wmi-1.3.16 from opsview.com

Samba/source/cldap_server/cldap_server.c

@@ -0,0 +1,203 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   CLDAP server task
+
+   Copyright (C) Andrew Tridgell	2005
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "libcli/ldap/ldap.h"
+#include "lib/socket/socket.h"
+#include "lib/messaging/irpc.h"
+#include "smbd/service_task.h"
+#include "smbd/service.h"
+#include "cldap_server/cldap_server.h"
+#include "system/network.h"
+#include "lib/socket/netif.h"
+#include "lib/ldb/include/ldb.h"
+#include "lib/ldb/include/ldb_errors.h"
+#include "dsdb/samdb/samdb.h"
+#include "db_wrap.h"
+#include "auth/auth.h"
+
+/*
+  handle incoming cldap requests
+*/
+static void cldapd_request_handler(struct cldap_socket *cldap, 
+				   struct ldap_message *ldap_msg, 
+				   struct socket_address *src)
+{
+	struct ldap_SearchRequest *search;
+	if (ldap_msg->type != LDAP_TAG_SearchRequest) {
+		DEBUG(0,("Invalid CLDAP request type %d from %s:%d\n", 
+			 ldap_msg->type, src->addr, src->port));
+		cldap_error_reply(cldap, ldap_msg->messageid, src,
+				  LDAP_OPERATIONS_ERROR, "Invalid CLDAP request");
+		return;
+	}
+
+	search = &ldap_msg->r.SearchRequest;
+
+	if (strcmp("", search->basedn) != 0) {
+		DEBUG(0,("Invalid CLDAP basedn '%s' from %s:%d\n", 
+			 search->basedn, src->addr, src->port));
+		cldap_error_reply(cldap, ldap_msg->messageid, src,
+				  LDAP_OPERATIONS_ERROR, "Invalid CLDAP basedn");
+		return;
+	}
+
+	if (search->scope != LDAP_SEARCH_SCOPE_BASE) {
+		DEBUG(0,("Invalid CLDAP scope %d from %s:%d\n", 
+			 search->scope, src->addr, src->port));
+		cldap_error_reply(cldap, ldap_msg->messageid, src,
+				  LDAP_OPERATIONS_ERROR, "Invalid CLDAP scope");
+		return;
+	}
+
+	if (search->num_attributes == 1 &&
+	    strcasecmp(search->attributes[0], "netlogon") == 0) {
+		cldapd_netlogon_request(cldap, ldap_msg->messageid,
+					search->tree, src);
+		return;
+	}
+
+	cldapd_rootdse_request(cldap, ldap_msg->messageid,
+			       search, src);
+}
+
+
+/*
+  start listening on the given address
+*/
+static NTSTATUS cldapd_add_socket(struct cldapd_server *cldapd, const char *address)
+{
+	struct cldap_socket *cldapsock;
+	struct socket_address *socket_address;
+	NTSTATUS status;
+
+	/* listen for unicasts on the CLDAP port (389) */
+	cldapsock = cldap_socket_init(cldapd, cldapd->task->event_ctx);
+	NT_STATUS_HAVE_NO_MEMORY(cldapsock);
+
+	socket_address = socket_address_from_strings(cldapsock, cldapsock->sock->backend_name, 
+						     address, lp_cldap_port());
+	if (!socket_address) {
+		talloc_free(cldapsock);
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	status = socket_listen(cldapsock->sock, socket_address, 0, 0);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0,("Failed to bind to %s:%d - %s\n", 
+			 address, lp_cldap_port(), nt_errstr(status)));
+		talloc_free(cldapsock);
+		return status;
+	}
+
+	talloc_free(socket_address);
+
+	cldap_set_incoming_handler(cldapsock, cldapd_request_handler, cldapd);
