source: branches/samba-3.5.x/source3/libads/ldap_utils.c

Last change on this file was 736, checked in by Silvan Scherrer, 13 years ago

Samba Server 3.5: update branche to 3.5.16
File size: 9.9 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 Some Helpful wrappers on LDAP
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Guenther Deschner 2006,2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23#include "includes.h"
24
25#ifdef HAVE_LDAP
26/*
27 a wrapper around ldap_search_s that retries depending on the error code
28 this is supposed to catch dropped connections and auto-reconnect
29*/
30static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
31 const char *expr,
32 const char **attrs, void *args,
33 LDAPMessage **res)
34{
35 ADS_STATUS status = ADS_SUCCESS;
36 int count = 3;
37 char *bp;
38
39 *res = NULL;
40
41 if (!ads->ldap.ld &&
42 time(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
43 return ADS_ERROR(LDAP_SERVER_DOWN);
44 }
45
46 bp = SMB_STRDUP(bind_path);
47
48 if (!bp) {
49 return ADS_ERROR(LDAP_NO_MEMORY);
50 }
51
52 *res = NULL;
53
54 /* when binding anonymously, we cannot use the paged search LDAP
55 * control - Guenther */
56
57 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
58 status = ads_do_search(ads, bp, scope, expr, attrs, res);
59 } else {
60 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
61 }
62 if (ADS_ERR_OK(status)) {
63 DEBUG(5,("Search for %s in <%s> gave %d replies\n",
64 expr, bp, ads_count_replies(ads, *res)));
65 SAFE_FREE(bp);
66 return status;
67 }
68
69 while (--count) {
70
71 if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) && ads->config.ldap_page_size >= 250) {
72 int new_page_size = (ads->config.ldap_page_size / 2);
73 DEBUG(1, ("Reducing LDAP page size from %d to %d due to IO_TIMEOUT\n",
74 ads->config.ldap_page_size, new_page_size));
75 ads->config.ldap_page_size = new_page_size;
76 }
77
78 if (*res)
79 ads_msgfree(ads, *res);
80 *res = NULL;
81
82 DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
83 ads->config.realm, ads_errstr(status)));
84
85 ads_disconnect(ads);
86 status = ads_connect(ads);
87
88 if (!ADS_ERR_OK(status)) {
89 DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
90 ads_errstr(status)));
91 ads_destroy(&ads);
92 SAFE_FREE(bp);
93 return status;
94 }
95
96 *res = NULL;
97
98 /* when binding anonymously, we cannot use the paged search LDAP
99 * control - Guenther */
100
101 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
102 status = ads_do_search(ads, bp, scope, expr, attrs, res);
103 } else {
104 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
105 }
106
107 if (ADS_ERR_OK(status)) {
108 DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
109 expr, bp, ads_count_replies(ads, *res)));
110 SAFE_FREE(bp);
111 return status;
112 }
113 }
114 SAFE_FREE(bp);
115
116 if (!ADS_ERR_OK(status)) {
117 DEBUG(1,("ads reopen failed after error %s\n",
118 ads_errstr(status)));
119 }
120 return status;
121}
122
123 ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
124 int scope, const char *expr,
125 const char **attrs, LDAPMessage **res)
126{
127 return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
128}
129
130 ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
131 int scope, const char *expr,
132 const char **attrs, void *args,
133 LDAPMessage **res)
134{
135 return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
136}
137
138
139 ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
140 const char *expr, const char **attrs)
141{
142 return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
143 expr, attrs, res);
144}
145
146 ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
147 const char *dn,
148 const char **attrs)
149{
150 return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
151 "(objectclass=*)", attrs, res);
152}
153
154 ADS_STATUS ads_search_retry_extended_dn(ADS_STRUCT *ads, LDAPMessage **res,
155 const char *dn,
156 const char **attrs,
157 enum ads_extended_dn_flags flags)
158{
159 ads_control args;
160
161 args.control = ADS_EXTENDED_DN_OID;
162 args.val = flags;
163 args.critical = True;
164
165 return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
166 "(objectclass=*)", attrs, &args, res);
167}
168
169 ADS_STATUS ads_search_retry_dn_sd_flags(ADS_STRUCT *ads, LDAPMessage **res,
170 uint32 sd_flags,
171 const char *dn,
172 const char **attrs)
173{
174 ads_control args;
175
176 args.control = ADS_SD_FLAGS_OID;
177 args.val = sd_flags;
178 args.critical = True;
179
180 return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
181 "(objectclass=*)", attrs, &args, res);
182}
183
184 ADS_STATUS ads_search_retry_extended_dn_ranged(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
185 const char *dn,
186 const char **attrs,
187 enum ads_extended_dn_flags flags,
