Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : Some Helpful wrappers on LDAP
5 :
6 : Copyright (C) Andrew Tridgell 2001
7 : Copyright (C) Guenther Deschner 2006,2007
8 :
9 : This program is free software; you can redistribute it and/or modify
10 : it under the terms of the GNU General Public License as published by
11 : the Free Software Foundation; either version 3 of the License, or
12 : (at your option) any later version.
13 :
14 : This program is distributed in the hope that it will be useful,
15 : but WITHOUT ANY WARRANTY; without even the implied warranty of
16 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 : GNU General Public License for more details.
18 :
19 : You should have received a copy of the GNU General Public License
20 : along with this program. If not, see <http://www.gnu.org/licenses/>.
21 : */
22 :
23 : #include "includes.h"
24 : #include "ads.h"
25 : #include "lib/param/loadparm.h"
26 :
27 : #ifdef HAVE_LDAP
28 :
29 : static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
30 : TALLOC_CTX *mem_ctx,
31 : int scope,
32 : const char *base,
33 : const char *filter,
34 : const char **attrs,
35 : void *args,
36 : const char *range_attr,
37 : char ***strings,
38 : size_t *num_strings,
39 : uint32_t *first_usn,
40 : int *num_retries,
41 : bool *more_values);
42 :
43 : /*
44 : a wrapper around ldap_search_s that retries depending on the error code
45 : this is supposed to catch dropped connections and auto-reconnect
46 : */
47 196 : static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
48 : const char *expr,
49 : const char **attrs, void *args,
50 : LDAPMessage **res)
51 : {
52 : ADS_STATUS status;
53 196 : int count = 3;
54 : char *bp;
55 :
56 196 : *res = NULL;
57 :
58 196 : if (!ads->ldap.ld &&
59 0 : time_mono(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
60 0 : return ADS_ERROR(LDAP_SERVER_DOWN);
61 : }
62 :
63 196 : bp = SMB_STRDUP(bind_path);
64 :
65 196 : if (!bp) {
66 0 : return ADS_ERROR(LDAP_NO_MEMORY);
67 : }
68 :
69 196 : *res = NULL;
70 :
71 : /* when binding anonymously, we cannot use the paged search LDAP
72 : * control - Guenther */
73 :
74 196 : if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
75 0 : status = ads_do_search(ads, bp, scope, expr, attrs, res);
76 : } else {
77 196 : status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
78 : }
79 196 : if (ADS_ERR_OK(status)) {
80 196 : DEBUG(5,("Search for %s in <%s> gave %d replies\n",
81 : expr, bp, ads_count_replies(ads, *res)));
82 196 : SAFE_FREE(bp);
83 196 : return status;
84 : }
85 :
86 0 : while (--count) {
87 :
88 0 : if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) &&
89 0 : ads->config.ldap_page_size >= (lp_ldap_page_size() / 4) &&
90 0 : lp_ldap_page_size() > 4) {
91 0 : int new_page_size = (ads->config.ldap_page_size / 2);
92 0 : DEBUG(1, ("Reducing LDAP page size from %d to %d due to IO_TIMEOUT\n",
93 : ads->config.ldap_page_size, new_page_size));
94 0 : ads->config.ldap_page_size = new_page_size;
95 : }
96 :
97 0 : if (*res)
98 0 : ads_msgfree(ads, *res);
99 0 : *res = NULL;
100 :
101 0 : DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
102 : ads->config.realm, ads_errstr(status)));
103 :
104 0 : ads_disconnect(ads);
105 0 : status = ads_connect(ads);
106 :
107 0 : if (!ADS_ERR_OK(status)) {
108 0 : bool orig_is_mine = ads->is_mine;
109 :
110 0 : DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
111 : ads_errstr(status)));
112 : /*
113 : * We need to keep the ads pointer
114 : * from being freed here as we don't own it and
115 : * callers depend on it being around.
