source: vendor/current/source3/libads/ldap_utils.c

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.3
File size: 9.7 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 Some Helpful wrappers on LDAP
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Guenther Deschner 2006,2007
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23#include "includes.h"
24#include "ads.h"
25#include "lib/param/loadparm.h"
26
27#ifdef HAVE_LDAP
28
29static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
30 TALLOC_CTX *mem_ctx,
31 int scope,
32 const char *base,
33 const char *filter,
34 const char **attrs,
35 void *args,
36 const char *range_attr,
37 char ***strings,
38 size_t *num_strings,
39 uint32_t *first_usn,
40 int *num_retries,
41 bool *more_values);
42
43/*
44 a wrapper around ldap_search_s that retries depending on the error code
45 this is supposed to catch dropped connections and auto-reconnect
46*/
47static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
48 const char *expr,
49 const char **attrs, void *args,
50 LDAPMessage **res)
51{
52 ADS_STATUS status = ADS_SUCCESS;
53 int count = 3;
54 char *bp;
55
56 *res = NULL;
57
58 if (!ads->ldap.ld &&
59 time_mono(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
60 return ADS_ERROR(LDAP_SERVER_DOWN);
61 }
62
63 bp = SMB_STRDUP(bind_path);
64
65 if (!bp) {
66 return ADS_ERROR(LDAP_NO_MEMORY);
67 }
68
69 *res = NULL;
70
71 /* when binding anonymously, we cannot use the paged search LDAP
72 * control - Guenther */
73
74 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
75 status = ads_do_search(ads, bp, scope, expr, attrs, res);
76 } else {
77 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
78 }
79 if (ADS_ERR_OK(status)) {
80 DEBUG(5,("Search for %s in <%s> gave %d replies\n",
81 expr, bp, ads_count_replies(ads, *res)));
82 SAFE_FREE(bp);
83 return status;
84 }
85
86 while (--count) {
87
88 if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) &&
89 ads->config.ldap_page_size >= (lp_ldap_page_size() / 4) &&
90 lp_ldap_page_size() > 4) {
91 int new_page_size = (ads->config.ldap_page_size / 2);
92 DEBUG(1, ("Reducing LDAP page size from %d to %d due to IO_TIMEOUT\n",
93 ads->config.ldap_page_size, new_page_size));
94 ads->config.ldap_page_size = new_page_size;
95 }
96
97 if (*res)
98 ads_msgfree(ads, *res);
99 *res = NULL;
100
101 DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
102 ads->config.realm, ads_errstr(status)));
103
104 ads_disconnect(ads);
105 status = ads_connect(ads);
106
107 if (!ADS_ERR_OK(status)) {
108 DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
109 ads_errstr(status)));
110 ads_destroy(&ads);
111 SAFE_FREE(bp);
112 return status;
113 }
114
115 *res = NULL;
116
117 /* when binding anonymously, we cannot use the paged search LDAP
118 * control - Guenther */
119
120 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
121 status = ads_do_search(ads, bp, scope, expr, attrs, res);
122 } else {
123 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
124 }
125
126 if (ADS_ERR_OK(status)) {
127 DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
128 expr, bp, ads_count_replies(ads, *res)));
129 SAFE_FREE(bp);
130 return status;
131 }
132 }
133 SAFE_FREE(bp);
134
135 if (!ADS_ERR_OK(status)) {
136 DEBUG(1,("ads reopen failed after error %s\n",
137 ads_errstr(status)));
138 }
139 return status;
140}
141
142 ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
143 int scope, const char *expr,
144 const char **attrs, LDAPMessage **res)
145{
146 return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
147}
148
149static ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
150 int scope, const char *expr,
151 const char **attrs, void *args,
152 LDAPMessage **res)
153{
154 return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
155}
156
157
158 ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
159 const char *expr, const char **attrs)
160{
161 return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
162 expr, attrs, res);
163}
164
165 ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
166 const char *dn,
167 const char **attrs)
168{
169 return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
170 "(objectclass=*)", attrs, res);
171}
172
173 ADS_STATUS ads_search_retry_dn_sd_flags(ADS_STRUCT *ads, LDAPMessage **res,
174 uint32_t sd_flags,
175 const char *dn,
176 const char **attrs)
177{
178 ads_control args;
179
180 args.control = ADS_SD_FLAGS_OID;
181 args.val = sd_flags;
182 args.critical = True;
183
184 return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
185 "(objectclass=*)", attrs, &args, res);
186}
187
188 ADS_STATUS ads_search_retry_extended_dn_ranged(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
189 const char *dn,
190 const char **attrs,
191 enum ads_extended_dn_flags flags,
192 char ***strings,
