ldap server: generate correct referral schemes

Ensure that the referrals returned in a search request use the same
scheme as the request, i.e. referrals recieved via ldap are prefixed
with "ldap://" and those over ldaps are prefixed with "ldaps://"

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12478

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri May 24 05:12:14 UTC 2019 on sn-devel-184

(cherry picked from commit 1958cd8a7fb81ec51b81944ecf4dd0fb5c4208fa)

diff --git a/lib/ldb/include/ldb_module.h b/lib/ldb/include/ldb_module.h
index 6ba2a49300aacf0131d865c9336a638604af0033..c73fc37f3aa15bb3d794cc6d3ccdfca5c9cf6b21 100644 (file)
--- a/lib/ldb/include/ldb_module.h
+++ b/lib/ldb/include/ldb_module.h
@@ -103,6 +103,11 @@ struct ldb_module;
  * attributes, not to be printed in trace messages */
 #define LDB_SECRET_ATTRIBUTE_LIST_OPAQUE "LDB_SECRET_ATTRIBUTE_LIST"
 
+/*
+ * The scheme to be used for referral entries, i.e. ldap or ldaps
+ */
+#define LDAP_REFERRAL_SCHEME_OPAQUE "LDAP_REFERRAL_SCHEME"
+
 /*
    these function pointers define the operations that a ldb module can intercept
 */

diff --git a/selftest/knownfail.d/ldap_referrals b/selftest/knownfail.d/ldap_referrals
deleted file mode 100644 (file)
index 403f0d3..0000000
--- a/selftest/knownfail.d/ldap_referrals
+++ /dev/null
@@ -1 +0,0 @@
-^samba.ldap.referrals.samba.tests.ldap_referrals.LdapReferralTest.test_ldaps_search

diff --git a/source4/dsdb/samdb/ldb_modules/partition.c b/source4/dsdb/samdb/ldb_modules/partition.c
index 49bdeb04fa51d1b20acfa7d5ac91faf648c51c27..f66ccab1dd56d3de7c1c0da6e605e5276603da67 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/partition.c
+++ b/source4/dsdb/samdb/ldb_modules/partition.c
@@ -902,11 +902,17 @@ static int partition_search(struct ldb_module *module, struct ldb_request *req)
                                                 data->partitions[i]->ctrl->dn) == 0) &&
                            (ldb_dn_compare(req->op.search.base,
                                            data->partitions[i]->ctrl->dn) != 0)) {
-                               char *ref = talloc_asprintf(ac,
-                                                           "ldap://%s/%s%s",
-                                                           lpcfg_dnsdomain(lp_ctx),
-                                                           ldb_dn_get_linearized(data->partitions[i]->ctrl->dn),
-                                                           req->op.search.scope == LDB_SCOPE_ONELEVEL ? "??base" : "");
+                               const char *scheme = ldb_get_opaque(
+                                   ldb, LDAP_REFERRAL_SCHEME_OPAQUE);
+                               char *ref = talloc_asprintf(
+                                       ac,
+                                       "%s://%s/%s%s",
+                                       scheme == NULL ? "ldap" : scheme,
+                                       lpcfg_dnsdomain(lp_ctx),
+                                       ldb_dn_get_linearized(
+                                           data->partitions[i]->ctrl->dn),
+                                       req->op.search.scope ==
+                                           LDB_SCOPE_ONELEVEL ? "??base" : "");
 
                                if (ref == NULL) {
                                        return ldb_oom(ldb);

diff --git a/source4/ldap_server/ldap_backend.c b/source4/ldap_server/ldap_backend.c
index 39f1aa2a2a6248af2175adcacd510b577d6e3fbd..573472c0f7f74afaa324e4daa0ecaa8d9a4f1077 100644 (file)
--- a/source4/ldap_server/ldap_backend.c
+++ b/source4/ldap_server/ldap_backend.c
@@ -647,6 +647,24 @@ static NTSTATUS ldapsrv_SearchRequest(struct ldapsrv_call *call)
                call->notification.busy = true;
        }
 
+       {
+               const char *scheme = NULL;
+               switch (call->conn->referral_scheme) {
+               case LDAP_REFERRAL_SCHEME_LDAPS:
+                       scheme = "ldaps";
+                       break;
+               default:
+                       scheme = "ldap";
+               }
+               ldb_ret = ldb_set_opaque(
+                       samdb,
+                       LDAP_REFERRAL_SCHEME_OPAQUE,
+                       discard_const_p(char *, scheme));
+               if (ldb_ret != LDB_SUCCESS) {
+                       goto reply;
+               }
+       }
+
        ldb_set_timeout(samdb, lreq, req->timelimit);
 
        if (!call->conn->is_privileged) {

diff --git a/source4/ldap_server/ldap_server.c b/source4/ldap_server/ldap_server.c
index bc2f54bc14615ae6581836117b7a5b0f8ea8da69..9599e0dacac2a9113d88381e3a560a7f2a3cbe71 100644 (file)
--- a/source4/ldap_server/ldap_server.c
+++ b/source4/ldap_server/ldap_server.c
@@ -436,6 +436,7 @@ static void ldapsrv_accept_tls_done(struct tevent_req *subreq)
        }
 
        conn->sockets.active = conn->sockets.tls;
+       conn->referral_scheme = LDAP_REFERRAL_SCHEME_LDAPS;
        ldapsrv_call_read_next(conn);
 }
 

diff --git a/source4/ldap_server/ldap_server.h b/source4/ldap_server/ldap_server.h
index d3e31fb1eec175fe21307f0853e271d688bfdbf8..5b944f5ab9b1e3494aec8f0f42af01acfafff926 100644 (file)
--- a/source4/ldap_server/ldap_server.h
+++ b/source4/ldap_server/ldap_server.h
@@ -24,6 +24,11 @@
 #include "system/network.h"
 #include "lib/param/loadparm.h"
 
+enum ldap_server_referral_scheme {
+       LDAP_REFERRAL_SCHEME_LDAP,
+       LDAP_REFERRAL_SCHEME_LDAPS
+};
+
 struct ldapsrv_connection {
        struct ldapsrv_connection *next, *prev;
        struct loadparm_context *lp_ctx;
@@ -47,6 +52,7 @@ struct ldapsrv_connection {
        bool is_privileged;
        enum ldap_server_require_strong_auth require_strong_auth;
        bool authz_logged;
+       enum ldap_server_referral_scheme referral_scheme;
 
        struct {
                int initial_timeout;