+
+	return NT_STATUS_OK;
+}
+
+
+/*
+  setup our listening sockets on the configured network interfaces
+*/
+static NTSTATUS cldapd_startup_interfaces(struct cldapd_server *cldapd)
+{
+	int num_interfaces = iface_count();
+	TALLOC_CTX *tmp_ctx = talloc_new(cldapd);
+	NTSTATUS status;
+
+	/* if we are allowing incoming packets from any address, then
+	   we need to bind to the wildcard address */
+	if (!lp_bind_interfaces_only()) {
+		status = cldapd_add_socket(cldapd, "0.0.0.0");
+		NT_STATUS_NOT_OK_RETURN(status);
+	} else {
+		int i;
+
+		for (i=0; i<num_interfaces; i++) {
+			const char *address = talloc_strdup(tmp_ctx, iface_n_ip(i));
+			status = cldapd_add_socket(cldapd, address);
+			NT_STATUS_NOT_OK_RETURN(status);
+		}
+	}
+
+	talloc_free(tmp_ctx);
+
+	return NT_STATUS_OK;
+}
+
+/*
+  startup the cldapd task
+*/
+static void cldapd_task_init(struct task_server *task)
+{
+	struct cldapd_server *cldapd;
+	NTSTATUS status;
+
+	if (iface_count() == 0) {
+		task_server_terminate(task, "cldapd: no network interfaces configured");
+		return;
+	}
+
+	task_server_set_title(task, "task[cldapd]");
+
+	cldapd = talloc(task, struct cldapd_server);
+	if (cldapd == NULL) {
+		task_server_terminate(task, "cldapd: out of memory");
+		return;
+	}
+
+	cldapd->task = task;
+	cldapd->samctx = samdb_connect(cldapd, anonymous_session(cldapd));
+	if (cldapd->samctx == NULL) {
+		task_server_terminate(task, "cldapd failed to open samdb");
+		return;
+	}
+
+	/* start listening on the configured network interfaces */
+	status = cldapd_startup_interfaces(cldapd);
+	if (!NT_STATUS_IS_OK(status)) {
+		task_server_terminate(task, "cldapd failed to setup interfaces");
+		return;
+	}
+
+	irpc_add_name(task->msg_ctx, "cldap_server");
+}
+
+
+/*
+  initialise the cldapd server
+ */
+static NTSTATUS cldapd_init(struct event_context *event_ctx, const struct model_ops *model_ops)
+{
+	return task_server_startup(event_ctx, model_ops, cldapd_task_init);
+}
+
+
+/*
+  register ourselves as a available server
+*/
+NTSTATUS server_service_cldapd_init(void)
+{
+	return register_server_service("cldap", cldapd_init);
+}

Samba/source/cldap_server/cldap_server.h

@@ -0,0 +1,33 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   CLDAP server structures
+
+   Copyright (C) Andrew Tridgell	2005
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "libcli/cldap/cldap.h"
+
+/*
+  top level context structure for the cldap server
+*/
+struct cldapd_server {
+	struct task_server *task;
+	struct ldb_context *samctx;
+};
+
+#include "cldap_server/proto.h"

Samba/source/cldap_server/config.mk

@@ -0,0 +1,16 @@
+# CLDAP server subsystem
+
+#######################
+# Start SUBSYSTEM CLDAPD
+[MODULE::CLDAPD]
+INIT_FUNCTION = server_service_cldapd_init
+SUBSYSTEM = service
+PRIVATE_PROTO_HEADER = proto.h
+OBJ_FILES = \
+		cldap_server.o \
+		netlogon.o \
+		rootdse.o
+PUBLIC_DEPENDENCIES = \
+		LIBCLI_CLDAP LIBNETIF process_model
+# End SUBSYSTEM CLDAPD
+#######################