193 size_t *num_strings)
194{
195 ads_control args;
196
197 args.control = ADS_EXTENDED_DN_OID;
198 args.val = flags;
199 args.critical = True;
200
201 /* we can only range process one attribute */
202 if (!attrs || !attrs[0] || attrs[1]) {
203 return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
204 }
205
206 return ads_ranged_search(ads, mem_ctx, LDAP_SCOPE_BASE, dn,
207 "(objectclass=*)", &args, attrs[0],
208 strings, num_strings);
209
210}
211
212 ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
213 const struct dom_sid *sid,
214 const char **attrs)
215{
216 char *dn, *sid_string;
217 ADS_STATUS status;
218
219 sid_string = sid_binstring_hex_talloc(talloc_tos(), sid);
220 if (sid_string == NULL) {
221 return ADS_ERROR(LDAP_NO_MEMORY);
222 }
223
224 if (!asprintf(&dn, "<SID=%s>", sid_string)) {
225 TALLOC_FREE(sid_string);
226 return ADS_ERROR(LDAP_NO_MEMORY);
227 }
228
229 status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
230 "(objectclass=*)", attrs, res);
231 SAFE_FREE(dn);
232 TALLOC_FREE(sid_string);
233 return status;
234}
235
236ADS_STATUS ads_ranged_search(ADS_STRUCT *ads,
237 TALLOC_CTX *mem_ctx,
238 int scope,
239 const char *base,
240 const char *filter,
241 void *args,
242 const char *range_attr,
243 char ***strings,
244 size_t *num_strings)
245{
246 ADS_STATUS status;
247 uint32_t first_usn;
248 int num_retries = 0;
249 const char **attrs;
250 bool more_values = False;
251
252 *num_strings = 0;
253 *strings = NULL;
254
255 attrs = talloc_array(mem_ctx, const char *, 3);
256 ADS_ERROR_HAVE_NO_MEMORY(attrs);
257
258 attrs[0] = talloc_strdup(mem_ctx, range_attr);
259 attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
260 attrs[2] = NULL;
261
262 ADS_ERROR_HAVE_NO_MEMORY(attrs[0]);
263 ADS_ERROR_HAVE_NO_MEMORY(attrs[1]);
264
265 do {
266 status = ads_ranged_search_internal(ads, mem_ctx,
267 scope, base, filter,
268 attrs, args, range_attr,
269 strings, num_strings,
270 &first_usn, &num_retries,
271 &more_values);
272
273 if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES, ads_ntstatus(status))) {
274 continue;
275 }
276
277 if (!ADS_ERR_OK(status)) {
278 *num_strings = 0;
279 strings = NULL;
280 goto done;
281 }
282
283 } while (more_values);
284
285 done:
286 DEBUG(10,("returning with %d strings\n", (int)*num_strings));
287
288 return status;
289}
290
291static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
292 TALLOC_CTX *mem_ctx,
293 int scope,
294 const char *base,
295 const char *filter,
296 const char **attrs,
297 void *args,
298 const char *range_attr,
299 char ***strings,
300 size_t *num_strings,
301 uint32_t *first_usn,
302 int *num_retries,
303 bool *more_values)
304{
305 LDAPMessage *res = NULL;
306 ADS_STATUS status;
307 int count;
308 uint32_t current_usn;
309
310 DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
311
312 *more_values = False;
313
314 status = ads_do_search_retry_internal(ads, base, scope, filter, attrs, args, &res);
315
316 if (!ADS_ERR_OK(status)) {
317 DEBUG(1,("ads_search: %s\n",
318 ads_errstr(status)));
319 return status;
320 }
321
322 if (!res) {
323 return ADS_ERROR(LDAP_NO_MEMORY);
324 }
325
326 count = ads_count_replies(ads, res);
327 if (count == 0) {
328 ads_msgfree(ads, res);
329 return ADS_ERROR(LDAP_SUCCESS);
330 }
331
332 if (*num_strings == 0) {
333 if (!ads_pull_uint32(ads, res, "usnChanged", first_usn)) {
334 DEBUG(1, ("could not pull first usnChanged!\n"));
335 ads_msgfree(ads, res);
336 return ADS_ERROR(LDAP_NO_MEMORY);
337 }
338 }
339
340 if (!ads_pull_uint32(ads, res, "usnChanged", &current_usn)) {
341 DEBUG(1, ("could not pull current usnChanged!\n"));
342 ads_msgfree(ads, res);
343 return ADS_ERROR(LDAP_NO_MEMORY);
344 }
345
346 if (*first_usn != current_usn) {
347 DEBUG(5, ("USN on this record changed"
348 " - restarting search\n"));
349 if (*num_retries < 5) {
350 (*num_retries)++;
351 *num_strings = 0;
352 ads_msgfree(ads, res);
353 return ADS_ERROR_NT(STATUS_MORE_ENTRIES);
354 } else {
355 DEBUG(5, ("USN on this record changed"
356 " - restarted search too many times, aborting!\n"));
357 ads_msgfree(ads, res);
358 return ADS_ERROR(LDAP_NO_MEMORY);
359 }
360 }
361
362 *strings = ads_pull_strings_range(ads, mem_ctx, res,
363 range_attr,
364 *strings,
365 &attrs[0],
366 num_strings,
367 more_values);
368
369 ads_msgfree(ads, res);
370
371 /* paranoia checks */
372 if (*strings == NULL && *more_values) {
373 DEBUG(0,("no strings found but more values???\n"));
374 return ADS_ERROR(LDAP_NO_MEMORY);
375 }
376 if (*num_strings == 0 && *more_values) {
377 DEBUG(0,("no strings found but more values???\n"));
378 return ADS_ERROR(LDAP_NO_MEMORY);
379 }
380
381 return (*more_values) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES) : ADS_ERROR(LDAP_SUCCESS);
382}
383
384#endif
Note: See TracBrowser for help on using the repository browser.