r21806: I've been working over the last week to fix up the LDAP backend for

Samba4.  This only broke on global catalog queries, which turned out to
be due to changes in the partitions module that metze needed for his
DRSUAPI work.

I've reworked partitions.c to always include the 'problematic' control,
and therefore demonstrated that this is the issue.  This ensures
consistency, and should help with finding issues like this in future.

As this control (DSDB_CONTROL_CURRENT_PARTITION_OID) is not intended to
be linearised, I've added logic to allow it to be skipped when creating
network packets.

I've likewise make our LDAP server skip unknown controls, when marked
'not critical' on it's input, rather than just dropping the entire
request.  I need some help to generate a correct error packet when it is
marked critical.

Further work could perhaps be to have the ldap_encode routine return a
textual description of what failed to encode, as that would have saved
me a lot of time...

Andrew Bartlett
(This used to be commit eef710668f91d1bbaa2d834d9e653e11c8aac817)

1 files changed, 4 insertions, 2 deletions

diff --git a/source4/ldap_server/ldap_server.c b/source4/ldap_server/ldap_server.c
index 4a05ac8851..738215cda5 100644
--- a/source4/ldap_server/ldap_server.c
+++ b/source4/ldap_server/ldap_server.c
@@ -131,6 +131,7 @@ static void ldapsrv_process_message(struct ldapsrv_connection *conn,
 */
 static NTSTATUS ldapsrv_decode(void *private, DATA_BLOB blob)
 {
+	NTSTATUS status;
 	struct ldapsrv_connection *conn = talloc_get_type(private, 
 							  struct ldapsrv_connection);
 	struct asn1_data asn1;
@@ -144,9 +145,10 @@ static NTSTATUS ldapsrv_decode(void *private, DATA_BLOB blob)
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	if (!ldap_decode(&asn1, msg)) {
+	status = ldap_decode(&asn1, msg);
+	if (!NT_STATUS_IS_OK(status)) {
 		asn1_free(&asn1);
-		return NT_STATUS_LDAP(LDAP_PROTOCOL_ERROR);
+		return status;
 	}
 
 	data_blob_free(&blob);