Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : Some Helpful wrappers on LDAP
5 :
6 : Copyright (C) Andrew Tridgell 2001
7 : Copyright (C) Guenther Deschner 2006,2007
8 :
9 : This program is free software; you can redistribute it and/or modify
10 : it under the terms of the GNU General Public License as published by
11 : the Free Software Foundation; either version 3 of the License, or
12 : (at your option) any later version.
13 :
14 : This program is distributed in the hope that it will be useful,
15 : but WITHOUT ANY WARRANTY; without even the implied warranty of
16 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 : GNU General Public License for more details.
18 :
19 : You should have received a copy of the GNU General Public License
20 : along with this program. If not, see <http://www.gnu.org/licenses/>.
21 : */
22 :
23 : #include "includes.h"
24 : #include "ads.h"
25 : #include "lib/param/loadparm.h"
26 :
27 : #ifdef HAVE_LDAP
28 :
29 : static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
30 : TALLOC_CTX *mem_ctx,
31 : int scope,
32 : const char *base,
33 : const char *filter,
34 : const char **attrs,
35 : void *args,
36 : const char *range_attr,
37 : char ***strings,
38 : size_t *num_strings,
39 : uint32_t *first_usn,
40 : int *num_retries,
41 : bool *more_values);
42 :
43 : /*
44 : a wrapper around ldap_search_s that retries depending on the error code
45 : this is supposed to catch dropped connections and auto-reconnect
46 : */
47 13 : static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
48 : const char *expr,
49 : const char **attrs, void *args,
50 : LDAPMessage **res)
51 : {
52 : ADS_STATUS status;
53 13 : int count = 3;
54 : char *bp;
55 :
56 13 : *res = NULL;
57 :
58 13 : if (!ads->ldap.ld &&
59 0 : time_mono(NULL) - ads->ldap.last_attempt < ADS_RECONNECT_TIME) {
60 0 : return ADS_ERROR(LDAP_SERVER_DOWN);
61 : }
62 :
63 13 : bp = SMB_STRDUP(bind_path);
64 :
65 13 : if (!bp) {
66 0 : return ADS_ERROR(LDAP_NO_MEMORY);
67 : }
68 :
69 13 : *res = NULL;
70 :
71 : /* when binding anonymously, we cannot use the paged search LDAP
72 : * control - Guenther */
73 :
74 13 : if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
75 0 : status = ads_do_search(ads, bp, scope, expr, attrs, res);
76 : } else {
77 13 : status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
78 : }
79 13 : if (ADS_ERR_OK(status)) {
80 13 : DEBUG(5,("Search for %s in <%s> gave %d replies\n",
81 : expr, bp, ads_count_replies(ads, *res)));
82 13 : SAFE_FREE(bp);
83 13 : return status;
84 : }
85 :
86 0 : while (--count) {
87 :
88 0 : if (NT_STATUS_EQUAL(ads_ntstatus(status), NT_STATUS_IO_TIMEOUT) &&
89 0 : ads->config.ldap_page_size >= (lp_ldap_page_size() / 4) &&
90 0 : lp_ldap_page_size() > 4) {
91 0 : int new_page_size = (ads->config.ldap_page_size / 2);
92 0 : DEBUG(1, ("Reducing LDAP page size from %d to %d due to IO_TIMEOUT\n",
93 : ads->config.ldap_page_size, new_page_size));
94 0 : ads->config.ldap_page_size = new_page_size;
95 : }
96 :
97 0 : if (*res)
98 0 : ads_msgfree(ads, *res);
99 0 : *res = NULL;
100 :
101 0 : DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
102 : ads->config.realm, ads_errstr(status)));
103 :
104 0 : ads_disconnect(ads);
105 0 : status = ads_connect(ads);
106 :
107 0 : if (!ADS_ERR_OK(status)) {
108 0 : DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
109 : ads_errstr(status)));
110 : /*
111 : * We need to keep the ads pointer
112 : * from being freed here as we don't own it and
113 : * callers depend on it being around.