116 : */
117 0 : ads->is_mine = false;
118 0 : ads_destroy(&ads);
119 0 : ads->is_mine = orig_is_mine;
120 0 : SAFE_FREE(bp);
121 0 : return status;
122 : }
123 :
124 0 : *res = NULL;
125 :
126 : /* when binding anonymously, we cannot use the paged search LDAP
127 : * control - Guenther */
128 :
129 0 : if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
130 0 : status = ads_do_search(ads, bp, scope, expr, attrs, res);
131 : } else {
132 0 : status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
133 : }
134 :
135 0 : if (ADS_ERR_OK(status)) {
136 0 : DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
137 : expr, bp, ads_count_replies(ads, *res)));
138 0 : SAFE_FREE(bp);
139 0 : return status;
140 : }
141 : }
142 0 : SAFE_FREE(bp);
143 :
144 0 : if (!ADS_ERR_OK(status)) {
145 0 : DEBUG(1,("ads reopen failed after error %s\n",
146 : ads_errstr(status)));
147 : }
148 0 : return status;
149 : }
150 :
151 80 : ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
152 : int scope, const char *expr,
153 : const char **attrs, LDAPMessage **res)
154 : {
155 80 : return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
156 : }
157 :
158 116 : static ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
159 : int scope, const char *expr,
160 : const char **attrs, void *args,
161 : LDAPMessage **res)
162 : {
163 116 : return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
164 : }
165 :
166 :
167 0 : ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
168 : const char *expr, const char **attrs)
169 : {
170 0 : return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
171 : expr, attrs, res);
172 : }
173 :
174 60 : ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
175 : const char *dn,
176 : const char **attrs)
177 : {
178 60 : return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
179 : "(objectclass=*)", attrs, res);
180 : }
181 :
182 116 : ADS_STATUS ads_search_retry_dn_sd_flags(ADS_STRUCT *ads, LDAPMessage **res,
183 : uint32_t sd_flags,
184 : const char *dn,
185 : const char **attrs)
186 : {
187 : ads_control args;
188 :
189 116 : args.control = ADS_SD_FLAGS_OID;
190 116 : args.val = sd_flags;
191 116 : args.critical = True;
192 :
193 116 : return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
194 : "(objectclass=*)", attrs, &args, res);
195 : }
196 :
197 0 : ADS_STATUS ads_search_retry_extended_dn_ranged(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
198 : const char *dn,
199 : const char **attrs,
200 : enum ads_extended_dn_flags flags,
201 : char ***strings,
202 : size_t *num_strings)
203 : {
204 : ads_control args;
205 :
206 0 : args.control = ADS_EXTENDED_DN_OID;
207 0 : args.val = flags;
208 0 : args.critical = True;
209 :
210 : /* we can only range process one attribute */
211 0 : if (!attrs || !attrs[0] || attrs[1]) {
212 0 : return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
213 : }
214 :
215 0 : return ads_ranged_search(ads, mem_ctx, LDAP_SCOPE_BASE, dn,
216 : "(objectclass=*)", &args, attrs[0],
217 : strings, num_strings);
218 :
219 : }
220 :
221 0 : ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
222 : const struct dom_sid *sid,
223 : const char **attrs)
224 : {
225 : char *dn, *sid_string;
226 : ADS_STATUS status;
227 :
228 0 : sid_string = sid_binstring_hex_talloc(talloc_tos(), sid);
229 0 : if (sid_string == NULL) {
230 0 : return ADS_ERROR(LDAP_NO_MEMORY);
231 : }
232 :
233 0 : if (!asprintf(&dn, "<SID=%s>", sid_string)) {
234 0 : TALLOC_FREE(sid_string);
235 0 : return ADS_ERROR(LDAP_NO_MEMORY);
236 : }
237 :
238 0 : status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
239 : "(objectclass=*)", attrs, res);
240 0 : SAFE_FREE(dn);
241 0 : TALLOC_FREE(sid_string);
242 0 : return status;
243 : }
244 :
245 0 : ADS_STATUS ads_ranged_search(ADS_STRUCT *ads,
246 : TALLOC_CTX *mem_ctx,
247 : int scope,
248 : const char *base,
249 : const char *filter,
250 : void *args,
251 : const char *range_attr,
