summaryrefslogtreecommitdiff
path: root/lib/ldb/include/ldb.h
AgeCommit message (Collapse)AuthorFilesLines
2026-01-15ldb: add "policy hints" controls to be used by password_hash moduleDouglas Bagnall1-0/+30
These won't have any effect yet, but soon they will allow a privileged account to perform a password reset that respects constraints on password history, age, and length, as if the reset was an ordinary password change (that is, where the user provides the old password). A normal user can't reset their own password using this, if the organisation is using a remote service (e.g. Entra ID or Keycloak) to manage passwords, that service can use a policy hints control to ensure it follows AD password policy. Entra ID Self Service Password Reset (SSPR) uses the deprecated OID. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12020 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2025-03-05ldb: remove unused sqlite backendDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz> Reviewed-by: Martin Schwenke <mschwenke@ddn.com>
2024-06-11ldb: Attach appropriate ldb context to returned resultJo Sutton1-0/+3
This is done by adding a new API that avoids the problems of ldb_dn_copy() and makes it clear that a struct ldb_context * pointer will be stored in the new copy. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-06-10ldb_wrap: Provide a way to avoid Samba using ldb_wrap()Andrew Bartlett1-0/+6
ldb_wrap is a caching mechansim, and it should probably be removed but for now provide a way to avoid it in specific cases where we know it is harmful. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
2024-05-23ldb: move struct ldb_debug_ops to ldb_private.hDouglas Bagnall1-11/+0
Only accessed through struct ldb_context -> debug_ops, which is already private. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu May 23 00:19:30 UTC 2024 on atb-devel-224
2024-05-22ldb: move struct ldb_utf8_fns to ldb_private.hDouglas Bagnall1-10/+0
It is only accessed via ldb functions that find it on the already-private struct ldb_context. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-22ldb: deprecate ldb_set_utf8_fnsDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-22ldb: add ldb_set_utf8_functions() for setting casefold functionsDouglas Bagnall1-4/+28
This replaces ldb_set_utf8_fns(), which will be deprecated really soon. The reason for this, as shown in surrounding commits, is that without an explicit case-insensitive comparison we need to rely on the casefold, and if the casefold can fail (because, e.g. bad utf-8) the comparison ends up being a bit chaotic. The strings being compared are generally user controlled, and a malicious user might find ways of hiding values or perhaps fooling a binary search. A case-insensitive comparisons that works gradually through the string without an all-at-once casefold is better placed to deal with problems where they happen, and we are able to separately specialise for the ASCII case (used by SSSD) and the UTF-8 case (Samba). Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-05-22ldb: add a utf-8 comparison fold callbackDouglas Bagnall1-0/+1
This isn't used yet, but it will allow library users to select a case-insensitive comparison function that matches their chosen casefold. This will allow the comparisons to be consistent when the strings are bad, whereas currently we kind of guess. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-04-10ldb: add NUMERIC_CMP macro to ldb.hDouglas Bagnall1-0/+16
In other places we tend to include tsort.h, which also has TYPESAFE_QSORT. ldb.h already has TYPESAFE_QSORT, so it might as well have NUMERIC_CMP. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15625 Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16ldb: Split out ldb_controls_get_control() to search a list of controlsJo Sutton1-0/+9
Update the ldb ABI accordingly. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-16ldb: Correct copy‐and‐pasted commentsJo Sutton1-2/+2
These comments refer to controls being added, but in these functions the controls are actually being *searched* for. Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2024-02-08ldb: Fix code spellingJo Sutton1-6/+6
Signed-off-by: Jo Sutton <josutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-21ldb: Fix code spellingJoseph Sutton1-1/+1
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-12-08ldb: Fix code spellingJoseph Sutton1-3/+3
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-09-11ldb: Fix code spellingJoseph Sutton1-2/+2
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-08-14ldb: Fix code spellingJoseph Sutton1-5/+5
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-26ldb: Add the RFC4532 LDB_EXTENDED_WHOAMI_OID definitionVolker Lendecke1-0/+5
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2023-04-12ldb: Fix function documentation to be consistentJoseph Sutton1-12/+12
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Andreas Schneider <asn@samba.org>
2023-04-04lib:ldb:include: Fix code spellingAndreas Schneider1-4/+4
Best reviewed with: `git show --word-diff`. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2022-12-23lib:ldb: Use ldb_ascii_toupper() for case foldingAndreas Schneider1-6/+12