Samba/source/cldap_server/netlogon.c

@@ -0,0 +1,321 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   CLDAP server - netlogon handling
+
+   Copyright (C) Andrew Tridgell	2005
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "libcli/ldap/ldap.h"
+#include "lib/ldb/include/ldb.h"
+#include "lib/ldb/include/ldb_errors.h"
+#include "lib/events/events.h"
+#include "lib/socket/socket.h"
+#include "smbd/service_task.h"
+#include "cldap_server/cldap_server.h"
+#include "librpc/gen_ndr/ndr_misc.h"
+#include "dsdb/samdb/samdb.h"
+#include "auth/auth.h"
+#include "db_wrap.h"
+#include "system/network.h"
+#include "lib/socket/netif.h"
+
+/*
+  fill in the cldap netlogon union for a given version
+*/
+static NTSTATUS cldapd_netlogon_fill(struct cldapd_server *cldapd,
+				     TALLOC_CTX *mem_ctx,
+				     const char *domain,
+				     const char *domain_guid,
+				     const char *user,
+				     const char *src_address,
+				     uint32_t version,
+				     union nbt_cldap_netlogon *netlogon)
+{
+	const char *ref_attrs[] = {"nETBIOSName", "dnsRoot", "ncName", NULL};
+	const char *dom_attrs[] = {"objectGUID", NULL};
+	struct ldb_message **ref_res, **dom_res;
+	int ret, count = 0;
+	const char **services = lp_server_services();
+	uint32_t server_type;
+	const char *pdc_name;
+	struct GUID domain_uuid;
+	const char *realm;
+	const char *dns_domain;
+	const char *pdc_dns_name;
+	const char *flatname;
+	const char *server_site;
+	const char *client_site;
+	const char *pdc_ip;
+	struct ldb_dn *partitions_basedn;
+
+	partitions_basedn = samdb_partitions_dn(cldapd->samctx, mem_ctx);
+
+	/* the domain has an optional trailing . */
+	if (domain && domain[strlen(domain)-1] == '.') {
+		domain = talloc_strndup(mem_ctx, domain, strlen(domain)-1);
+	}
+
+	if (domain) {
+		struct ldb_result *dom_ldb_result;
+		struct ldb_dn *dom_dn;
+		/* try and find the domain */
+		count = gendb_search(cldapd->samctx, mem_ctx, partitions_basedn, &ref_res, ref_attrs, 
+				   "(&(&(objectClass=crossRef)(dnsRoot=%s))(nETBIOSName=*))", 
+				   domain);
+		if (count == 1) {
+			dom_dn = samdb_result_dn(cldapd->samctx, mem_ctx, ref_res[0], "ncName", NULL);
+			if (!dom_dn) {
+				return NT_STATUS_NO_SUCH_DOMAIN;
+			}
+			ret = ldb_search(cldapd->samctx, dom_dn,
+					 LDB_SCOPE_BASE, "objectClass=domain", 
+					 dom_attrs, &dom_ldb_result);
+			if (ret != LDB_SUCCESS) {
+				DEBUG(2,("Error finding domain '%s'/'%s' in sam: %s\n", domain, ldb_dn_get_linearized(dom_dn), ldb_errstring(cldapd->samctx)));
+				return NT_STATUS_NO_SUCH_DOMAIN;
+			}
+			talloc_steal(mem_ctx, dom_ldb_result);
+			if (dom_ldb_result->count != 1) {
+				DEBUG(2,("Error finding domain '%s'/'%s' in sam\n", domain, ldb_dn_get_linearized(dom_dn)));
+				return NT_STATUS_NO_SUCH_DOMAIN;
+			}
+			dom_res = dom_ldb_result->msgs;
+		}
+	}
+
+	if (count == 0 && domain_guid) {
+		/* OK, so no dice with the name, try and find the domain with the GUID */
+		count = gendb_search(cldapd->samctx, mem_ctx, NULL, &dom_res, dom_attrs, 
