source: trunk/server/source3/libads/ldap_utils.c

Last change on this file was 751, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.9
File size: 9.9 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 Some Helpful wrappers on LDAP
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Guenther Deschner 2006,2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23#include "includes.h"
24#include "ads.h"
25
26#ifdef HAVE_LDAP
27
28static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
29 TALLOC_CTX *mem_ctx,
30 int scope,
31 const char *base,
32 const char *filter,
33 const char **attrs,
34 void *args,
35 const char *range_attr,
36 char ***strings,
37 size_t *num_strings,
38 uint32 *first_usn,
39 int *num_retries,
40 bool *more_values);
41
42/*
43 a wrapper around ldap_search_s that retries depending on the error code
44 this is supposed to catch dropped connections and auto-reconnect
45*/
46static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
47 const char *expr,
48 const char **attrs, void *args,
49 LDAPMessage **res)
50{
51 ADS_STATUS status = ADS_SUCCESS;
52 int count = 3;
53 char *bp;
54
55 *res = NULL;
56
57 if (!ads->ldap.ld &&
58 time_mono(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
59 return ADS_ERROR(LDAP_SERVER_DOWN);
60 }
61
62 bp = SMB_STRDUP(bind_path);
63
64 if (!bp) {
65 return ADS_ERROR(LDAP_NO_MEMORY);
66 }
67
68 *res = NULL;
69
70 /* when binding anonymously, we cannot use the paged search LDAP
71 * control - Guenther */
72
73 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
74 status = ads_do_search(ads, bp, scope, expr, attrs, res);
75 } else {
76 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
77 }
78 if (ADS_ERR_OK(status)) {
79 DEBUG(5,("Search for %s in <%s> gave %d replies\n",
80 expr, bp, ads_count_replies(ads, *res)));
81 SAFE_FREE(bp);
82 return status;
83 }
84
85 while (--count) {
86
87 if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) && ads->config.ldap_page_size >= 250) {
88 int new_page_size = (ads->config.ldap_page_size / 2);
89 DEBUG(1, ("Reducing LDAP page size from %d to %d due to IO_TIMEOUT\n",
90 ads->config.ldap_page_size, new_page_size));
91 ads->config.ldap_page_size = new_page_size;
92 }
93
94 if (*res)
95 ads_msgfree(ads, *res);
96 *res = NULL;
97
98 DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
99 ads->config.realm, ads_errstr(status)));
100
101 ads_disconnect(ads);
102 status = ads_connect(ads);
103
104 if (!ADS_ERR_OK(status)) {
105 DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
106 ads_errstr(status)));
107 ads_destroy(&ads);
108 SAFE_FREE(bp);
109 return status;
110 }
111
112 *res = NULL;
113
114 /* when binding anonymously, we cannot use the paged search LDAP
115 * control - Guenther */
116
117 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
118 status = ads_do_search(ads, bp, scope, expr, attrs, res);
119 } else {
120 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
121 }
122
123 if (ADS_ERR_OK(status)) {
124 DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
125 expr, bp, ads_count_replies(ads, *res)));
126 SAFE_FREE(bp);
127 return status;
128 }
129 }
130 SAFE_FREE(bp);
131
132 if (!ADS_ERR_OK(status)) {
133 DEBUG(1,("ads reopen failed after error %s\n",
134 ads_errstr(status)));
135 }
136 return status;
137}
138
139 ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
140 int scope, const char *expr,
141 const char **attrs, LDAPMessage **res)
142{
143 return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
144}
145
146static ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
147 int scope, const char *expr,
148 const char **attrs, void *args,
149 LDAPMessage **res)
150{
151 return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
152}
153
154
155 ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
156 const char *expr, const char **attrs)
157{
158 return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
159 expr, attrs, res);
160}
161
162 ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
163 const char *dn,
164 const char **attrs)
165{
166 return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
167 "(objectclass=*)", attrs, res);
168}
169
170 ADS_STATUS ads_search_retry_dn_sd_flags(ADS_STRUCT *ads, LDAPMessage **res,
171 uint32 sd_flags,
172 const char *dn,
173 const char **attrs)
174{
175 ads_control args;
176
177 args.control = ADS_SD_FLAGS_OID;
178 args.val = sd_flags;
179 args.critical = True;
180
181 return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
182 "(objectclass=*)", attrs, &args, res);
183}
184
185 ADS_STATUS ads_search_retry_extended_dn_ranged(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
186 const char *dn,
187 const char **attrs,
188 enum ads_extended_dn_flags flags,
189 char ***strings,
190 size_t *num_strings)