For example there are at least two locales (tr_TR and az_AZ) in glibc having dotless i transformation different from Latin scripts and GUID versus Guid comparison would be different there (attribute name would not match in the test). See also https://en.wikipedia.org/wiki/Dotted_and_dotless_I https://lists.samba.org/archive/samba-technical/2019-December/134659.html This fixes: LC_ALL=tr_TR.UTF-8 make test BUG: https://bugzilla.samba.org/show_bug.cgi?id=15248 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2022-10-21ldb: don't call comparison() directly in LDB_TYPESAFE_QSORTJoseph Sutton1-2/+6
The result is not used, it is only part of the macro to gain type-checking. Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2022-09-07ldb: Fix a typoVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-07-27CVE-2022-32746 ldb: Add functions for appending to an ldb_messageJoseph Sutton1-0/+24
Currently, there are many places where we use ldb_msg_add_empty() to add an empty element to a message, and then call ldb_msg_add_value() or similar to add values to that element. However, this performs an unnecessary search of the message's elements to locate the new element. Moreover, if an element with the same attribute name already exists earlier in the message, the values will be added to that element, instead of to the intended newly added element. A similar pattern exists where we add values to a message, and then call ldb_msg_find_element() to locate that message element and sets its flags to (e.g.) LDB_FLAG_MOD_REPLACE. This also performs an unnecessary search, and may locate the wrong message element for setting the flags. To avoid these problems, add functions for appending a value to a message, so that a particular value can be added to the end of a message in a single operation. For ADD requests, it is important that no two message elements share the same attribute name, otherwise things will break. (Normally, ldb_msg_normalize() is called before processing the request to help ensure this.) Thus, we must be careful not to append an attribute to an ADD message, unless we are sure (e.g. through ldb_msg_find_element()) that an existing element for that attribute is not present. These functions will be used in the next commit. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2022-07-27CVE-2022-32746 ldb: Ensure shallow copy modifications do not affect original ↵Joseph Sutton1-0/+6
message Using the newly added ldb flag, we can now detect when a message has been shallow-copied so that its elements share their values with the original message elements. Then when adding values to the copied message, we now make a copy of the shared values array first. This should prevent a use-after-free that occurred in LDB modules when new values were added to a shallow copy of a message by calling talloc_realloc() on the original values array, invalidating the 'values' pointer in the original message element. The original values pointer can later be used in the database audit logging module which logs database requests, and potentially cause a crash. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15009 Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
2021-03-17ldb.h: remove undefined async_ctx function signaturesDouglas Bagnall1-12/+0
These functions do not exist. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Jeremy Allison <jra@samba.org>
2020-08-28lib/util: remove extra safe_string.h fileMatthew DeVore1-0/+1
lib/util/safe_string.h is similar to source3/include/safe_string.h, but the former has fewer checks. It is missing bcopy, strcasecmp, and strncasecmp. Add the missing elements to lib/util/safe_string.h remove the other safe_string.h which is in the source3-specific path. To accomodate existing uses of str(n?)casecmp, add #undef lines to source files where they are used. Signed-off-by: Matthew DeVore <matvore@google.com> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Fri Aug 28 02:18:40 UTC 2020 on sn-devel-184
2020-05-24ldb: also use portable __has_attribute macro to check for attribute supportBjörn Jacke1-1/+1
Signed-off-by: Bjoern Jacke <bjacke@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-08-20ldb: Always log when the database pack format changesTim Beale1-0/+3
LDB_DEBUG_WARNING gets logged by Samba as level 2, whereas the default log level for Samba is 0. It's not really fair to the user to change the format of their database on disk and potentially not tell them. This patch adds a log with level zero (using a alias define, as this technically isn't a fatal problem). BUG: https://bugzilla.samba.org/show_bug.cgi?id=14059 Signed-off-by: Tim Beale <timbeale@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2019-07-04ldb: Try to explain the confusing overload of the LDB_FLG_MOD_* enumeration ↵Andrew Bartlett1-7/+11
and other flags Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Jul 4 03:51:58 UTC 2019 on sn-devel-184
2019-07-04ldb/ldb_ldif: add LDB_FLAG_FORCE_NO_BASE64_LDIF flagBjörn Baumbach1-0/+6
Flag is used to enforce binary encoded attribute values per attribute. Signed-off-by: Björn Baumbach <bb@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-10ldb.h: spelling of 'means'Douglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-05-10ldb.h: improve comment for LDB_ATTR_FLAG_INDEXEDDouglas Bagnall1-1/+1
