samldb.c

samba最新软件

	if (!msg2) {
		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
		talloc_free(mem_ctx);
		return LDB_ERR_OPERATIONS_ERROR;
	}

	ret = samdb_copy_template(module->ldb, msg2, 
				  "group",
				  &errstr);
	if (ret != 0) {
		
		talloc_free(mem_ctx);
		return ret;
	}

	rdn_name = ldb_dn_get_rdn_name(msg2->dn);

	if (strcasecmp(rdn_name, "cn") != 0) {
		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad RDN (%s) for group!\n", rdn_name);
		talloc_free(mem_ctx);
		return LDB_ERR_CONSTRAINT_VIOLATION;
	}

	ret = samdb_search_for_parent_domain(module->ldb, mem_ctx, msg2->dn, &dom_dn, &errstr);
	if (ret != LDB_SUCCESS) {
		ldb_asprintf_errstring(module->ldb,
				       "samldb_fill_group_object: %s", errstr);
		return ret;
	}

	/* Generate a random name, if no samAccountName was supplied */
	if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
		ret = samldb_generate_samAccountName(module, mem_ctx, dom_dn, &name);
		if (ret != LDB_SUCCESS) {
			talloc_free(mem_ctx);
			return ret;
		}
		ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
		if (ret) {
			talloc_free(mem_ctx);
			return ret;
		}
	}
	
	if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
		ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
		talloc_free(mem_ctx);
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}
	group_type = samdb_result_uint(msg2, "groupType", 0);
	if (group_type == 0) {
		ldb_asprintf_errstring(module->ldb, "groupType invalid");
		talloc_free(mem_ctx);
		return LDB_ERR_UNWILLING_TO_PERFORM;
	} else {
		unsigned int account_type = samdb_gtype2atype(group_type);
		ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
					 "sAMAccountType",
					 account_type);
		if (ret != LDB_SUCCESS) {
			return ret;
		}
	}

	/* Manage SID allocation, conflicts etc */
	ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn); 

	if (ret == LDB_SUCCESS) {
		talloc_steal(msg, msg2);
		*ret_msg = msg2;
	}
	talloc_free(mem_ctx);
	return ret;
}

static int samldb_fill_user_or_computer_object(struct ldb_module *module, const struct ldb_message *msg, struct ldb_message **ret_msg)
{
	int ret;
	char *name;
	struct ldb_message *msg2;
	struct ldb_dn *dom_dn;
	const char *rdn_name;
	TALLOC_CTX *mem_ctx = talloc_new(msg);
	const char *errstr;
	unsigned int user_account_control;
	if (!mem_ctx) {
		return LDB_ERR_OPERATIONS_ERROR;
	}

	/* build the new msg */
	msg2 = ldb_msg_copy(mem_ctx, msg);
	if (!msg2) {
		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: ldb_msg_copy failed!\n");
		talloc_free(mem_ctx);
		return LDB_ERR_OPERATIONS_ERROR;
	}

	ret = samdb_copy_template(module->ldb, msg2, 
				  "user",
				  &errstr);
	if (ret) {
		ldb_asprintf_errstring(module->ldb, 
				       "samldb_fill_user_or_computer_object: Error copying user template: %s\n",
				       errstr);
		talloc_free(mem_ctx);
		return ret;
	}

	rdn_name = ldb_dn_get_rdn_name(msg2->dn);

	if (strcasecmp(rdn_name, "cn") != 0) {
		ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for user/computer, should be CN=!\n", rdn_name);
		talloc_free(mem_ctx);
		return LDB_ERR_CONSTRAINT_VIOLATION;
	}

	ret = samdb_search_for_parent_domain(module->ldb, mem_ctx, msg2->dn, &dom_dn, &errstr);
	if (ret != LDB_SUCCESS) {
		ldb_asprintf_errstring(module->ldb,
				       "samldb_fill_user_or_computer_object: %s", errstr);
		return ret;
	}

	if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
		ret = samldb_generate_samAccountName(module, mem_ctx, dom_dn, &name);
		if (ret != LDB_SUCCESS) {
			talloc_free(mem_ctx);
			return ret;
		}
		ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
		if (ret) {
			talloc_free(mem_ctx);
			return ret;
		}
	}

	if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
		ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
		talloc_free(mem_ctx);
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}
	user_account_control = samdb_result_uint(msg2, "userAccountControl", 0);
	if (user_account_control == 0) {
		ldb_asprintf_errstring(module->ldb, "userAccountControl invalid");
		talloc_free(mem_ctx);
		return LDB_ERR_UNWILLING_TO_PERFORM;
	} else {
		unsigned int account_type = samdb_uf2atype(user_account_control);
		ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
					 "sAMAccountType",
					 account_type);
		if (ret != LDB_SUCCESS) {
			return ret;
		}
	}