191{
192 ads_control args;
193
194 args.control = ADS_EXTENDED_DN_OID;
195 args.val = flags;
196 args.critical = True;
197
198 /* we can only range process one attribute */
199 if (!attrs || !attrs[0] || attrs[1]) {
200 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
201 }
202
203 return ads_ranged_search(ads, mem_ctx, LDAP_SCOPE_BASE, dn,
204 "(objectclass=*)", &args, attrs[0],
205 strings, num_strings);
206
207}
208
209 ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
210 const struct dom_sid *sid,
211 const char **attrs)
212{
213 char *dn, *sid_string;
214 ADS_STATUS status;
215
216 sid_string = sid_binstring_hex(sid);
217 if (sid_string == NULL) {
218 return ADS_ERROR(LDAP_NO_MEMORY);
219 }
220
221 if (!asprintf(&dn, "<SID=%s>", sid_string)) {
222 SAFE_FREE(sid_string);
223 return ADS_ERROR(LDAP_NO_MEMORY);
224 }
225
226 status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
227 "(objectclass=*)", attrs, res);
228 SAFE_FREE(dn);
229 SAFE_FREE(sid_string);
230 return status;
231}
232
233ADS_STATUS ads_ranged_search(ADS_STRUCT *ads,
234 TALLOC_CTX *mem_ctx,
235 int scope,
236 const char *base,
237 const char *filter,
238 void *args,
239 const char *range_attr,
240 char ***strings,
241 size_t *num_strings)
242{
243 ADS_STATUS status;
244 uint32 first_usn;
245 int num_retries = 0;
246 const char **attrs;
247 bool more_values = False;
248
249 *num_strings = 0;
250 *strings = NULL;
251
252 attrs = TALLOC_ARRAY(mem_ctx, const char *, 3);
253 ADS_ERROR_HAVE_NO_MEMORY(attrs);
254
255 attrs[0] = talloc_strdup(mem_ctx, range_attr);
256 attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
257 attrs[2] = NULL;
258
259 ADS_ERROR_HAVE_NO_MEMORY(attrs[0]);
260 ADS_ERROR_HAVE_NO_MEMORY(attrs[1]);
261
262 do {
263 status = ads_ranged_search_internal(ads, mem_ctx,
264 scope, base, filter,
265 attrs, args, range_attr,
266 strings, num_strings,
267 &first_usn, &num_retries,
268 &more_values);
269
270 if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES, ads_ntstatus(status))) {
271 continue;
272 }
273
274 if (!ADS_ERR_OK(status)) {
275 *num_strings = 0;
276 strings = NULL;
277 goto done;
278 }
279
280 } while (more_values);
281
282 done:
283 DEBUG(10,("returning with %d strings\n", (int)*num_strings));
284
285 return status;
286}
287
288static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
289 TALLOC_CTX *mem_ctx,
290 int scope,
291 const char *base,
292 const char *filter,
293 const char **attrs,
294 void *args,
295 const char *range_attr,
296 char ***strings,
297 size_t *num_strings,
298 uint32 *first_usn,
299 int *num_retries,
300 bool *more_values)
301{
302 LDAPMessage *res = NULL;
303 ADS_STATUS status;
304 int count;
305 uint32 current_usn;
306
307 DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
308
309 *more_values = False;
310
311 status = ads_do_search_retry_internal(ads, base, scope, filter, attrs, args, &res);
312
313 if (!ADS_ERR_OK(status)) {
314 DEBUG(1,("ads_search: %s\n",
315 ads_errstr(status)));
316 return status;
317 }
318
319 if (!res) {
320 return ADS_ERROR(LDAP_NO_MEMORY);
321 }
322
323 count = ads_count_replies(ads, res);
324 if (count == 0) {
325 ads_msgfree(ads, res);
326 return ADS_ERROR(LDAP_SUCCESS);
327 }
328
329 if (*num_strings == 0) {
330 if (!ads_pull_uint32(ads, res, "usnChanged", first_usn)) {
331 DEBUG(1, ("could not pull first usnChanged!\n"));
332 ads_msgfree(ads, res);
333 return ADS_ERROR(LDAP_NO_MEMORY);
334 }
335 }
336
337 if (!ads_pull_uint32(ads, res, "usnChanged", &current_usn)) {
338 DEBUG(1, ("could not pull current usnChanged!\n"));
339 ads_msgfree(ads, res);
340 return ADS_ERROR(LDAP_NO_MEMORY);
341 }
342
343 if (*first_usn != current_usn) {
344 DEBUG(5, ("USN on this record changed"
345 " - restarting search\n"));
346 if (*num_retries < 5) {
347 (*num_retries)++;
348 *num_strings = 0;
349 ads_msgfree(ads, res);
350 return ADS_ERROR_NT(STATUS_MORE_ENTRIES);
351 } else {
352 DEBUG(5, ("USN on this record changed"
353 " - restarted search too many times, aborting!\n"));
354 ads_msgfree(ads, res);
355 return ADS_ERROR(LDAP_NO_MEMORY);
356 }
357 }
358
359 *strings = ads_pull_strings_range(ads, mem_ctx, res,
360 range_attr,
361 *strings,
362 &attrs[0],
363 num_strings,
364 more_values);
365
366 ads_msgfree(ads, res);
367
368 /* paranoia checks */
369 if (*strings == NULL && *more_values) {
370 DEBUG(0,("no strings found but more values???\n"));
371 return ADS_ERROR(LDAP_NO_MEMORY);
372 }
373 if (*num_strings == 0 && *more_values) {
374 DEBUG(0,("no strings found but more values???\n"));
375 return ADS_ERROR(LDAP_NO_MEMORY);
376 }
377
378 return (*more_values) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES) : ADS_ERROR(LDAP_SUCCESS);
379}
380
381#endif
Note: See TracBrowser for help on using the repository browser.