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-08ldb: activating <= and >= indexing for integersAaron Haslett1-0/+6
Activating <= and >= mdb indexing in samba for int32 and int64 attributes by: 1. Adding index_format_fn to LDB_SYNTAX_SAMBA_INT32 in ldb_samba 2. Cloning the 64bit LDB_SYNTAX_INTEGER type as LDB_SYNTAX_ORDERED_INTEGER 3. Adding index_format_fn to the new type 4. Modifying LargeInteger use the new type in samba schema 5. Bumping the index version to trigger reindexing Pair-programmed-with: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2019-04-08ldb: <= and >= indexed searchingAaron Haslett1-0/+4
Full implementation of <= and >= indexed searching using iterate_range backend operation. Adds index_format_fn to ldb_schema_syntax so requires an ABI version bump. The function must be provided for any type for which <= and >= indexing is required, and must return a lexicographically ordered canonicalization of a value. This causes index entries to be written in correct order to the database, so iterate_range on the index DNs can be used. ldb_kv_index_key is modified to return an index DN with attribute name but without value if an empty value is provided. This is needed for constructing keys that match the beginning or end of an index DN range. Pair-programmed-with: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Aaron Haslett <aaronhaslett@catalyst.net.nz> Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2018-08-15ldb: Add new function ldb_dn_add_child_val()Andrew Bartlett1-0/+3
This is safer for untrusted input than ldb_dn_add_child_fmt() BUG: https://bugzilla.samba.org/show_bug.cgi?id=13466 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2017-09-07ldb: Add new ldb_ldif_message_redacted_string() with testsAndrew Bartlett1-5/+35
This is designed to be a drop in replacement for ldb_ldif_message_string() while better protecting privacy. BUG: https://bugzilla.samba.org/show_bug.cgi?id=13017 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
2017-06-15ldb.h whitespaceDouglas Bagnall1-91/+91
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-31ldb: Allow a caller (in particular Samba) to handle the list of attributes ↵Andrew Bartlett1-0/+5
with an index By doing that, Samba will use a binary search to locate the attributes rather than an O(n) search, during every search or modify of the database. Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2017-04-19ldb: Clarify LDB_MODULES_PATH is usedJakub Hrozek1-0/+4
Make it (hopefully more) clear where modules are loaded from. Signed-off-by: Jakub Hrozek <jakub.hrozek@posteo.se> Reviewed-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlet <abartlet@samba.org>
2017-03-09ldb: add LDB_FLG_DONT_CREATE_DBStefan Metzmacher1-0/+9
This avoids creating an new tdb files on ldbsearch or other callers which use LDB_FLG_DONT_CREATE_DB. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Thu Mar 9 16:02:21 CET 2017 on sn-devel-144
2016-12-01ldb: Add helper function ldb_schema_attribute_remove_flagged()Andrew Bartlett1-0/+5
This helps us avoid keeping a list of attributes to later remove on @ATTRIBUTES reload Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-12-01ldb:controls: add LDB_CONTROL_RECALCULATE_RDN_OIDStefan Metzmacher1-0/+7
This will be used by 'samba-tool dbcheck' to fix the rdn attribute name. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12399 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> (Patch reduced by Andrew Bartlett to only allocate the OID)
2016-03-09ldb controls: use uint8_t* for contextID binary blobDouglas Bagnall1-2/+2
It is never a readable string. Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz> Signed-off-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz>
2016-02-17ldb: add support for LDB_CONTROL_DIRSYNC_EXStefan Metzmacher1-0/+2
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2016-02-17ldb: add LDB_ATTR_FLAG_FORCE_BASE64_LDIF supportStefan Metzmacher1-0/+5
This can be used to force ldb_write_ldif() to use base64 for a specific attribute. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Garming Sam <garming@catalyst.net.nz> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2014-09-30ldb: fix a typo in the comment, LDB_FLAGS_MOD_xxx -> LDB_FLAG_MOD_xxxMatthieu Patou1-2/+2
Change-Id: I99ac6e272aa0f54a2720c58f630ae472068f255b Signed-off-by: Matthieu Patou <mat@matws.net> Reviewed-by: Kamen Mazdrashki <kamenim@samba.org> Autobuild-User(master): Matthieu Patou <mat@samba.org> Autobuild-Date(master): Tue Sep 30 08:19:55 CEST 2014 on sn-devel-104
2013-01-14ldb: Move doxygen comments for ldb_connect to the right placeStephen Gallagher1-13/+12
Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Mon Jan 14 16:21:02 CET 2013 on sn-devel-104
2012-06-22ldb: lay foundation for proper utc/generalized time handlingMatthieu Patou1-0/+1
We use to handle UTCtime and generalized time the same way. The thing is that it's not the case, they are different in the way they are set (most of the time) with different format and also stored and return in different format too.
2012-06-22ldb: add the VERIFY_NAME controlMatthieu Patou1-0/+15
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-10 12:05:41 +0000