	/* Manage SID allocation, conflicts etc */
	ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn); 

	/* TODO: userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */

	if (ret == 0) {
		*ret_msg = msg2;
		talloc_steal(msg, msg2);
	}
	talloc_free(mem_ctx);
	return ret;
}
	
static int samldb_fill_foreignSecurityPrincipal_object(struct ldb_module *module, const struct ldb_message *msg, 
						       struct ldb_message **ret_msg)
{
	struct ldb_message *msg2;
	const char *rdn_name;
	struct dom_sid *dom_sid;
	struct dom_sid *sid;
	const char *dom_attrs[] = { "name", NULL };
	struct ldb_message **dom_msgs;
	const char *errstr;
	int ret;

	TALLOC_CTX *mem_ctx = talloc_new(msg);
	if (!mem_ctx) {
		return LDB_ERR_OPERATIONS_ERROR;
	}

	/* build the new msg */
	msg2 = ldb_msg_copy(mem_ctx, msg);
	if (!msg2) {
		ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: ldb_msg_copy failed!\n");
		talloc_free(mem_ctx);
		return LDB_ERR_OPERATIONS_ERROR;
	}

	ret = samdb_copy_template(module->ldb, msg2, 
				  "ForeignSecurityPrincipal",
				  &errstr);
	if (ret != 0) {
		ldb_asprintf_errstring(module->ldb, 
				       "samldb_fill_foreignSecurityPrincipal_object: "
				       "Error copying template: %s",
				    errstr);
		talloc_free(mem_ctx);
		return ret;
	}

	rdn_name = ldb_dn_get_rdn_name(msg2->dn);

	if (strcasecmp(rdn_name, "cn") != 0) {
		ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for ForeignSecurityPrincipal, should be CN=!", rdn_name);
		talloc_free(mem_ctx);
		return LDB_ERR_CONSTRAINT_VIOLATION;
	}

	sid = samdb_result_dom_sid(msg2, msg, "objectSid");
	if (!sid) {
		/* Slightly different for the foreign sids.  We don't want
		 * domain SIDs ending up there, it would cause all sorts of
		 * pain */

		sid = dom_sid_parse_talloc(msg2, (const char *)ldb_dn_get_rdn_val(msg2->dn)->data);
		if (!sid) {
			ldb_set_errstring(module->ldb, "No valid found SID in ForeignSecurityPrincipal CN!");
			talloc_free(mem_ctx);
			return LDB_ERR_CONSTRAINT_VIOLATION;
		}

		if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
			talloc_free(sid);
			return LDB_ERR_OPERATIONS_ERROR;
		}

		dom_sid = dom_sid_dup(mem_ctx, sid);
		if (!dom_sid) {
			talloc_free(mem_ctx);
			return LDB_ERR_OPERATIONS_ERROR;
		}
		/* get the domain component part of the provided SID */
		dom_sid->num_auths--;

		/* find the domain DN */

		ret = gendb_search(module->ldb,
				   mem_ctx, NULL, &dom_msgs, dom_attrs,
				   "(&(objectSid=%s)(objectclass=domain))",
				   ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
		if (ret >= 1) {
			/* We don't really like the idea of foreign sids that are not foreign, but it happens */
			const char *name = samdb_result_string(dom_msgs[0], "name", NULL);
			ldb_debug(module->ldb, LDB_DEBUG_TRACE, "NOTE (strange but valid): Adding foreign SID record with SID %s, but this domian (%s) is already in the database", 
				  dom_sid_string(mem_ctx, sid), name); 
		} else if (ret == -1) {
			ldb_asprintf_errstring(module->ldb,
						"samldb_fill_foreignSecurityPrincipal_object: error searching for a domain with this sid: %s\n", 
						dom_sid_string(mem_ctx, dom_sid));
			talloc_free(dom_msgs);
			return LDB_ERR_OPERATIONS_ERROR;
		}
	}