+				   "(&(objectClass=domainDNS)(objectGUID=%s))", 
+				   domain_guid);
+		if (count == 1) {
+			/* try and find the domain */
+			ret = gendb_search(cldapd->samctx, mem_ctx, partitions_basedn, &ref_res, ref_attrs, 
+					   "(&(objectClass=crossRef)(ncName=%s))", 
+					   ldb_dn_get_linearized(dom_res[0]->dn));
+			if (ret != 1) {
+				DEBUG(2,("Unable to find referece to '%s' in sam\n",
+					 ldb_dn_get_linearized(dom_res[0]->dn)));
+				return NT_STATUS_NO_SUCH_DOMAIN;
+			}
+		}
+	}
+
+	if (count == 0) {
+		DEBUG(2,("Unable to find domain with name %s or GUID {%s}\n", domain, domain_guid));
+		return NT_STATUS_NO_SUCH_DOMAIN;
+	}
+
+	server_type      = 
+		NBT_SERVER_PDC | NBT_SERVER_GC | 
+		NBT_SERVER_DS | NBT_SERVER_TIMESERV |
+		NBT_SERVER_CLOSEST | NBT_SERVER_WRITABLE | 
+		NBT_SERVER_GOOD_TIMESERV;
+
+	if (str_list_check(services, "ldap")) {
+		server_type |= NBT_SERVER_LDAP;
+	}
+
+	if (str_list_check(services, "kdc")) {
+		server_type |= NBT_SERVER_KDC;
+	}
+
+	pdc_name         = talloc_asprintf(mem_ctx, "\\\\%s", lp_netbios_name());
+	domain_uuid      = samdb_result_guid(dom_res[0], "objectGUID");
+	realm            = samdb_result_string(ref_res[0], "dnsRoot", lp_realm());
+	dns_domain       = samdb_result_string(ref_res[0], "dnsRoot", lp_realm());
+	pdc_dns_name     = talloc_asprintf(mem_ctx, "%s.%s", 
+					   strlower_talloc(mem_ctx, lp_netbios_name()), 
+					   dns_domain);
+
+	flatname         = samdb_result_string(ref_res[0], "nETBIOSName", lp_workgroup());
+	server_site      = "Default-First-Site-Name";
+	client_site      = "Default-First-Site-Name";
+	pdc_ip           = iface_best_ip(src_address);
+
+	ZERO_STRUCTP(netlogon);
+
+	switch (version & 0xF) {
+	case 0:
+	case 1:
+		netlogon->logon1.type        = (user?19+2:19);
+		netlogon->logon1.pdc_name    = pdc_name;
+		netlogon->logon1.user_name   = user;
+		netlogon->logon1.domain_name = flatname;
+		netlogon->logon1.nt_version  = 1;
+		netlogon->logon1.lmnt_token  = 0xFFFF;
+		netlogon->logon1.lm20_token  = 0xFFFF;
+		break;
+	case 2:
+	case 3:
+		netlogon->logon3.type         = (user?19+2:19);
+		netlogon->logon3.pdc_name     = pdc_name;
+		netlogon->logon3.user_name    = user;
+		netlogon->logon3.domain_name  = flatname;
+		netlogon->logon3.domain_uuid  = domain_uuid;
+		netlogon->logon3.forest       = realm;
+		netlogon->logon3.dns_domain   = dns_domain;
+		netlogon->logon3.pdc_dns_name = pdc_dns_name;
+		netlogon->logon3.pdc_ip       = pdc_ip;
+		netlogon->logon3.server_type  = server_type;
+		netlogon->logon3.lmnt_token   = 0xFFFF;
+		netlogon->logon3.lm20_token   = 0xFFFF;
+		break;
+	case 4:
+	case 5:
+	case 6:
+	case 7:
+		netlogon->logon5.type         = (user?23+2:23);
+		netlogon->logon5.server_type  = server_type;
+		netlogon->logon5.domain_uuid  = domain_uuid;
+		netlogon->logon5.forest       = realm;
+		netlogon->logon5.dns_domain   = dns_domain;
+		netlogon->logon5.pdc_dns_name = pdc_dns_name;