114 : */
115 0 : ads_disconnect(ads);
116 0 : SAFE_FREE(bp);
117 0 : return status;
118 : }
119 :
120 0 : *res = NULL;
121 :
122 : /* when binding anonymously, we cannot use the paged search LDAP
123 : * control - Guenther */
124 :
125 0 : if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
126 0 : status = ads_do_search(ads, bp, scope, expr, attrs, res);
127 : } else {
128 0 : status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
129 : }
130 :
131 0 : if (ADS_ERR_OK(status)) {
132 0 : DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
133 : expr, bp, ads_count_replies(ads, *res)));
134 0 : SAFE_FREE(bp);
135 0 : return status;
136 : }
137 : }
138 0 : SAFE_FREE(bp);
139 :
140 0 : if (!ADS_ERR_OK(status)) {
141 0 : DEBUG(1,("ads reopen failed after error %s\n",
142 : ads_errstr(status)));
143 : }
144 0 : return status;
145 : }
146 :
147 13 : ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
148 : int scope, const char *expr,
149 : const char **attrs, LDAPMessage **res)
150 : {
151 13 : return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
152 : }
153 :
154 0 : static ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
155 : int scope, const char *expr,
156 : const char **attrs, void *args,
157 : LDAPMessage **res)
158 : {
159 0 : return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
160 : }
161 :
162 :
163 0 : ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
164 : const char *expr, const char **attrs)
165 : {
166 0 : return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
167 : expr, attrs, res);
168 : }
169 :
170 0 : ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
171 : const char *dn,
172 : const char **attrs)
173 : {
174 0 : return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
175 : "(objectclass=*)", attrs, res);
176 : }
177 :
178 0 : ADS_STATUS ads_search_retry_dn_sd_flags(ADS_STRUCT *ads, LDAPMessage **res,
179 : uint32_t sd_flags,
180 : const char *dn,
181 : const char **attrs)
182 : {
183 : ads_control args;
184 :
185 0 : args.control = ADS_SD_FLAGS_OID;
186 0 : args.val = sd_flags;
187 0 : args.critical = True;
188 :
189 0 : return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
190 : "(objectclass=*)", attrs, &args, res);
191 : }
192 :
193 0 : ADS_STATUS ads_search_retry_extended_dn_ranged(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
194 : const char *dn,
195 : const char **attrs,
196 : enum ads_extended_dn_flags flags,
197 : char ***strings,
198 : size_t *num_strings)
199 : {
200 : ads_control args;
201 :
202 0 : args.control = ADS_EXTENDED_DN_OID;
203 0 : args.val = flags;
204 0 : args.critical = True;
205 :
206 : /* we can only range process one attribute */
207 0 : if (!attrs || !attrs[0] || attrs[1]) {
208 0 : return ADS_ERROR_NT(NT_STATUS_INVALID_PARAMETER);
209 : }
210 :
211 0 : return ads_ranged_search(ads, mem_ctx, LDAP_SCOPE_BASE, dn,
212 : "(objectclass=*)", &args, attrs[0],
213 : strings, num_strings);
214 :
215 : }
216 :
217 0 : ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
218 : const struct dom_sid *sid,
219 : const char **attrs)
220 : {
221 : char *dn, *sid_string;
222 : ADS_STATUS status;
223 :
224 0 : sid_string = sid_binstring_hex_talloc(talloc_tos(), sid);
225 0 : if (sid_string == NULL) {
226 0 : return ADS_ERROR(LDAP_NO_MEMORY);
227 : }
228 :
229 0 : if (!asprintf(&dn, "<SID=%s>", sid_string)) {
230 0 : TALLOC_FREE(sid_string);
231 0 : return ADS_ERROR(LDAP_NO_MEMORY);
232 : }
233 :
234 0 : status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
235 : "(objectclass=*)", attrs, res);
236 0 : SAFE_FREE(dn);
237 0 : TALLOC_FREE(sid_string);
238 0 : return status;
239 : }
240 :
241 0 : ADS_STATUS ads_ranged_search(ADS_STRUCT *ads,
242 : TALLOC_CTX *mem_ctx,
243 : int scope,
244 : const char *base,
245 : const char *filter,
246 : void *args,
247 : const char *range_attr,
248 : char ***strings,