	/* This isn't an operation on a domain we know about, so just
	 * check for the SID, looking for duplicates via the common
	 * code */
	ret = samldb_notice_sid(module, msg2, sid);
	if (ret == 0) {
		talloc_steal(msg, msg2);
		*ret_msg = msg2;
	}
	
	return ret;
}

/* add_record */

/*
 * FIXME
 *
 * Actually this module is not async at all as it does a number of sync searches
 * in the process. It still to be decided how to deal with it properly so it is
 * left SYNC for now until we think of a good solution.
 */

static int samldb_add(struct ldb_module *module, struct ldb_request *req)
{
	const struct ldb_message *msg = req->op.add.message;
	struct ldb_message *msg2 = NULL;
	struct ldb_request *down_req;
	int ret;

	ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_add_record\n");

	if (ldb_dn_is_special(msg->dn)) { /* do not manipulate our control entries */
		return ldb_next_request(module, req);
	}

	/* is user or computer? */
	if ((samdb_find_attribute(module->ldb, msg, "objectclass", "user") != NULL) || 
	    (samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL)) {
		/*  add all relevant missing objects */
		ret = samldb_fill_user_or_computer_object(module, msg, &msg2);
		if (ret) {
			return ret;
		}
	}

	/* is group? add all relevant missing objects */
	if ( ! msg2 ) {
		if (samdb_find_attribute(module->ldb, msg, "objectclass", "group") != NULL) {
			ret = samldb_fill_group_object(module, msg, &msg2);
			if (ret) {
				return ret;
			}
		}
	}

	/* perhaps a foreignSecurityPrincipal? */
	if ( ! msg2 ) {
		if (samdb_find_attribute(module->ldb, msg, "objectclass", "foreignSecurityPrincipal") != NULL) {
			ret = samldb_fill_foreignSecurityPrincipal_object(module, msg, &msg2);
			if (ret) {
				return ret;
			}
		}
	}

	if (msg2 == NULL) {
		return ldb_next_request(module, req);
	}

	down_req = talloc(req, struct ldb_request);
	if (down_req == NULL) {
		return LDB_ERR_OPERATIONS_ERROR;
	}

	*down_req = *req;
	
	down_req->op.add.message = talloc_steal(down_req, msg2);

	ldb_set_timeout_from_prev_req(module->ldb, req, down_req);

	/* go on with the call chain */
	ret = ldb_next_request(module, down_req);

	/* do not free down_req as the call results may be linked to it,
	 * it will be freed when the upper level request get freed */
	if (ret == LDB_SUCCESS) {
		req->handle = down_req->handle;
	}

	return ret;
}

/* modify */
static int samldb_modify(struct ldb_module *module, struct ldb_request *req)
{
	struct ldb_message *msg;
	struct ldb_message_element *el, *el2;
	int ret;
	unsigned int group_type, user_account_control, account_type;
	if (ldb_msg_find_element(req->op.mod.message, "sAMAccountType") != NULL) {
		ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
		return LDB_ERR_UNWILLING_TO_PERFORM;
	}

	el = ldb_msg_find_element(req->op.mod.message, "groupType");
	if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
		req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);

		group_type = strtoul((const char *)el->values[0].data, NULL, 0);
		account_type =  samdb_gtype2atype(group_type);
		ret = samdb_msg_add_uint(module->ldb, msg, msg,
					 "sAMAccountType",
					 account_type);
		if (ret != LDB_SUCCESS) {
			return ret;
		}
		el2 = ldb_msg_find_element(msg, "sAMAccountType");
		el2->flags = LDB_FLAG_MOD_REPLACE;
	}

	el = ldb_msg_find_element(req->op.mod.message, "userAccountControl");
	if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
		req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);

		user_account_control = strtoul((const char *)el->values[0].data, NULL, 0);
		account_type = samdb_uf2atype(user_account_control);
		ret = samdb_msg_add_uint(module->ldb, msg, msg,
					 "sAMAccountType",
					 account_type);
		if (ret != LDB_SUCCESS) {
			return ret;
		}
		el2 = ldb_msg_find_element(msg, "sAMAccountType");
		el2->flags = LDB_FLAG_MOD_REPLACE;
	}
	return ldb_next_request(module, req);
}


static int samldb_init(struct ldb_module *module)
{
	return ldb_next_init(module);
}

_PUBLIC_ const struct ldb_module_ops ldb_samldb_module_ops = {
	.name          = "samldb",
	.init_context  = samldb_init,
	.add           = samldb_add,
	.modify        = samldb_modify
};