+		netlogon->logon5.domain       = flatname;
+		netlogon->logon5.pdc_name     = lp_netbios_name();
+		netlogon->logon5.user_name    = user;
+		netlogon->logon5.server_site  = server_site;
+		netlogon->logon5.client_site  = client_site;
+		netlogon->logon5.lmnt_token   = 0xFFFF;
+		netlogon->logon5.lm20_token   = 0xFFFF;
+		break;
+	default:
+		netlogon->logon13.type         = (user?23+2:23);
+		netlogon->logon13.server_type  = server_type;
+		netlogon->logon13.domain_uuid  = domain_uuid;
+		netlogon->logon13.forest       = realm;
+		netlogon->logon13.dns_domain   = dns_domain;
+		netlogon->logon13.pdc_dns_name = pdc_dns_name;
+		netlogon->logon13.domain       = flatname;
+		netlogon->logon13.pdc_name     = lp_netbios_name();
+		netlogon->logon13.user_name    = user;
+		netlogon->logon13.server_site  = server_site;
+		netlogon->logon13.client_site  = client_site;
+		netlogon->logon13.unknown      = 10;
+		netlogon->logon13.unknown2     = 2;
+		netlogon->logon13.pdc_ip       = pdc_ip;
+		netlogon->logon13.lmnt_token   = 0xFFFF;
+		netlogon->logon13.lm20_token   = 0xFFFF;
+		break;
+	}
+
+	return NT_STATUS_OK;
+}
+
+
+/*
+  handle incoming cldap requests
+*/
+void cldapd_netlogon_request(struct cldap_socket *cldap, 
+			     uint32_t message_id,
+			     struct ldb_parse_tree *tree,
+			     struct socket_address *src)
+{
+	struct cldapd_server *cldapd = talloc_get_type(cldap->incoming.private, struct cldapd_server);
+	int i;
+	const char *domain = NULL;
+	const char *host = NULL;
+	const char *user = NULL;
+	const char *domain_guid = NULL;
+	const char *domain_sid = NULL;
+	int acct_control = -1;
+	int version = -1;
+	union nbt_cldap_netlogon netlogon;
+	NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
+
+	TALLOC_CTX *tmp_ctx = talloc_new(cldap);
+
+	if (tree->operation != LDB_OP_AND) goto failed;
+
+	/* extract the query elements */
+	for (i=0;i<tree->u.list.num_elements;i++) {
+		struct ldb_parse_tree *t = tree->u.list.elements[i];
+		if (t->operation != LDB_OP_EQUALITY) goto failed;
+		if (strcasecmp(t->u.equality.attr, "DnsDomain") == 0) {
+			domain = talloc_strndup(tmp_ctx, 
+						(const char *)t->u.equality.value.data,
+						t->u.equality.value.length);
+		}
+		if (strcasecmp(t->u.equality.attr, "Host") == 0) {
+			host = talloc_strndup(tmp_ctx, 
+					      (const char *)t->u.equality.value.data,
+					      t->u.equality.value.length);
+		}
+		if (strcasecmp(t->u.equality.attr, "DomainGuid") == 0) {
+			NTSTATUS enc_status;
+			struct GUID guid;
+			enc_status = ldap_decode_ndr_GUID(tmp_ctx, 
+							  t->u.equality.value, &guid);
+			if (NT_STATUS_IS_OK(enc_status)) {
+				domain_guid = GUID_string(tmp_ctx, &guid);
+			}
+		}
+		if (strcasecmp(t->u.equality.attr, "DomainSid") == 0) {
+			domain_sid = talloc_strndup(tmp_ctx, 
+						    (const char *)t->u.equality.value.data,
+						    t->u.equality.value.length);
+		}
+		if (strcasecmp(t->u.equality.attr, "User") == 0) {
+			user = talloc_strndup(tmp_ctx, 
+					      (const char *)t->u.equality.value.data,