188 char ***strings,
189 size_t *num_strings)
190{
191 ads_control args;
192
193 args.control = ADS_EXTENDED_DN_OID;
194 args.val = flags;
195 args.critical = True;
196
197 /* we can only range process one attribute */
198 if (!attrs || !attrs[0] || attrs[1]) {
199 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
200 }
201
202 return ads_ranged_search(ads, mem_ctx, LDAP_SCOPE_BASE, dn,
203 "(objectclass=*)", &args, attrs[0],
204 strings, num_strings);
205
206}
207
208 ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
209 const DOM_SID *sid,
210 const char **attrs)
211{
212 char *dn, *sid_string;
213 ADS_STATUS status;
214
215 sid_string = sid_binstring_hex(sid);
216 if (sid_string == NULL) {
217 return ADS_ERROR(LDAP_NO_MEMORY);
218 }
219
220 if (!asprintf(&dn, "<SID=%s>", sid_string)) {
221 SAFE_FREE(sid_string);
222 return ADS_ERROR(LDAP_NO_MEMORY);
223 }
224
225 status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
226 "(objectclass=*)", attrs, res);
227 SAFE_FREE(dn);
228 SAFE_FREE(sid_string);
229 return status;
230}
231
232ADS_STATUS ads_ranged_search(ADS_STRUCT *ads,
233 TALLOC_CTX *mem_ctx,
234 int scope,
235 const char *base,
236 const char *filter,
237 void *args,
238 const char *range_attr,
239 char ***strings,
240 size_t *num_strings)
241{
242 ADS_STATUS status;
243 uint32 first_usn;
244 int num_retries = 0;
245 const char **attrs;
246 bool more_values = False;
247
248 *num_strings = 0;
249 *strings = NULL;
250
251 attrs = TALLOC_ARRAY(mem_ctx, const char *, 3);
252 ADS_ERROR_HAVE_NO_MEMORY(attrs);
253
254 attrs[0] = talloc_strdup(mem_ctx, range_attr);
255 attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
256 attrs[2] = NULL;
257
258 ADS_ERROR_HAVE_NO_MEMORY(attrs[0]);
259 ADS_ERROR_HAVE_NO_MEMORY(attrs[1]);
260
261 do {
262 status = ads_ranged_search_internal(ads, mem_ctx,
263 scope, base, filter,
264 attrs, args, range_attr,
265 strings, num_strings,
266 &first_usn, &num_retries,
267 &more_values);
268
269 if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES, ads_ntstatus(status))) {
270 continue;
271 }
272
273 if (!ADS_ERR_OK(status)) {
274 *num_strings = 0;
275 strings = NULL;
276 goto done;
277 }
278
279 } while (more_values);
280
281 done:
282 DEBUG(10,("returning with %d strings\n", (int)*num_strings));
283
284 return status;
285}
286
287ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
288 TALLOC_CTX *mem_ctx,
289 int scope,
290 const char *base,
291 const char *filter,
292 const char **attrs,
293 void *args,
294 const char *range_attr,
295 char ***strings,
296 size_t *num_strings,
297 uint32 *first_usn,
298 int *num_retries,
299 bool *more_values)
300{
301 LDAPMessage *res = NULL;
302 ADS_STATUS status;
303 int count;
304 uint32 current_usn;
305
306 DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
307
308 *more_values = False;
309
310 status = ads_do_search_retry_internal(ads, base, scope, filter, attrs, args, &res);
311
312 if (!ADS_ERR_OK(status)) {
313 DEBUG(1,("ads_search: %s\n",
314 ads_errstr(status)));
315 return status;
316 }
317
318 if (!res) {
319 return ADS_ERROR(LDAP_NO_MEMORY);
320 }
321
322 count = ads_count_replies(ads, res);
323 if (count == 0) {
324 ads_msgfree(ads, res);
325 return ADS_ERROR(LDAP_SUCCESS);
326 }
327
328 if (*num_strings == 0) {
329 if (!ads_pull_uint32(ads, res, "usnChanged", first_usn)) {
330 DEBUG(1, ("could not pull first usnChanged!\n"));
331 ads_msgfree(ads, res);
332 return ADS_ERROR(LDAP_NO_MEMORY);
333 }
334 }
335
336 if (!ads_pull_uint32(ads, res, "usnChanged", &current_usn)) {
337 DEBUG(1, ("could not pull current usnChanged!\n"));
338 ads_msgfree(ads, res);
339 return ADS_ERROR(LDAP_NO_MEMORY);
340 }
341
342 if (*first_usn != current_usn) {
343 DEBUG(5, ("USN on this record changed"
344 " - restarting search\n"));
345 if (*num_retries < 5) {
346 (*num_retries)++;
347 *num_strings = 0;
348 ads_msgfree(ads, res);
349 return ADS_ERROR_NT(STATUS_MORE_ENTRIES);
350 } else {
351 DEBUG(5, ("USN on this record changed"
352 " - restarted search too many times, aborting!\n"));
353 ads_msgfree(ads, res);
354 return ADS_ERROR(LDAP_NO_MEMORY);
355 }
356 }
357
358 *strings = ads_pull_strings_range(ads, mem_ctx, res,
359 range_attr,
360 *strings,
361 &attrs[0],
362 num_strings,
363 more_values);
364
365 ads_msgfree(ads, res);
366
367 /* paranoia checks */
368 if (*strings == NULL && *more_values) {
369 DEBUG(0,("no strings found but more values???\n"));
370 return ADS_ERROR(LDAP_NO_MEMORY);
371 }
372 if (*num_strings == 0 && *more_values) {
373 DEBUG(0,("no strings found but more values???\n"));
374 return ADS_ERROR(LDAP_NO_MEMORY);
375 }
376
377 return (*more_values) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES) : ADS_ERROR(LDAP_SUCCESS);
378}
379
380#endif
Note: See TracBrowser for help on using the repository browser.