252 : char ***strings,
253 : size_t *num_strings)
254 : {
255 : ADS_STATUS status;
256 : uint32_t first_usn;
257 0 : int num_retries = 0;
258 : const char **attrs;
259 0 : bool more_values = False;
260 :
261 0 : *num_strings = 0;
262 0 : *strings = NULL;
263 :
264 0 : attrs = talloc_array(mem_ctx, const char *, 3);
265 0 : ADS_ERROR_HAVE_NO_MEMORY(attrs);
266 :
267 0 : attrs[0] = talloc_strdup(mem_ctx, range_attr);
268 0 : attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
269 0 : attrs[2] = NULL;
270 :
271 0 : ADS_ERROR_HAVE_NO_MEMORY(attrs[0]);
272 0 : ADS_ERROR_HAVE_NO_MEMORY(attrs[1]);
273 :
274 : do {
275 0 : status = ads_ranged_search_internal(ads, mem_ctx,
276 : scope, base, filter,
277 : attrs, args, range_attr,
278 : strings, num_strings,
279 : &first_usn, &num_retries,
280 : &more_values);
281 :
282 0 : if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES, ads_ntstatus(status))) {
283 0 : continue;
284 : }
285 :
286 0 : if (!ADS_ERR_OK(status)) {
287 0 : *num_strings = 0;
288 0 : strings = NULL;
289 0 : goto done;
290 : }
291 :
292 0 : } while (more_values);
293 :
294 0 : done:
295 0 : DEBUG(10,("returning with %d strings\n", (int)*num_strings));
296 :
297 0 : return status;
298 : }
299 :
300 0 : static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
301 : TALLOC_CTX *mem_ctx,
302 : int scope,
303 : const char *base,
304 : const char *filter,
305 : const char **attrs,
306 : void *args,
307 : const char *range_attr,
308 : char ***strings,
309 : size_t *num_strings,
310 : uint32_t *first_usn,
311 : int *num_retries,
312 : bool *more_values)
313 : {
314 0 : LDAPMessage *res = NULL;
315 : ADS_STATUS status;
316 : int count;
317 : uint32_t current_usn;
318 :
319 0 : DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
320 :
321 0 : *more_values = False;
322 :
323 0 : status = ads_do_search_retry_internal(ads, base, scope, filter, attrs, args, &res);
324 :
325 0 : if (!ADS_ERR_OK(status)) {
326 0 : DEBUG(1,("ads_search: %s\n",
327 : ads_errstr(status)));
328 0 : return status;
329 : }
330 :
331 0 : if (!res) {
332 0 : return ADS_ERROR(LDAP_NO_MEMORY);
333 : }
334 :
335 0 : count = ads_count_replies(ads, res);
336 0 : if (count == 0) {
337 0 : ads_msgfree(ads, res);
338 0 : return ADS_ERROR(LDAP_SUCCESS);
339 : }
340 :
341 0 : if (*num_strings == 0) {
342 0 : if (!ads_pull_uint32(ads, res, "usnChanged", first_usn)) {
343 0 : DEBUG(1, ("could not pull first usnChanged!\n"));
344 0 : ads_msgfree(ads, res);
345 0 : return ADS_ERROR(LDAP_NO_MEMORY);
346 : }
347 : }
348 :
349 0 : if (!ads_pull_uint32(ads, res, "usnChanged", ¤t_usn)) {
350 0 : DEBUG(1, ("could not pull current usnChanged!\n"));
351 0 : ads_msgfree(ads, res);
352 0 : return ADS_ERROR(LDAP_NO_MEMORY);
353 : }
354 :
355 0 : if (*first_usn != current_usn) {
356 0 : DEBUG(5, ("USN on this record changed"
357 : " - restarting search\n"));
358 0 : if (*num_retries < 5) {
359 0 : (*num_retries)++;
360 0 : *num_strings = 0;
361 0 : ads_msgfree(ads, res);
362 0 : return ADS_ERROR_NT(STATUS_MORE_ENTRIES);
363 : } else {
364 0 : DEBUG(5, ("USN on this record changed"
365 : " - restarted search too many times, aborting!\n"));
366 0 : ads_msgfree(ads, res);
367 0 : return ADS_ERROR(LDAP_NO_MEMORY);
368 : }
369 : }
370 :
371 0 : *strings = ads_pull_strings_range(ads, mem_ctx, res,
372 : range_attr,
373 : *strings,
374 : &attrs[0],
375 : num_strings,
376 : more_values);
377 :
378 0 : ads_msgfree(ads, res);
379 :
380 : /* paranoia checks */
381 0 : if (*strings == NULL && *more_values) {
382 0 : DEBUG(0,("no strings found but more values???\n"));
383 0 : return ADS_ERROR(LDAP_NO_MEMORY);
384 : }
385 0 : if (*num_strings == 0 && *more_values) {
386 0 : DEBUG(0,("no strings found but more values???\n"));
387 0 : return ADS_ERROR(LDAP_NO_MEMORY);
388 : }
389 :
390 0 : return (*more_values) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES) : ADS_ERROR(LDAP_SUCCESS);
391 : }
392 :
393 : #endif
|