+					      t->u.equality.value.length);
+		}
+		if (strcasecmp(t->u.equality.attr, "NtVer") == 0 &&
+		    t->u.equality.value.length == 4) {
+			version = IVAL(t->u.equality.value.data, 0);
+		}
+		if (strcasecmp(t->u.equality.attr, "AAC") == 0 &&
+		    t->u.equality.value.length == 4) {
+			acct_control = IVAL(t->u.equality.value.data, 0);
+		}
+	}
+
+	if (domain_guid == NULL && domain == NULL) {
+		domain = lp_realm();
+	}
+
+	if (version == -1) {
+		goto failed;
+	}
+
+	DEBUG(5,("cldap netlogon query domain=%s host=%s user=%s version=%d guid=%s\n",
+		 domain, host, user, version, domain_guid));
+
+	status = cldapd_netlogon_fill(cldapd, tmp_ctx, domain, domain_guid, 
+				      user, src->addr, 
+				      version, &netlogon);
+	if (!NT_STATUS_IS_OK(status)) {
+		goto failed;
+	}
+
+	status = cldap_netlogon_reply(cldap, message_id, src, version,
+				      &netlogon);
+	if (!NT_STATUS_IS_OK(status)) {
+		goto failed;
+	}
+
+	talloc_free(tmp_ctx);
+	return;
+	
+failed:
+	DEBUG(2,("cldap netlogon query failed domain=%s host=%s version=%d - %s\n",
+		 domain, host, version, nt_errstr(status)));
+	talloc_free(tmp_ctx);
+	cldap_empty_reply(cldap, message_id, src);	
+}

Samba/source/cldap_server/rootdse.c

@@ -0,0 +1,185 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   CLDAP server - rootdse handling
+
+   Copyright (C) Stefan Metzmacher	2006
+   
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "libcli/ldap/ldap.h"
+#include "lib/ldb/include/ldb.h"
+#include "lib/ldb/include/ldb_errors.h"
+#include "lib/events/events.h"
+#include "lib/socket/socket.h"
+#include "smbd/service_task.h"
+#include "cldap_server/cldap_server.h"
+#include "librpc/gen_ndr/ndr_misc.h"
+#include "dsdb/samdb/samdb.h"
+#include "auth/auth.h"
+#include "db_wrap.h"
+#include "system/network.h"
+#include "lib/socket/netif.h"
+
+static void cldapd_rootdse_fill(struct cldapd_server *cldapd,
+				TALLOC_CTX *mem_ctx,
+				struct ldap_SearchRequest *search,
+				struct ldap_SearchResEntry **response,
+				struct ldap_Result *result)
+{
+	struct ldap_SearchResEntry *ent = NULL;
+	struct ldb_dn *basedn;
+	struct ldb_result *res = NULL;
+	struct ldb_request *lreq;
+	enum ldb_scope scope = LDB_SCOPE_DEFAULT;
+	const char **attrs = NULL;
+	const char *errstr = NULL;
+	int ret = 0;
+	int ldb_ret = -1;
+
+	basedn = ldb_dn_new(mem_ctx, cldapd->samctx, NULL);
+	if (basedn == NULL) goto nomem;
+	scope = LDB_SCOPE_BASE;
+
+	if (search->num_attributes >= 1) {
+		int i;
+
+		attrs = talloc_array(mem_ctx, const char *, search->num_attributes+1);
+		if (attrs == NULL) goto nomem;
+
+		for (i=0; i < search->num_attributes; i++) {
+			attrs[i] = search->attributes[i];
+		}
+		attrs[i] = NULL;
+	}
+
+	lreq = talloc(mem_ctx, struct ldb_request);
+	if (lreq == NULL) goto nomem;
+
+	res = talloc_zero(mem_ctx, struct ldb_result);
+	if (res == NULL) goto nomem;
+
+	lreq->operation = LDB_SEARCH;
+	lreq->op.search.base = basedn;
+	lreq->op.search.scope = scope;