249 : size_t *num_strings)
250 : {
251 : ADS_STATUS status;
252 : uint32_t first_usn;
253 0 : int num_retries = 0;
254 : const char **attrs;
255 0 : bool more_values = False;
256 :
257 0 : *num_strings = 0;
258 0 : *strings = NULL;
259 :
260 0 : attrs = talloc_array(mem_ctx, const char *, 3);
261 0 : ADS_ERROR_HAVE_NO_MEMORY(attrs);
262 :
263 0 : attrs[0] = talloc_strdup(mem_ctx, range_attr);
264 0 : attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
265 0 : attrs[2] = NULL;
266 :
267 0 : ADS_ERROR_HAVE_NO_MEMORY(attrs[0]);
268 0 : ADS_ERROR_HAVE_NO_MEMORY(attrs[1]);
269 :
270 : do {
271 0 : status = ads_ranged_search_internal(ads, mem_ctx,
272 : scope, base, filter,
273 : attrs, args, range_attr,
274 : strings, num_strings,
275 : &first_usn, &num_retries,
276 : &more_values);
277 :
278 0 : if (NT_STATUS_EQUAL(STATUS_MORE_ENTRIES, ads_ntstatus(status))) {
279 0 : continue;
280 : }
281 :
282 0 : if (!ADS_ERR_OK(status)) {
283 0 : *num_strings = 0;
284 0 : strings = NULL;
285 0 : goto done;
286 : }
287 :
288 0 : } while (more_values);
289 :
290 0 : done:
291 0 : DEBUG(10,("returning with %d strings\n", (int)*num_strings));
292 :
293 0 : return status;
294 : }
295 :
296 0 : static ADS_STATUS ads_ranged_search_internal(ADS_STRUCT *ads,
297 : TALLOC_CTX *mem_ctx,
298 : int scope,
299 : const char *base,
300 : const char *filter,
301 : const char **attrs,
302 : void *args,
303 : const char *range_attr,
304 : char ***strings,
305 : size_t *num_strings,
306 : uint32_t *first_usn,
307 : int *num_retries,
308 : bool *more_values)
309 : {
310 0 : LDAPMessage *res = NULL;
311 : ADS_STATUS status;
312 : int count;
313 : uint32_t current_usn;
314 :
315 0 : DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
316 :
317 0 : *more_values = False;
318 :
319 0 : status = ads_do_search_retry_internal(ads, base, scope, filter, attrs, args, &res);
320 :
321 0 : if (!ADS_ERR_OK(status)) {
322 0 : DEBUG(1,("ads_search: %s\n",
323 : ads_errstr(status)));
324 0 : return status;
325 : }
326 :
327 0 : if (!res) {
328 0 : return ADS_ERROR(LDAP_NO_MEMORY);
329 : }
330 :
331 0 : count = ads_count_replies(ads, res);
332 0 : if (count == 0) {
333 0 : ads_msgfree(ads, res);
334 0 : return ADS_ERROR(LDAP_SUCCESS);
335 : }
336 :
337 0 : if (*num_strings == 0) {
338 0 : if (!ads_pull_uint32(ads, res, "usnChanged", first_usn)) {
339 0 : DEBUG(1, ("could not pull first usnChanged!\n"));
340 0 : ads_msgfree(ads, res);
341 0 : return ADS_ERROR(LDAP_NO_MEMORY);
342 : }
343 : }
344 :
345 0 : if (!ads_pull_uint32(ads, res, "usnChanged", ¤t_usn)) {
346 0 : DEBUG(1, ("could not pull current usnChanged!\n"));
347 0 : ads_msgfree(ads, res);
348 0 : return ADS_ERROR(LDAP_NO_MEMORY);
349 : }
350 :
351 0 : if (*first_usn != current_usn) {
352 0 : DEBUG(5, ("USN on this record changed"
353 : " - restarting search\n"));
354 0 : if (*num_retries < 5) {
355 0 : (*num_retries)++;
356 0 : *num_strings = 0;
357 0 : ads_msgfree(ads, res);
358 0 : return ADS_ERROR_NT(STATUS_MORE_ENTRIES);
359 : } else {
360 0 : DEBUG(5, ("USN on this record changed"
361 : " - restarted search too many times, aborting!\n"));
362 0 : ads_msgfree(ads, res);
363 0 : return ADS_ERROR(LDAP_NO_MEMORY);
364 : }
365 : }
366 :
367 0 : *strings = ads_pull_strings_range(ads, mem_ctx, res,
368 : range_attr,
369 : *strings,
370 : &attrs[0],
371 : num_strings,
372 : more_values);
373 :
374 0 : ads_msgfree(ads, res);
375 :
376 : /* paranoia checks */
377 0 : if (*strings == NULL && *more_values) {
378 0 : DEBUG(0,("no strings found but more values???\n"));
379 0 : return ADS_ERROR(LDAP_NO_MEMORY);
380 : }
381 0 : if (*num_strings == 0 && *more_values) {
382 0 : DEBUG(0,("no strings found but more values???\n"));
383 0 : return ADS_ERROR(LDAP_NO_MEMORY);
384 : }
385 :
386 0 : return (*more_values) ? ADS_ERROR_NT(STATUS_MORE_ENTRIES) : ADS_ERROR(LDAP_SUCCESS);
387 : }
388 :
389 : #endif
|
