 1543 1544 asn1_start_tag(data, ASN1_CONTEXT(0)); 1545 1546 while (asn1_peek_tag(data, ASN1_SEQUENCE(0))) { 1547 DATA_BLOB value; 1548 /* asn1_start_tag(data, ASN1_SEQUENCE(0)); */ 1549 1550 ctrl = talloc_realloc(msg, ctrl, struct ldb_control *, i+2); 1551 if (!ctrl) { 1552 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); 1553 } 1554 1555 decoded = talloc_realloc(msg, decoded, bool, i+1); 1556 if (!decoded) { 1557 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); 1558 } 1559 1560 ctrl[i] = talloc(ctrl, struct ldb_control); 1561 if (!ctrl[i]) { 1562 return NT_STATUS_LDAP(LDAP_OPERATIONS_ERROR); 1563 } 1564 1565 if (!ldap_decode_control_wrapper(ctrl, data, ctrl[i], &value)) { 1566 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR); 1567 } 1568 1569 if (!ldap_decode_control_value(ctrl, value, 1570 control_handlers, 1571 ctrl[i])) { 1572 if (ctrl[i]->critical) { 1573 ctrl[i]->data = NULL; 1574 decoded[i] = false; 1575 i++; 1576 } else { 1577 talloc_free(ctrl[i]); 1578 ctrl[i] = NULL; 1579 } 1580 } else { 1581 decoded[i] = true; 1582 i++; 1583 } 1584 } 1585 1586 if (ctrl != NULL) { 1587 ctrl[i] = NULL; 1588 } 1589 1590 msg->controls = ctrl; 1591 msg->controls_decoded = decoded; 1592 1593 asn1_end_tag(data); 1594 } 1595 1596 asn1_end_tag(data); 1597 if ((data->has_error) || (data->nesting != NULL)) { 1598 return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR); 1599 } 1600 return NT_STATUS_OK; 1601} 1602 1603 1604/* 1605 return NT_STATUS_OK if a blob has enough bytes in it to be a full 1606 ldap packet. Set packet_size if true. 1607*/ 1608NTSTATUS ldap_full_packet(void *private_data, DATA_BLOB blob, size_t *packet_size) 1609{ 1610 return asn1_full_tag(blob, ASN1_SEQUENCE(0), packet_size); 1611} 1612