+	lreq->op.search.tree = search->tree;
+	lreq->op.search.attrs = attrs;
+
+	lreq->controls = NULL;
+
+	lreq->context = res;
+	lreq->callback = ldb_search_default_callback;
+
+	/* Copy the timeout from the incoming call */
+	ldb_set_timeout(cldapd->samctx, lreq, search->timelimit);
+
+	ldb_ret = ldb_request(cldapd->samctx, lreq);
+	if (ldb_ret != LDB_SUCCESS) {
+		goto reply;
+	}
+
+	ldb_ret = ldb_wait(lreq->handle, LDB_WAIT_ALL);
+	if (ldb_ret != LDB_SUCCESS) {
+		goto reply;
+	}
+
+	if (res->count > 1) {
+		errstr = "Internal error: to much replies";
+		ldb_ret = LDB_ERR_OTHER;
+		goto reply;
+	} else if (res->count == 1) {
+		int j;
+
+		ent = talloc(mem_ctx, struct ldap_SearchResEntry);
+		if (ent == NULL) goto nomem;
+
+		ent->dn = ldb_dn_alloc_linearized(ent, res->msgs[0]->dn);
+		if (ent->dn == NULL) goto nomem;
+		ent->num_attributes = 0;
+		ent->attributes = NULL;
+		if (res->msgs[0]->num_elements == 0) {
+			goto reply;
+		}
+		ent->num_attributes = res->msgs[0]->num_elements;
+		ent->attributes = talloc_array(ent, struct ldb_message_element, ent->num_attributes);
+		if (ent->attributes == NULL) goto nomem;
+		for (j=0; j < ent->num_attributes; j++) {
+			ent->attributes[j].name = talloc_steal(ent->attributes, res->msgs[0]->elements[j].name);
+			ent->attributes[j].num_values = 0;
+			ent->attributes[j].values = NULL;
+			if (search->attributesonly && (res->msgs[0]->elements[j].num_values == 0)) {
+				continue;
+			}
+			ent->attributes[j].num_values = res->msgs[0]->elements[j].num_values;
+			ent->attributes[j].values = res->msgs[0]->elements[j].values;
+			talloc_steal(ent->attributes, res->msgs[0]->elements[j].values);
+		}
+	}
+
+reply:
+	if (ret) {
+		/* nothing ... */
+	} else if (ldb_ret == LDB_SUCCESS) {
+		ret = LDAP_SUCCESS;
+		errstr = NULL;
+	} else {
+		ret = ldb_ret;
+		errstr = ldb_errstring(cldapd->samctx);
+	}
+	goto done;
+nomem:
+	talloc_free(ent);
+	ret = LDAP_OPERATIONS_ERROR;
+	errstr = "No memory";
+done:
+	*response = ent;
+	result->resultcode = ret;
+	result->errormessage = (errstr?talloc_strdup(mem_ctx, errstr):NULL);
+}
+
+/*
+  handle incoming cldap requests
+*/
+void cldapd_rootdse_request(struct cldap_socket *cldap, 
+			    uint32_t message_id,
+			    struct ldap_SearchRequest *search,
+			    struct socket_address *src)
+{
+	struct cldapd_server *cldapd = talloc_get_type(cldap->incoming.private, struct cldapd_server);
+	NTSTATUS status;
+	struct cldap_reply reply;
+	struct ldap_Result result;
+	TALLOC_CTX *tmp_ctx = talloc_new(cldap);
+
+	ZERO_STRUCT(result);
+
+	reply.messageid		= message_id;
+	reply.dest		= src;
+	reply.response		= NULL;
+	reply.result		= &result;
+
+	cldapd_rootdse_fill(cldapd, tmp_ctx, search, &reply.response, reply.result);
+
+	status = cldap_reply_send(cldap, &reply);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(2,("cldap rootdse query failed '%s' - %s\n",
+			 ldb_filter_from_tree(tmp_ctx, search->tree), nt_errstr(status)));
+	}
+
+	talloc_free(tmp_ctx);
+	return;
+}