source/libads/ldap_utils.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Some Helpful wrappers on LDAP
   5
   6    Copyright (C) Andrew Tridgell 2001
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24
  25 #ifdef HAVE_LDAP
  26 /*
  27   a wrapper around ldap_search_s that retries depending on the error code
  28   this is supposed to catch dropped connections and auto-reconnect
  29 */
  30 static ADS_STATUS ads_do_search_retry_internal(ADS_STRUCT *ads, const char *bind_path, int scope,
  31                                                const char *expr,
  32                                                const char **attrs, void *args,
  33                                                LDAPMessage **res)
  34 {
  35         ADS_STATUS status = ADS_SUCCESS;
  36         int count = 3;
  37         char *bp;
  38
  39         *res = NULL;
  40
  41         if (!ads->ld &&
  42             time(NULL) - ads->last_attempt < ADS_RECONNECT_TIME) {
  43                 return ADS_ERROR(LDAP_SERVER_DOWN);
  44         }
  45
  46         bp = SMB_STRDUP(bind_path);
  47
  48         if (!bp) {
  49                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
  50         }
  51
  52         *res = NULL;
  53
  54         /* when binding anonymously, we cannot use the paged search LDAP
  55          * control - Guenther */
  56
  57         if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
  58                 status = ads_do_search(ads, bp, scope, expr, attrs, res);
  59         } else {
  60                 status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
  61         }
  62         if (ADS_ERR_OK(status)) {
  63                DEBUG(5,("Search for %s in <%s> gave %d replies\n",
  64                         expr, bp, ads_count_replies(ads, *res)));
  65                 SAFE_FREE(bp);
  66                 return status;
  67         }
  68
  69         while (--count) {
  70
  71                 if (*res)
  72                         ads_msgfree(ads, *res);
  73                 *res = NULL;
  74
  75                 DEBUG(3,("Reopening ads connection to realm '%s' after error %s\n",
  76                          ads->config.realm, ads_errstr(status)));
  77
  78                 if (ads->ld) {
  79                         ldap_unbind(ads->ld);
  80                 }
  81
  82                 ads->ld = NULL;
  83                 status = ads_connect(ads);
  84
  85                 if (!ADS_ERR_OK(status)) {
  86                         DEBUG(1,("ads_search_retry: failed to reconnect (%s)\n",
  87                                  ads_errstr(status)));
  88                         ads_destroy(&ads);
  89                         SAFE_FREE(bp);
  90                         return status;
  91                 }
  92
  93                 *res = NULL;
  94
  95                 /* when binding anonymously, we cannot use the paged search LDAP
  96                  * control - Guenther */
  97
  98                 if (ads->auth.flags & ADS_AUTH_ANON_BIND) {
  99                         status = ads_do_search(ads, bp, scope, expr, attrs, res);
 100                 } else {
 101                         status = ads_do_search_all_args(ads, bp, scope, expr, attrs, args, res);
 102                 }
 103
 104                 if (ADS_ERR_OK(status)) {
 105                         DEBUG(5,("Search for filter: %s, base: %s gave %d replies\n",
 106                                  expr, bp, ads_count_replies(ads, *res)));
 107                         SAFE_FREE(bp);
 108                         return status;
 109                 }
 110         }
 111         SAFE_FREE(bp);
 112
 113         if (!ADS_ERR_OK(status)) {
 114                 DEBUG(1,("ads reopen failed after error %s\n",
 115                          ads_errstr(status)));
 116         }
 117         return status;
 118 }
 119
 120  ADS_STATUS ads_do_search_retry(ADS_STRUCT *ads, const char *bind_path,
 121                                 int scope, const char *expr,
 122                                 const char **attrs, LDAPMessage **res)
 123 {
 124         return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, NULL, res);
 125 }
 126
 127  ADS_STATUS ads_do_search_retry_args(ADS_STRUCT *ads, const char *bind_path,
 128                                      int scope, const char *expr,
 129                                      const char **attrs, void *args,
 130                                      LDAPMessage **res)
 131 {
 132         return ads_do_search_retry_internal(ads, bind_path, scope, expr, attrs, args, res);
 133 }
 134
 135
 136  ADS_STATUS ads_search_retry(ADS_STRUCT *ads, LDAPMessage **res,
 137                              const char *expr, const char **attrs)
 138 {
 139         return ads_do_search_retry(ads, ads->config.bind_path, LDAP_SCOPE_SUBTREE,
 140                                    expr, attrs, res);
 141 }
 142
 143  ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, LDAPMessage **res,
 144                                 const char *dn,
 145                                 const char **attrs)
 146 {
 147         return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
 148                                    "(objectclass=*)", attrs, res);
 149 }
 150
 151  ADS_STATUS ads_search_retry_extended_dn(ADS_STRUCT *ads, LDAPMessage **res,
 152                                          const char *dn,
 153                                          const char **attrs,
 154                                          enum ads_extended_dn_flags flags)
 155 {
 156         ads_control args;
 157
 158         args.control = ADS_EXTENDED_DN_OID;
 159         args.val = flags;
 160         args.critical = True;
 161
 162         return ads_do_search_retry_args(ads, dn, LDAP_SCOPE_BASE,
 163                                         "(objectclass=*)", attrs, &args, res);
 164 }
 165
 166  ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, LDAPMessage **res,
 167                                  const DOM_SID *sid,
 168                                  const char **attrs)
 169 {
 170         char *dn, *sid_string;
 171         ADS_STATUS status;
 172
 173         sid_string = sid_binstring_hex(sid);
 174         if (sid_string == NULL) {
 175                 return ADS_ERROR(LDAP_NO_MEMORY);
 176         }
 177
 178         if (!asprintf(&dn, "<SID=%s>", sid_string)) {
 179                 SAFE_FREE(sid_string);
 180                 return ADS_ERROR(LDAP_NO_MEMORY);
 181         }
 182
 183         status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
 184                                    "(objectclass=*)", attrs, res);
 185         SAFE_FREE(dn);
 186         SAFE_FREE(sid_string);
 187         return status;
 188 }
 189
 190 #endif